Malware Found in the Ubuntu Snap Store • Hacker News Board

Re: Malware Found in the Ubuntu Snap Store

#31

Post by drchickensalad » Sat, May 12, 2018, 7:30 PM UTC

faho wrote: post #29

userbinator wrote: post #22

used a proprietary license Does the license actually mention it mines? I am reminded of a lot of "freemium"/"ad-supported"/etc. software that makes its author money via ads or whatever else --- and you agree to that if you read the license --- and it is a bit shady to name the miner 'systemd', but it seems rather overboard to call this "malware"... when I see that term I think of software that self-propagates and exf…

>a simple game like that taking >100MB would make me suspicious Nah. Games often feature a bunch of textures and video and sound files. Bad compression or too high resolution on those is quite common, which is why games _are_ often that large. Also proprietary software usually ships a bunch of libraries - games often ship with a premade engine, which are also often quite large. As a datapoint, I have a copy of "Strat…

For some high performance games, storing assets with weaker compression means less CPU cycles spent.

Re: Malware Found in the Ubuntu Snap Store

#32

Post by aritmo » Sat, May 12, 2018, 7:30 PM UTC

solomatov wrote: post #8

The problem with snaps is that they didn't take security really seriously on desktop: https://www.zdnet.com/article/linux-expert-matthew-garrett-u... >"X has no real concept of different levels of application trust. Any application can register to receive keystrokes from any other application. Any application can inject fake key events into the input stream. An application that is otherwise confined by strong securit…

There's not much to do with X without breaking the protocol.

Re: Malware Found in the Ubuntu Snap Store

#33

Post by solomatov » Sat, May 12, 2018, 7:31 PM UTC

btashton wrote: post #16

solomatov wrote: post #8

The problem with snaps is that they didn't take security really seriously on desktop: https://www.zdnet.com/article/linux-expert-matthew-garrett-u... >"X has no real concept of different levels of application trust. Any application can register to receive keystrokes from any other application. Any application can inject fake key events into the input stream. An application that is otherwise confined by strong securit…

The issues with X11 you mention is part of what Wayland tries to fix. And why early on seemingly benign things like screenshot tools broke.

Yes, I understand that there're people in the community who try to fix the problems. But it's really unfortunate, that Canonical tells us that it's secure whereas it's not: https://snapcraft.io/

>Snaps are containerised software packages that are simple to create and install. They auto-update and are safe to run. And because they bundle their dependencies, they work on all major Linux systems without modification.

Re: Malware Found in the Ubuntu Snap Store

#34

Post by solomatov » Sat, May 12, 2018, 7:32 PM UTC

aritmo wrote: post #32

solomatov wrote: post #8

The problem with snaps is that they didn't take security really seriously on desktop: https://www.zdnet.com/article/linux-expert-matthew-garrett-u... >"X has no real concept of different levels of application trust. Any application can register to receive keystrokes from any other application. Any application can inject fake key events into the input stream. An application that is otherwise confined by strong securit…

There's not much to do with X without breaking the protocol.

If nothing can be done, then there should be no claims of security.

Re: Malware Found in the Ubuntu Snap Store

#35

Post by zootboy » Sat, May 12, 2018, 7:33 PM UTC

eat_veggies wrote: post #24

geofft wrote: post #9

There is no review process or central restrictions on who can upload to the Ubuntu Snap Store, so in a sense, this isn't surprising. https://docs.snapcraft.io/build-snaps/publish Does the name "Ubuntu Snap Store" carry a connotation that code is reviewed for malware by Ubuntu, the way that the Apple, Google, Amazon, etc. mobile app stores are? Or does its presence in the software center app imply a connotation that i…

I like Arch's package management model, where sources are split into the official repositories, which are manually approved, and the AUR, which everyone knows are not officially endorsed or reviewed, and to check the sources and PKGBUILDS for anything sketchy before installing. The processes for installing from the two are also different enough that the user can't mistake one for the other: official packages are a pa…

Also, compare the wording on the snap store:

> Safe to run - Not only are snaps kept separate, their data is kept separate too. Snaps communicate with each other only in ways that you approve.

Versus the AUR:

> DISCLAIMER: AUR packages are user produced content. Any use of the provided files is at your own risk.

Re: Malware Found in the Ubuntu Snap Store

#36

Post by solomatov » Sat, May 12, 2018, 7:35 PM UTC

the_common_man wrote: post #6

This is exactly why you should not run random docker images and snaps. Docker images are also run as root in many cases. It is better to build app images from scratch and understand what exactly goes into the image.

Why not run random docker images? As far as I understand, docker container are pretty solid. Not super solid but solid enough.

Re: Malware Found in the Ubuntu Snap Store

#37

Post by evand » Sat, May 12, 2018, 7:35 PM UTC

aritmo wrote: post #30

userbinator wrote: post #22

used a proprietary license Does the license actually mention it mines? I am reminded of a lot of "freemium"/"ad-supported"/etc. software that makes its author money via ads or whatever else --- and you agree to that if you read the license --- and it is a bit shady to name the miner 'systemd', but it seems rather overboard to call this "malware"... when I see that term I think of software that self-propagates and exf…

There is no support for specifying the license yet, so all snap packages appear as "proprietary". Nothing to look here. edit: https://forum.snapcraft.io/t/snap-license-metadata/856/53 Still it is unresolved, they probably use the deprecated licence feature in VLC.

That is not true. You absolutely can specify a license: https://snapcraft.io/vlc

Re: Malware Found in the Ubuntu Snap Store

#38

Post by RayDonnelly » Sat, May 12, 2018, 7:37 PM UTC

jacquesm wrote: post #18

geofft wrote: post #9

There is no review process or central restrictions on who can upload to the Ubuntu Snap Store, so in a sense, this isn't surprising. https://docs.snapcraft.io/build-snaps/publish Does the name "Ubuntu Snap Store" carry a connotation that code is reviewed for malware by Ubuntu, the way that the Apple, Google, Amazon, etc. mobile app stores are? Or does its presence in the software center app imply a connotation that i…

Ever since I learned about it and then read up on it Anaconda has been my go-to way of using Python. Python packaging is a huge mess.

Glad to hear it. We take these matters very seriously, including good hardening flags etc: https://www.anaconda.com/blog/developer-blog/improved-securi...

Re: Malware Found in the Ubuntu Snap Store

#39

Post by zokier » Sat, May 12, 2018, 7:38 PM UTC

userbinator wrote: post #22

used a proprietary license Does the license actually mention it mines? I am reminded of a lot of "freemium"/"ad-supported"/etc. software that makes its author money via ads or whatever else --- and you agree to that if you read the license --- and it is a bit shady to name the miner 'systemd', but it seems rather overboard to call this "malware"... when I see that term I think of software that self-propagates and exf…

I would be really surprised if the miner is contributing any major portion of that size. I just did a very basic search and a random miner I found has binary sizes https://github.com/xmrig/xmrig/releases

edit: apparently the actual game is based on https://github.com/gabrielecirulli/2048 which is HTML+JS, so probably the Snap was bundling in Chromium/Electron, which explains the size.

Re: Malware Found in the Ubuntu Snap Store

#40

Post by aritmo » Sat, May 12, 2018, 7:38 PM UTC

rrix2 wrote: post #19

It's too bad there isn't some sinister cabal of trusted individuals within the Ubuntu project that can review packages for quality and package them securely and in an auditable fashion.

A snap package may ask for elevated permissions. In that case, it goes for manual review.

But if it does not ask for special permissions, then it goes in automatically. Because the app is quite confined.

Compared to other package repos, here it's somewhat better.