Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Arch Linux Now Believes Malware Incident Under Control: More Than 1,500 Packages

phoronix.com

Post reply on HN
Print view View original

141–150 of 227 posts

Re: Arch Linux Now Believes Malware Incident Under Control: More Than 1,500 Packages

#141

Post by mrbluecoat »

jorams wrote: post #59
mcv wrote: post #54

Earlier quoted context omitted.

It's still surprising someone was able to infect so many packages. But I admit I don't really know how AUR works. Can anyone with access simply update anything? Do packages not have owners who check contributions?

Packages in the AUR have some number of maintainers. When a maintainer no longer wants to maintain the package they can disown it, and when all maintainers do so the package becomes orphaned. An orphaned package can then be adopted by any user. At any time there's a large number of orphaned packages in the AUR, and the attacker(s) targeted those.

This.

Who needs social engineering NPM maintainers when there are thousands of freebie AUR ones.

Re: Arch Linux Now Believes Malware Incident Under Control: More Than 1,500 Packages

#142

Post by embedding-shape »

dualvariable wrote: post #135
Gormo wrote: post #132

Earlier quoted context omitted.

AUR isn't a package repo. It's a collection of user-contributed PKGBUILD scripts, to make building packages from upstream source distributions more convenient. It's not meant to be treated like an official repo of binary packages.

That's a semantic detail based on the choice of build from source over binary distribution. This is also a terrible way to run a package build system in this day and age as well, if you like. I feel exactly the same way about it, and when I wrote that I understood what it was, so I didn't need that helpful correction (I first used the FreeBSD ports system sometime around the turn of the millennia).

> That's a semantic detail based on the choice of build from source over binary distribution.

It's not, AUR is more like GitHub, anyone can upload content there, not like a proper repository where things are reviewed, verified and cared for.

You're complaining about "curl https://random-website.com | bash" being "a semantic detail" while it's a major difference in how much trust you can put into it. If you don't trust random-website.com, you shouldn't trust AUR packages. But very different from BSD Ports or Arch's official repositories.

Re: Arch Linux Now Believes Malware Incident Under Control: More Than 1,500 Packages

#143

Post by [deleted] »

blcknight wrote: post #74
embedding-shape wrote: post #2

As always a fair reminder to not install random 3rd party packages/libraries/applications without reviewing them, especially when there is zero vetting. Luckily this was constrained to AUR, which basically is a free-for-all package repository, with users being warned multiple times that it's vital to review anything before you install it, compared to the official repositories. `rua` and other similar CLIs make it rea…

"Review" them how? Read every single line of code before installing something? If it's a binary package, how do you do that? Make reproducible builds for everything you install? Move to from source distro? Putting this on users is not a tenable solution. There's room for common sense, but blaming the users for this is ridiculous

[deleted]

Re: Arch Linux Now Believes Malware Incident Under Control: More Than 1,500 Packages

#144

Post by Induane »

fooqux wrote: post #87
reedlaw wrote: post #76

Earlier quoted context omitted.

I did the malware check using Claude, providing it with the same list ( https://md.archlinux.org/s/SxbqukK6IA ), and it did essentially the same things as this script does to verify. So either way should do the trick.

I think, for this, I'll trust something community verified and not the potential hallucinations of an AI. But we all put our trust in something I suppose. Glad you're clean.

Malware has started sprinkling references to nuclear shit and other strings that trigger model safety so they'll refuse to actually scan them.

Re: Arch Linux Now Believes Malware Incident Under Control: More Than 1,500 Packages

#145

Post by dualvariable »

embedding-shape wrote: post #142
dualvariable wrote: post #135

Earlier quoted context omitted.

That's a semantic detail based on the choice of build from source over binary distribution. This is also a terrible way to run a package build system in this day and age as well, if you like. I feel exactly the same way about it, and when I wrote that I understood what it was, so I didn't need that helpful correction (I first used the FreeBSD ports system sometime around the turn of the millennia).

> That's a semantic detail based on the choice of build from source over binary distribution. It's not, AUR is more like GitHub, anyone can upload content there, not like a proper repository where things are reviewed, verified and cared for. You're complaining about "curl https://random-website.com | bash" being "a semantic detail" while it's a major difference in how much trust you can put into it. If you don't trus…

GitHub doesn't allow me to put up my old repos for adoption by any old rando, or to allow randos to request to take over my repos if I don't respond for 2 weeks.

GitHub also actually protects against repojacking and tombstones username/reponame combinations (that exceed a certain minimum popularity) and never lets anyone ever use them again.

The utility of AUR is also really based around being able to reuse the same repo without having to re-vet every single time. This kind of attack, that forces you to re-vet on every single upgrade so that trust inherently can't be established, is also not GitHub's model at all.

And go has a software package manager that heavily uses GH for distribution, and is arguably more VCS decentralized, but isn't vulnerable to this kind of attack, because it inherts GH's threat model, and doesn't implement the kind of choices that AUR decided to deliberately build into their system.

Re: Arch Linux Now Believes Malware Incident Under Control: More Than 1,500 Packages

#146

Post by naturalmovement »

Gormo wrote: post #132
dualvariable wrote: post #119

Earlier quoted context omitted.

That is a terrible way to run a package repo in this day and age. Maintainers need to have some level of vetting, and should own a repo or three for a while to establish a track record, before they get to blast out contributions to 100 of them without any review.

AUR isn't a package repo. It's a collection of user-contributed PKGBUILD scripts, to make building packages from upstream source distributions more convenient. It's not meant to be treated like an official repo of binary packages.

> AUR isn't a package repo.

What does the 'R' in AUR stand for? Rutabaga?

Re: Arch Linux Now Believes Malware Incident Under Control: More Than 1,500 Packages

#147

Post by popcornricecake »

robby_w_g wrote: post #9

I’ve made a point of not installing any AUR packages. It’s really tempting when there’s a package that’s not available via pacman, but at the end of the day I’d rather build from source myself or use a docker image.

I've made a point of always installing software via the package manager. That means making my own PKGBUILDs if there's not already good ones available. I don't want to ever sidestep the package manager and go `sudo make install` or something. That feels like taking a shit in your system directories and you'll never be able to clean it all up after a short while.

Re: Arch Linux Now Believes Malware Incident Under Control: More Than 1,500 Packages

#148

Post by Induane »

bitmasher9 wrote: post #25

I’m not on Arch Linux, but I am on NodeJS a lot, which frequently suffers from similar types of attacks. Who is doing package management right these days? Who is doing it securely?

I think something about the node ecosystem makes it particularly vulnerable. Maybe it's the insane "dry" ethos. Or something else.

Nothing I have ever used has a comparable dependency tree nightmare.

Re: Arch Linux Now Believes Malware Incident Under Control: More Than 1,500 Packages

#149

Post by matheusmoreira »

naturalmovement wrote: post #101
yowo wrote: post #96

Earlier quoted context omitted.

This is like saying a user who clone a random git repo is not to blame and git-scm should do more to prevent cloning of malicious repos. If it is not official, it is your job to review, if you dont like it, use iOS instead of Arch Linux. If you crash your car, you are liable for the accident. If you aren't ready for that, take the bus. More power = more responsibility

Uh but this isn't random git repos these are packages available through the OS's repos. Why does the AUR even exist if not for malware distribution? It's an uncontrolled free-for-all disguised as a watering hole. If they can't do the most basic of housekeeping it should not exist full stop.

Nothing is "disguised" here. Arch Linux makes an enormous effort to warn that due dilligence is required before installing things, and to dissuade users from using the User Repository at all, to the point of not offering package manager support for it. The wiki even cites previous instances where malware was discovered in the AUR packages.

The only way you could possibly not be aware of the AUR's nature as an "uncontrolled free-for-all" is if you didn't read the Arch Wiki, and anyone who doesn't read the Arch Wiki should not be using Arch Linux to begin with.

"Uncontrolled free-for-all" is exactly the status quo of programming language package managers such as npm and pip. It's just as easy for total randoms to sign up for an account and push packages on those services as it is to push a package to the AUR. Only the AUR made the lack of trust explicit and part of the culture.

Re: Arch Linux Now Believes Malware Incident Under Control: More Than 1,500 Packages

#150

Post by matheusmoreira »

glitchc wrote: post #81
embedding-shape wrote: post #2

As always a fair reminder to not install random 3rd party packages/libraries/applications without reviewing them, especially when there is zero vetting. Luckily this was constrained to AUR, which basically is a free-for-all package repository, with users being warned multiple times that it's vital to review anything before you install it, compared to the official repositories. `rua` and other similar CLIs make it rea…

This is great but ultimately unactionable advice, which makes it worse than useless because it sounds good at first brush but upon inspection turns out to be ridiculous. There is more code out there than is readable by any human being in their lifetime. I'm willing to bet you yourself have read <1% of the source code currently running on your computers. Does this mean you have stopped using your computer(s)? How can…

I review the source code of every AUR package I install. It's not that difficult to do some basic due dilligence. Now with AI it's even easier.
Post reply on HN