Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

EvilGnome: Rare Malware Spying on Linux Desktop Users

intezer.com

Post reply on HN
Print view View original

41–50 of 51 posts

Re: EvilGnome: Rare Malware Spying on Linux Desktop Users

#41

Post by Kaiyou »

simion314 wrote: post #18

This incident made me think that the hackers planned to hijack some popular extension. this would make the more damage. My (unpopular) opinion is that GNOME should see what are the most used extensions, accept that people want those feature and bring those features into GNOME or make those official extension and not third party, so you at least control what most people would install.

Wow, so this is what GNOME has become. I've ditched them in favor of Mate at some point and later made that into an i3/Mate combination. Something about editing text files for configuration is just inherently better over clicking through dozens of menus.

Re: EvilGnome: Rare Malware Spying on Linux Desktop Users

#42

Post by AnIdiotOnTheNet »

emerongi wrote: post #25
simion314 wrote: post #18

This incident made me think that the hackers planned to hijack some popular extension. this would make the more damage. My (unpopular) opinion is that GNOME should see what are the most used extensions, accept that people want those feature and bring those features into GNOME or make those official extension and not third party, so you at least control what most people would install.

GNOME has been nuking features for a while, recommending people to go and install extensions. Extensions work by monkey-patching and once you have a critical mass of them, you're guaranteed to run into some glitches where one monkey-patch messes up the other. I like the KDE approach more where features are actually baked into the DE. It's much easier to reproduce bugs and fix bugs that can depend on different feature…

> GNOME has been nuking features for a while

That's an understatement. GNOME is so notorious for removing features that I recall jokes on Slashdot 15 years ago about how the next version of GNOME will just have a giant "Do Stuff" button in the middle of the screen.

Re: EvilGnome: Rare Malware Spying on Linux Desktop Users

#43

Post by tripzilch »

Kaiyou wrote: post #41
simion314 wrote: post #18

This incident made me think that the hackers planned to hijack some popular extension. this would make the more damage. My (unpopular) opinion is that GNOME should see what are the most used extensions, accept that people want those feature and bring those features into GNOME or make those official extension and not third party, so you at least control what most people would install.

Wow, so this is what GNOME has become. I've ditched them in favor of Mate at some point and later made that into an i3/Mate combination. Something about editing text files for configuration is just inherently better over clicking through dozens of menus.

what's an i3/mate combination? do you mean you switch between them as you feel like it, or somehow have a combined workspace with both? don't you need to log out to switch?

Re: EvilGnome: Rare Malware Spying on Linux Desktop Users

#44

Post by simion314 »

tripzilch wrote: post #43
Kaiyou wrote: post #41

Earlier quoted context omitted.

Wow, so this is what GNOME has become. I've ditched them in favor of Mate at some point and later made that into an i3/Mate combination. Something about editing text files for configuration is just inherently better over clicking through dozens of menus.

what's an i3/mate combination? do you mean you switch between them as you feel like it, or somehow have a combined workspace with both? don't you need to log out to switch?

Not OP, on most DEs(desktop environment) you can change the WM (window manager) , like in the past you could replace Mutter or KWin with Compiz. I am not sure if this is possible this days with GNOME.

Re: EvilGnome: Rare Malware Spying on Linux Desktop Users

#45

Post by woodrowbarlow »

Crinus wrote: post #39
emidln wrote: post #36

Earlier quoted context omitted.

Who is to say that future versions of this won't be paired with some arbitrary browser/email-based RCE. This is the persistent threat, a payload if you will, not an exploit itself.

If someone can force download and install an application through browser/email then the issue isn't with the application being downloaded and installed but whatever allowed the application to be forcefully downloaded and installed (that is, your browser/email client).

you're being dismissive because it sounds like a such an RCE could only be the result of gross negligence. let me paint a more plausible scenario.

many gnome-based distros (fedora, for example) ship with firefox and the "gnome extensions" plugin for firefox pre-installed. this extension allows you to install extensions directly into your shell from extensions.gnome.org just by clicking "install".

suppose an exploit was found that allows sources other than extensions.gnome.org to trigger the firefox plugin to install a shell extension.

seems much more likely now, doesn't it?

Re: EvilGnome: Rare Malware Spying on Linux Desktop Users

#46

Post by Crinus »

tjoff wrote: post #40
Crinus wrote: post #37

Earlier quoted context omitted.

I do not consider all 3rd party places as untrusted (this sort of thinking leads to walled gardens) and i'd put these under "downloading from trustworthy places" in the sense that they are more of a way to download something and less a source themselves (e.g. you can download a pip package from both a trustworthy developer and untrusted developer). Of course the more layers between you and whatever you want to downlo…

Neither do I. But even if I download a pip package from blender and it depends on 14-third party packages - how on earth am I able to assess the risk/trust of that? I most certainly trust that there is no ill intent from them and that it didn't raise any flags during testing. But even if I believe they have the resources to audit everything I might be getting a newer and infected version. And even if my trust of a pr…

You can't really, but at some point you have to trust someone, otherwise everyone would recreate everything from scratch. Though TBH what i had in mind wasn't really the "let's download live code from random places" repositories like npm and pip, but more "static" repositories where all dependencies are either part of the repository itself or assumed to be already on your system.

Re: EvilGnome: Rare Malware Spying on Linux Desktop Users

#47

Post by Crinus »

woodrowbarlow wrote: post #45
Crinus wrote: post #39

Earlier quoted context omitted.

If someone can force download and install an application through browser/email then the issue isn't with the application being downloaded and installed but whatever allowed the application to be forcefully downloaded and installed (that is, your browser/email client).

you're being dismissive because it sounds like a such an RCE could only be the result of gross negligence. let me paint a more plausible scenario. many gnome-based distros (fedora, for example) ship with firefox and the "gnome extensions" plugin for firefox pre-installed. this extension allows you to install extensions directly into your shell from extensions.gnome.org just by clicking "install". suppose an exploit w…

I'm not sure how much of a possibility this is because i do not know exactly how GNOME extensions work - the linked malware is not a real GNOME extension, it just pretends to be one by placing itself in the directory where GNOME extensions are placed, but it really is a shell script. But assuming that this is the case, as i said above the issue would be with Firefox and/or the Firefox extension, not with GNOME being extensible or the user being able to download and run shell scripts (the two things that enable this to work) in their computer (and really the "GNOME being extensible" part is minor, the only reason the malware uses that is to hide itself, it isn't even a real GNOME extension).

The main reason i am dismissive is because if you think this is a real threat then you'd have to also think anything you can run on your computer to be a real threat - which, IMO, is absurd and at that point you might as well turn off and throw your computer out of the window.

Re: EvilGnome: Rare Malware Spying on Linux Desktop Users

#48

Post by JoeSamoa »

tjoff wrote: post #40
Crinus wrote: post #37

Earlier quoted context omitted.

I do not consider all 3rd party places as untrusted (this sort of thinking leads to walled gardens) and i'd put these under "downloading from trustworthy places" in the sense that they are more of a way to download something and less a source themselves (e.g. you can download a pip package from both a trustworthy developer and untrusted developer). Of course the more layers between you and whatever you want to downlo…

Neither do I. But even if I download a pip package from blender and it depends on 14-third party packages - how on earth am I able to assess the risk/trust of that? I most certainly trust that there is no ill intent from them and that it didn't raise any flags during testing. But even if I believe they have the resources to audit everything I might be getting a newer and infected version. And even if my trust of a pr…

This is something I have wondered myself.

Would love if someone would chime in on the reality here.

Re: EvilGnome: Rare Malware Spying on Linux Desktop Users

#49

Post by SmileyRedBall »

> Linux desktop remains an unpopular choice among mainstream desktop users ..

Because it's virtually to buy a computer in the shops with a Linux Desktop pre-installed. Even online Dell manages to keep a Linux Desktop computer well hidden on their website.

> .. in the beginning of July, we discovered a new, fully undetected Linux backdoor implant ..

How does this “fully undetected Linux backdoor” get onto the Desktop in the first place, without the end-user explicitly downloading and installing this Linux “implant”.

> .. We have named the implant EvilGnome, for its disguise as a Gnome extension ..

Thanking you, so the “implant” disguises itself as a Gnome extension and resides on some third-party website.

> .. The malware is currently fully undetected across all major security solutions ..

So, the defect resides in the security solutions :]

Re: EvilGnome: Rare Malware Spying on Linux Desktop Users

#50

Post by tjoff »

Crinus wrote: post #46
tjoff wrote: post #40

Earlier quoted context omitted.

Neither do I. But even if I download a pip package from blender and it depends on 14-third party packages - how on earth am I able to assess the risk/trust of that? I most certainly trust that there is no ill intent from them and that it didn't raise any flags during testing. But even if I believe they have the resources to audit everything I might be getting a newer and infected version. And even if my trust of a pr…

You can't really, but at some point you have to trust someone, otherwise everyone would recreate everything from scratch. Though TBH what i had in mind wasn't really the "let's download live code from random places" repositories like npm and pip, but more "static" repositories where all dependencies are either part of the repository itself or assumed to be already on your system.

And my point was that linux users depend on such repositories all the time.

There will probably be quite a few wake up-calls where this is exploited.

Post reply on HN