Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Arch Linux Now Believes Malware Incident Under Control: More Than 1,500 Packages

phoronix.com

Post reply on HN
Print view View original

31–40 of 227 posts

Re: Arch Linux Now Believes Malware Incident Under Control: More Than 1,500 Packages

#31

Post by mkayokay »

So from a quick read, it seems it installed "atomic-lockfile", "js-digest" or "lockfile-js" from npm. A list of affected packages is here [1].

Didn't find any quick info on how to check a system, so I ran the following command to find foreign packages and some date related infos:

> pacman -Qmi

Check the output against the list of affected packages.

Then, you can also grep for those files in various locations: > grep -rl "atomic-lockfile" / --include="package.json" --include="package-lock.json"

> grep -rl "atomic-lockfile" ~/.npm 2>/dev/null

> grep -i "atomic-lockfile" /var/log/pacman.log 2>/dev/null

Don't know if the packages delete themself after they run. I just wanted to provide some basic commands, as all the other infos I found didn't provide any help.

[1] https://md.archlinux.org/s/SxbqukK6IA

Re: Arch Linux Now Believes Malware Incident Under Control: More Than 1,500 Packages

#32

Post by fooqux »

bitmasher9 wrote: post #25

I’m not on Arch Linux, but I am on NodeJS a lot, which frequently suffers from similar types of attacks. Who is doing package management right these days? Who is doing it securely?

The AUR is user supported and thus malware sneaks into packages all the time, although admittedly not to this scale. Still, it's pointedly not secure and has always had "here be dragons" signs plastered all around it.

Re: Arch Linux Now Believes Malware Incident Under Control: More Than 1,500 Packages

#33

Post by halfcat »

bitmasher9 wrote: post #25

I’m not on Arch Linux, but I am on NodeJS a lot, which frequently suffers from similar types of attacks. Who is doing package management right these days? Who is doing it securely?

> Who is doing package management right these days? Who is doing it securely?

QBASIC. When you need a package you type it in from a magazine. Virtually anything you could ever need is only 1-12 weeks away.

Re: Arch Linux Now Believes Malware Incident Under Control: More Than 1,500 Packages

#34

Post by anon7000 »

bitmasher9 wrote: post #25

I’m not on Arch Linux, but I am on NodeJS a lot, which frequently suffers from similar types of attacks. Who is doing package management right these days? Who is doing it securely?

There are definitely LTS distros where the official packages are not updated ASAP. Npm lets package authors publish new versions to all users immediately. Anything that doesn’t allow that is better. Some distros only incorporate patch/security updates for example.

AUR is worse, in that there may not be official authors and you can take over releases of a package. Like, you’ll have random users publishing the release for some application that doesn’t have their own Arch release. And if that user disappears, someone else may take it over

Re: Arch Linux Now Believes Malware Incident Under Control: More Than 1,500 Packages

#35

Post by anthonj »

mqus wrote: post #24
anthonj wrote: post #5

I cringed hard when some people started to make pacman wrappers that could install from AUR directly. I've installed stuff from the aur before but most of the times I prefer to skip the middleman and just navigate to the project website. A premade pkgbuild is not convenient enough to take the risk of typoquatting or the tactical npm or pip dependency.

This sounds like your update process is quite involved then. Or do you just not do it?

I only have a couple of things in /opt/ and some manually installed fonts, and vim plugins in my home. Everything else that I don't use often lives in the original cloned git repo in /home/projects and never really gets installed.

Of course the process breaks down for a large amount of packets, but I've never been in that situation. In part because the official repo is already large, and in part because I like minimalism.

If that even became an issue, I would manage a personal set of pkgbuild probably.

Re: Arch Linux Now Believes Malware Incident Under Control: More Than 1,500 Packages

#36

Post by landdate »

> It was bad enough when finding out more than 400 AUR packages for Arch Linux users had been infected with malware but now that number has risen to around 900 a few hours ago and now in the end at more than 1,500 user-contributed packages.been infected with malware

I never had a need for the AUR.

If I want a package not in the official repository I build it myself or if it has a binary release I will download it. this way i don't have to use root when building and can have program installed locally just for a single user which is how it should be anyway for most desktop use cases.

At least in this way there is one less level of possible malicious code insertion in developer -> user, vs develeper -> maintainer -> user.

Re: Arch Linux Now Believes Malware Incident Under Control: More Than 1,500 Packages

#38

Post by saghm »

bitmasher9 wrote: post #23
anthonj wrote: post #18

Earlier quoted context omitted.

I get it, but you only need to do that for the odd cases of packages not present in the official repo (not that common at all for me at least). Also if the software is downloaded in the form of a git repo, you only needed to checkout the new tag and rebuild, don't need your browser at all.

I think the existence of the AUR puts less pressure on the official repository to have all popular software.

I think it's also a bit of a testing ground for the main repos as well. I maintained the `ruby-build` AUR package for a couple of years after the previous maintainer wanted to step down, but they eventually added it to the main repos and now it's maintained by one of the official people. (I don't recall ever having to do more than paste in the new release tag into the PKGBUILD each time and then generate the new .SRCINFO and checksums in terms of actual maintenance, although I'd test locally first before pushing of course).

Re: Arch Linux Now Believes Malware Incident Under Control: More Than 1,500 Packages

#39

Post by tobyhinloopen »

bitmasher9 wrote: post #25

I’m not on Arch Linux, but I am on NodeJS a lot, which frequently suffers from similar types of attacks. Who is doing package management right these days? Who is doing it securely?

Min Release Age of 7-30 days covers the majority of potential issues with 0 effort.

All major Node package managers should support it by now.

Prom was the best IIRC, yarn second, but even npm is catching up

Post reply on HN