Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Arch Linux Now Believes Malware Incident Under Control: More Than 1,500 Packages

phoronix.com

Post reply on HN
Print view View original

101–110 of 227 posts

Re: Arch Linux Now Believes Malware Incident Under Control: More Than 1,500 Packages

#101

Post by naturalmovement »

yowo wrote: post #96
blcknight wrote: post #74

Earlier quoted context omitted.

"Review" them how? Read every single line of code before installing something? If it's a binary package, how do you do that? Make reproducible builds for everything you install? Move to from source distro? Putting this on users is not a tenable solution. There's room for common sense, but blaming the users for this is ridiculous

This is like saying a user who clone a random git repo is not to blame and git-scm should do more to prevent cloning of malicious repos. If it is not official, it is your job to review, if you dont like it, use iOS instead of Arch Linux. If you crash your car, you are liable for the accident. If you aren't ready for that, take the bus. More power = more responsibility

Uh but this isn't random git repos these are packages available through the OS's repos. Why does the AUR even exist if not for malware distribution?

It's an uncontrolled free-for-all disguised as a watering hole. If they can't do the most basic of housekeeping it should not exist full stop.

Re: Arch Linux Now Believes Malware Incident Under Control: More Than 1,500 Packages

#102

Post by naturalmovement »

kcyb wrote: post #84
blcknight wrote: post #74

Earlier quoted context omitted.

"Review" them how? Read every single line of code before installing something? If it's a binary package, how do you do that? Make reproducible builds for everything you install? Move to from source distro? Putting this on users is not a tenable solution. There's room for common sense, but blaming the users for this is ridiculous

As an arch user, I would always skim the PKGBUILD file of AUR packages to see if they install the software they claim to install from official sources and if there's something obviously fishy.

The BSDs prevent this by never having allowed random jamokes to upload Makefiles into the ports system.

Re: Arch Linux Now Believes Malware Incident Under Control: More Than 1,500 Packages

#103

Post by Hackbraten »

naturalmovement wrote: post #101
yowo wrote: post #96

Earlier quoted context omitted.

This is like saying a user who clone a random git repo is not to blame and git-scm should do more to prevent cloning of malicious repos. If it is not official, it is your job to review, if you dont like it, use iOS instead of Arch Linux. If you crash your car, you are liable for the accident. If you aren't ready for that, take the bus. More power = more responsibility

Uh but this isn't random git repos these are packages available through the OS's repos. Why does the AUR even exist if not for malware distribution? It's an uncontrolled free-for-all disguised as a watering hole. If they can't do the most basic of housekeeping it should not exist full stop.

> these are packages

PKGBUILDs are not packages. They’re (user-contributed) instructions on how to build packages.

> available through the OS's repos.

No. The AUR is a platform, similarly to NPM or PyPI, that allows users to upload PKGBUILDs. It is not part of “the OS’s repos,” and it says that loud and clear, multiple times, including on the front page.

Re: Arch Linux Now Believes Malware Incident Under Control: More Than 1,500 Packages

#104

Post by Gud »

embedding-shape wrote: post #2

As always a fair reminder to not install random 3rd party packages/libraries/applications without reviewing them, especially when there is zero vetting. Luckily this was constrained to AUR, which basically is a free-for-all package repository, with users being warned multiple times that it's vital to review anything before you install it, compared to the official repositories. `rua` and other similar CLIs make it rea…

So easy to say.

For a distro this popular I’m surprised how much is in unofficial repos(AUR) and not the official ones.

Re: Arch Linux Now Believes Malware Incident Under Control: More Than 1,500 Packages

#105

Post by Slothrop99 »

sam_lowry_ wrote: post #86
glitchc wrote: post #81

Earlier quoted context omitted.

This is great but ultimately unactionable advice, which makes it worse than useless because it sounds good at first brush but upon inspection turns out to be ridiculous. There is more code out there than is readable by any human being in their lifetime. I'm willing to bet you yourself have read <1% of the source code currently running on your computers. Does this mean you have stopped using your computer(s)? How can…

As someone already explained in a sibling comment, Arch Linux AUR packages are simple shell scripts that download source code from upstream, apply patches and install. I review them every time I have to install from AUR.

If I understand, the malware is installed via npm from some subshell. But yeah I totally believe you have a detailed review of every package-lock.json and etc.

Re: Arch Linux Now Believes Malware Incident Under Control: More Than 1,500 Packages

#106

Post by Hackbraten »

bawolff wrote: post #90
sam_lowry_ wrote: post #86

Earlier quoted context omitted.

As someone already explained in a sibling comment, Arch Linux AUR packages are simple shell scripts that download source code from upstream, apply patches and install. I review them every time I have to install from AUR.

And what if upstream is problematic? Even if it stops this particular attack, reading just the AUR file feels like fighting yesterday's war. I don't think advice to the effect of, just read the parts of the code that have been used in attacks in the past but blindly trust everything else, makes a lot of sense.

> And what if upstream is problematic?

Then don’t install the package.

It’s on you to decide whether you trust upstream or not.

You’re free to use any scanner you want on the upstream sources if it makes you feel safer. (I’m currently working on a makepkg extension that allows just that.)

The core and extra repos are curated, and every package maintainer is doing their due diligence (and more) to protect the users. But on the AUR, nobody is going to do that work for you.

Re: Arch Linux Now Believes Malware Incident Under Control: More Than 1,500 Packages

#107

Post by naturalmovement »

Hackbraten wrote: post #103
naturalmovement wrote: post #101

Earlier quoted context omitted.

Uh but this isn't random git repos these are packages available through the OS's repos. Why does the AUR even exist if not for malware distribution? It's an uncontrolled free-for-all disguised as a watering hole. If they can't do the most basic of housekeeping it should not exist full stop.

> these are packages PKGBUILDs are not packages. They’re (user-contributed) instructions on how to build packages. > available through the OS's repos. No. The AUR is a platform, similarly to NPM or PyPI, that allows users to upload PKGBUILDs. It is not part of “the OS’s repos,” and it says that loud and clear, multiple times, including on the front page.

[flagged]

Re: Arch Linux Now Believes Malware Incident Under Control: More Than 1,500 Packages

#108

Post by Slothrop99 »

jorams wrote: post #59
mcv wrote: post #54

Earlier quoted context omitted.

It's still surprising someone was able to infect so many packages. But I admit I don't really know how AUR works. Can anyone with access simply update anything? Do packages not have owners who check contributions?

Packages in the AUR have some number of maintainers. When a maintainer no longer wants to maintain the package they can disown it, and when all maintainers do so the package becomes orphaned. An orphaned package can then be adopted by any user. At any time there's a large number of orphaned packages in the AUR, and the attacker(s) targeted those.

Obviously way too easy to take over these 'orphaned' packages if it can be done in an automated manner. GitHub/NPM/etc doesn't have this issue, they need to stop equivicating. Sounds more like an anonymous FTP site.

Re: Arch Linux Now Believes Malware Incident Under Control: More Than 1,500 Packages

#109

Post by exceptione »

bawolff wrote: post #90
sam_lowry_ wrote: post #86

Earlier quoted context omitted.

As someone already explained in a sibling comment, Arch Linux AUR packages are simple shell scripts that download source code from upstream, apply patches and install. I review them every time I have to install from AUR.

And what if upstream is problematic? Even if it stops this particular attack, reading just the AUR file feels like fighting yesterday's war. I don't think advice to the effect of, just read the parts of the code that have been used in attacks in the past but blindly trust everything else, makes a lot of sense.

  > And what if upstream is problematic?
That would be the same problem for official packages. Unless I am mistaken, the difference between maintainers for the official repos versus AUR, is that the former is a trusted/vetted person. But afaik, they also just package upstream software. I doubt they will read through tons of commits to see if there might be anything nefarious there.

It would be better if software would be forced to have something like a very advanced manifest file, with requested permissions. Malware has to eventually communicate with endpoints, so a declared whitelist of endpoints should definitely be part of such a manifest. Some wrapper program could set up a namespaces that allows just what is requested. Any software that requires `endpoints = [.*]` would make it obvious to the user that it is a really dangerous piece of software. Your code editor should not ship like that.

The first thing I can think of in this direction is flatpak, but that is really coarse grained, with defaults that are very lax. Also flatpak-like solutions do not expose an api to the wrapped application, which is both a pro and a con (a con when you consider installing application plugins requiring further permissions).

Re: Arch Linux Now Believes Malware Incident Under Control: More Than 1,500 Packages

#110

Post by exceptione »

Hackbraten wrote: post #106
bawolff wrote: post #90

Earlier quoted context omitted.

And what if upstream is problematic? Even if it stops this particular attack, reading just the AUR file feels like fighting yesterday's war. I don't think advice to the effect of, just read the parts of the code that have been used in attacks in the past but blindly trust everything else, makes a lot of sense.

> And what if upstream is problematic? Then don’t install the package. It’s on you to decide whether you trust upstream or not. You’re free to use any scanner you want on the upstream sources if it makes you feel safer. (I’m currently working on a makepkg extension that allows just that.) The core and extra repos are curated, and every package maintainer is doing their due diligence (and more) to protect the users. B…

> doing their due diligence (and more)

Do you know how? This sounds like an unpractical high amount of time consuming task.

Post reply on HN