Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Firefox-patch-bin, librewolf-fix-bin AUR packages contain malware

lists.archlinux.org

Post reply on HN
Print view View original

131–140 of 142 posts

Re: Firefox-patch-bin, librewolf-fix-bin AUR packages contain malware

#131

Post by michaelmrose »

RandyOrion wrote: post #123

Comments below is from the perspective of an arch Linux user, not maintainer or authors of some software. When installing softwares on arch Linux, first searching for official packages provided by Arch Linux maintainers, then official installation methods approved by authors of the software, or AURs which do the installation in the exact way as the authors of the software describe. A search on the default installatio…

This shouldn't reasonably be considered secure because it isn't altogether hard to obscure the nature of the attack until someone notices they are compromised.

Re: Firefox-patch-bin, librewolf-fix-bin AUR packages contain malware

#132

Post by michaelmrose »

jabjq wrote: post #2

> We strongly encourage users that may have installed one of these packages […] to take the necessary measures in order to ensure they were not compromised. How are they supposed to do that when you give them no information as to what the malware does?

It's a remote access trojan. There is no acceptable way to be sure of removal short of full reinstalling every OS installed and reinstalling or rebuilding stuff in the Home dir from known good sources.

Re: Firefox-patch-bin, librewolf-fix-bin AUR packages contain malware

#133

Post by johnisgood »

bee_rider wrote: post #127
akerl_ wrote: post #105

Earlier quoted context omitted.

Yay is a 3rd party package manager. The 1st party package manager does not interact with the AUR. Yay itself is in the AUR. You have to go out of your way to install it. The Archlinux docs on AUR helpers lead with a red warning: https://wiki.archlinux.org/title/AUR_helpers

Oh, I thought it was a package from the repo. (I didn’t use any of those third party package managers, just stuck to manually doing everything when using the AUR, which was fine because I used it sparingly).

No, and these AUR helpers are not even official packages in the official repository.

Re: Firefox-patch-bin, librewolf-fix-bin AUR packages contain malware

#134

Post by johnisgood »

LargoLasskhyfv wrote: post #129
johnisgood wrote: post #79

Earlier quoted context omitted.

I find it odd to call a specific Linux distribution blazingly fast. Gentoo with make.conf (/etc/portage/make.conf[1]) having "CFLAGS="-O3 -march=native -flto"" means that Gentoo, a Linux distribution, is performant? [1] It is not a good idea to build everything with LTO or PGO enabled because not all packages support LTO / PGO cleanly. Do it on the basis of per-package.

Does Gentoo have binpkgs with these compileflags? With CachyOS you don't have to compile, because it's a rolling binary distro. Regarding your [1]: They do that, systemd(or parts of it) are unoptimized, for instance. They don't apply that stuff blindly, only where it works. For me it feels blazingly fast, even on obsolete KabyLake Core-I5/7(t) forcibly clocked down to about 800Mhz most of the times :) It fucking flie…

Actually, there are binpkgs, now: https://wiki.gentoo.org/wiki/Gentoo_Binary_Host_Quickstart.

My i3 with vim / emacs and even VSCodium flies too, on X Linux. :P

The browser is always the slowest in my case and this has always been my experience, and unfortunately it still is.

Re: Firefox-patch-bin, librewolf-fix-bin AUR packages contain malware

#135

Post by LargoLasskhyfv »

johnisgood wrote: post #134
LargoLasskhyfv wrote: post #129

Earlier quoted context omitted.

Does Gentoo have binpkgs with these compileflags? With CachyOS you don't have to compile, because it's a rolling binary distro. Regarding your [1]: They do that, systemd(or parts of it) are unoptimized, for instance. They don't apply that stuff blindly, only where it works. For me it feels blazingly fast, even on obsolete KabyLake Core-I5/7(t) forcibly clocked down to about 800Mhz most of the times :) It fucking flie…

Actually, there are binpkgs, now: https://wiki.gentoo.org/wiki/Gentoo_Binary_Host_Quickstart . My i3 with vim / emacs and even VSCodium flies too, on X Linux. :P The browser is always the slowest in my case and this has always been my experience, and unfortunately it still is.

Good for you. The 'oh-so-slow' regarding FF was meant as satirical btw. With what I'm using it for, it doesn't lag. Maybe because of https://github.com/graysky2/profile-sync-daemon mostly, and some other fine-tunings, which make it not touching the filesystem over and over again. I really recommend PSD. Not even insane amounts of RAM, it usually takes about 4 to 5GB, rarely going to 8, then shrinking back a while after closing too much tabs. Imagine that!1!! It's all about some sysctl settings :-)

Sideberry (Tree-Style-Tabs like extension) was the ugliest offender there. Though that may have been me misconfiguring it. OTOH I didn't manage to find settings where it didn't do that, and still looked like I wanted it to. At that time, maybe a year ago, I've thought of it as potential 'instant ssd-killer'. Couldn't be bothered. Deinstalled. Now FF has some basic version of vertical tabs by Mozilla itself. It suffices(for now).

Re: Firefox-patch-bin, librewolf-fix-bin AUR packages contain malware

#136

Post by pndy »

nulld3v wrote: post #124
Shellban wrote: post #119

Earlier quoted context omitted.

Whether or not SteamOS installed them is irrelevant. All the hacker would need is to compromise a machine that had some sort of remote access to other devices (ssh in this case, with some sort of keylogger to decrypt the private key).

You are not compromised unless you specifically installed one of these 3 packages on one of your machines: - librewolf-fix-bin - firefox-patch-bin - zen-browser-patched-bin The packages were only available for download for 3 days, and the only way you could have installed them is if you explicitly typed one of the package names into your terminal within those 3 days. Did you do that? If no, then you are not compromis…

I wonder if this is really about compromised packages or rather in wider view trying to paint Arch, AUR as insecure.

Re: Firefox-patch-bin, librewolf-fix-bin AUR packages contain malware

#137

Post by abacate »

homebrewer wrote: post #126
WD-42 wrote: post #99

Earlier quoted context omitted.

And what distro does package those? That's what Flatpak is for. If you must install crappy proprietary software, at least get an official package from the developer.

> And what distro does package those? nix, which has its own share of problems.

> nix, which has its own share of problems.

Care to elaborate?

Re: Firefox-patch-bin, librewolf-fix-bin AUR packages contain malware

#138

Post by defraudbah »

gus_ wrote: post #100
defraudbah wrote: post #50

i installed a lot of cra* from aur in the past, wouldn't be surprised if i got a malware somewhere. Strange thing, I don't think open snitch would even help in such situation.. and official repo does not have enough packages to run arch :\ I don't want to go back to ubuntu

I haven't taken a look at the malware, but it seems to download files from the Internet so it should have warned you to allow/deny the outbound connections. It'd be nice to test it with a sample of aur package/malware.

it does, I am using it extensively (little snitch on mac, and open snitch on linux). My problem with it is that every new tool wants to connect to the internet and my terminal is the constant source of outbound connections. I try to review everything but the amount of tools and connections is overwhelming. It does limit the risk, but i do not trust my terminal and dev tools as usually i give them way too many permissions and any plugin or tool from AUR can contain malware

PS. Regarding downloading files from internet, every self-update tool does that nowadays, it becomes more common because of apple/others stores policies. I created a few remote control tools and it is very very difficult to caught them, and I am not even a professional malware researcher. Things they do is beyond understanding of average superuser

Re: Firefox-patch-bin, librewolf-fix-bin AUR packages contain malware

#139

Post by johnisgood »

LargoLasskhyfv wrote: post #135
johnisgood wrote: post #134

Earlier quoted context omitted.

Actually, there are binpkgs, now: https://wiki.gentoo.org/wiki/Gentoo_Binary_Host_Quickstart . My i3 with vim / emacs and even VSCodium flies too, on X Linux. :P The browser is always the slowest in my case and this has always been my experience, and unfortunately it still is.

Good for you. The 'oh-so-slow' regarding FF was meant as satirical btw. With what I'm using it for, it doesn't lag. Maybe because of https://github.com/graysky2/profile-sync-daemon mostly, and some other fine-tunings, which make it not touching the filesystem over and over again. I really recommend PSD. Not even insane amounts of RAM, it usually takes about 4 to 5GB, rarely going to 8, then shrinking back a while aft…

Thanks, PSD looks interesting. I only have 8 GB RAM at the moment, I will see if my motherboard supports more (it should support 16 GB at the very least). After the RAM upgrade, I will probably use PSD. Or is there a way to specify how many RAM it can use?

As for tabs, I like the way Vivaldi does it and allows me to customize.

Re: Firefox-patch-bin, librewolf-fix-bin AUR packages contain malware

#140

Post by LargoLasskhyfv »

johnisgood wrote: post #139
LargoLasskhyfv wrote: post #135

Earlier quoted context omitted.

Good for you. The 'oh-so-slow' regarding FF was meant as satirical btw. With what I'm using it for, it doesn't lag. Maybe because of https://github.com/graysky2/profile-sync-daemon mostly, and some other fine-tunings, which make it not touching the filesystem over and over again. I really recommend PSD. Not even insane amounts of RAM, it usually takes about 4 to 5GB, rarely going to 8, then shrinking back a while aft…

Thanks, PSD looks interesting. I only have 8 GB RAM at the moment, I will see if my motherboard supports more (it should support 16 GB at the very least). After the RAM upgrade, I will probably use PSD. Or is there a way to specify how many RAM it can use? As for tabs, I like the way Vivaldi does it and allows me to customize.

Hrrm. My comment was supoptimal, I guess.

By "Not even insane amounts of RAM, it usually takes about 4 to 5GB, rarely going to 8, then shrinking back a while after closing too much tabs." I meant to say that this applies to the resident size in RAM of the whole browser, not what PSD does, or adds. That would be just what your browser profile is using 'on disk'. Peanuts, so to speak.

With only 8GB it's really hard to tell. It depends on your usage patterns.

First, regarding just PSD, it relies on RuntimeDirectorySize= of https://man.archlinux.org/man/logind.conf.5 which by default is limited to use up to 10% of system memory, but not statically reserved, only "on demand".

Which in turn relies on tmpfs which can use up to half of system RAM by default. Again, on demand only, not statically reserved.

https://wiki.archlinux.org/title/Tmpfs https://wiki.gentoo.org/wiki/Tmpfs

However, I think these are the wrong knobs to turn :-)

PSD can make use of overlayfs, which saves a little bit of used RAM, and is faster to initially sync, but uses more disk space then. But not that much. Which can be further minimized by the number of kept profile backups, or not using backups at all.

Just keep your profile lean and mean, then there's less stuff to shuffle around. Since your'e using Vivaldi, pointing you to wikipages how to make Firefox use less RAM seems pointless ;)

Maybe (carefully) use something like https://www.bleachbit.org for cleaning up Vivalidis profile.

Which leaves things like

https://en.wikipedia.org/wiki/Zram https://wiki.archlinux.org/title/Zram https://wiki.gentoo.org/wiki/Zram https://www.kernel.org/doc/html/latest/admin-guide/blockdev/...

OR

https://en.wikipedia.org/wiki/Zswap https://wiki.archlinux.org/title/Zswap https://wiki.gentoo.org/wiki/Zswap https://docs.kernel.org/admin-guide/mm/zswap.html

to consider.

While it may seem insane to reserve already limited RAM for just another thing, these are worth it. If configured right. I used them, or their predecessors since olden times, when I've just had a Thinkpad T60p with some Centrino and only 4GB.

That made things better in general. Of course it's no silver bullet for everything, but it made the system less sluggish, and it took longer to slow down because of being 'swapped to death'.

From then on I continued to use stuff like that.

On a system with only 8GB, too. ZRAM in this case, because backing device like zswap was impossible, because the HDD blew. So I booted live from USB(2(Arrgh!)) and ran from RAM.

By means of AntiX, which btw. showed my the ways sysctls regarding swappiness, pressure stall information, and related stuff can totally change the behaviour of a system.

Even if it looks strange/ghettoish at first, which can be remastered away easily anyways, the devs really know how to get the most out of older systems with limited RAM and power, in interesting ways. Should be looked at, even if only for 'inspiration', technically.

For instance making things like Firefox shrink back, after having closed too much tabs. And remaining usable, while doing so.

Anyway. Depending on what you do, 8GB only can go a looong way, if configured/used right.

IMO not using ZRAM/ZSWAP, sysctls for swappiness, PSI, etc. is wrong and wasteful.

PSD is just a little icing on the cake.

Post reply on HN