Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Firefox-patch-bin, librewolf-fix-bin AUR packages contain malware

lists.archlinux.org

Post reply on HN
Print view View original

51–60 of 142 posts

Re: Firefox-patch-bin, librewolf-fix-bin AUR packages contain malware

#51

Post by akerl_ »

jchoksi wrote: post #46

AUR packages are user-produced content i.e. packages built on their own machines. They have to be installed via "pacman -U package_file" Arch developers can code "pacman -U" such that it performs a VirusTotal scan before installation for each package. VirusTotal's API is free. - https://docs.virustotal.com/docs/api-scripts-and-client-libr... - https://docs.virustotal.com/docs/please-give-me-an-api-key - https://docs.…

Is this accurate? My understanding is that the AUR does not host binary packages. It hosts pkgbuild files, which contain config and scripts that a user has to build on their own machine in order to install. The malicious code here is fetched as part of those scripts.

Re: Firefox-patch-bin, librewolf-fix-bin AUR packages contain malware

#52

Post by OsrsNeedsf2P »

jchoksi wrote: post #46

AUR packages are user-produced content i.e. packages built on their own machines. They have to be installed via "pacman -U package_file" Arch developers can code "pacman -U" such that it performs a VirusTotal scan before installation for each package. VirusTotal's API is free. - https://docs.virustotal.com/docs/api-scripts-and-client-libr... - https://docs.virustotal.com/docs/please-give-me-an-api-key - https://docs.…

Between false positives, high QPS, and the fact malware devs would then test against Virus Total, is this useful?

Re: Firefox-patch-bin, librewolf-fix-bin AUR packages contain malware

#53

Post by Barrin92 »

There's always been this security theater of people recommending arch because they "don't trust the companies" or Canonical or what have you but frankly I'm surprised this hasn't happened sooner. Well or maybe it has and we don't know.

Running random binaries on your computer uploaded by some anonymous dude has to be the equivalent of buying heart medicine on craigslist. And because Arch is so barebones to begin with the AUR is very popular, you see a lot of arch users using it.

Re: Firefox-patch-bin, librewolf-fix-bin AUR packages contain malware

#54

Post by Tharre »

jchoksi wrote: post #46

AUR packages are user-produced content i.e. packages built on their own machines. They have to be installed via "pacman -U package_file" Arch developers can code "pacman -U" such that it performs a VirusTotal scan before installation for each package. VirusTotal's API is free. - https://docs.virustotal.com/docs/api-scripts-and-client-libr... - https://docs.virustotal.com/docs/please-give-me-an-api-key - https://docs.…

First of all, this is incorrect, the checking would have to happen _before_ even building the package since malware is already being executed at that point.

But more importantly this is a terrible idea in regards to privacy/infosec. I do not want packages I build and install myself to be uploaded to a 3rd party website.

And for what benefit? 99% of new malware won't be detected anyway, and once it is known it is way more effective to just remove the offending package from the AUR.

Re: Firefox-patch-bin, librewolf-fix-bin AUR packages contain malware

#55

Post by johnisgood »

nilamo wrote: post #41
johnisgood wrote: post #32

Earlier quoted context omitted.

FWIW this is AUR. These packages are not officially supported. AUR = Arch User Repository.

Plenty of package managers (such as `yay`) install from AUR by default.

yay is a package manager that has been made for AUR. yay is not the official package manager for Arch Linux, pacman is, and it does not support AUR. yay is not installed on Arch Linux by default, its official package manager, pacman, is. AUR is for unofficial 3rd party packages, i.e. "use at your own risk". It has always been the case.

Re: Firefox-patch-bin, librewolf-fix-bin AUR packages contain malware

#57

Post by mariusor »

ASalazarMX wrote: post #20
WD-42 wrote: post #12

As Arch seemingly explodes in popularity I’m afraid we’ll start seeing more of this.

The only thing I've seen Arch exploding in popularity has been memes. It's a fun distro for hobbyists, but too inconvenient as a daily driver.

I can't imagine what kind of a problem I would personally have to encounter to make me utter such a sweeping generalization with this much confidence. :)

At least this guy has been using it as a daily driver (at home and at work) for at least fifteen years.

Re: Firefox-patch-bin, librewolf-fix-bin AUR packages contain malware

#58

Post by heavyset_go »

WD-42 wrote: post #12

As Arch seemingly explodes in popularity I’m afraid we’ll start seeing more of this.

Nearly all distros have this problem when it comes to packaging and distributing 3rd party software.

Even if you're using an immutable distro, your KDE Plasma session can get hijacked if you simply use the built in wizard to install 3rd party desktop widgets, which is a right-click + single-click away on any Plasma destkop.

Re: Firefox-patch-bin, librewolf-fix-bin AUR packages contain malware

#59

Post by icar »

jchoksi wrote: post #46

AUR packages are user-produced content i.e. packages built on their own machines. They have to be installed via "pacman -U package_file" Arch developers can code "pacman -U" such that it performs a VirusTotal scan before installation for each package. VirusTotal's API is free. - https://docs.virustotal.com/docs/api-scripts-and-client-libr... - https://docs.virustotal.com/docs/please-give-me-an-api-key - https://docs.…

Just create a pacman hook before install that uploads the package there and aborts installation if necessary. Probably skipping repo packages is a good idea otherwise you're gonna spam the API each update.

Re: Firefox-patch-bin, librewolf-fix-bin AUR packages contain malware

#60

Post by ziml77 »

johnisgood wrote: post #29
ementally wrote: post #28

Earlier quoted context omitted.

CachyOS (Arch based distro), no.1 on https://distrowatch.com/

> Blazingly Fast & Customizable Linux distribution I love Arch Linux, but please... (Arch Linux is already "fast" (depends on what you install for your DE, if any) and customizable.)

But their differentiation is that to improve performance they compile all the packages with newer instruction sets as the target as well as enabling more optimizations like LTO. And some are even optimized with PGO.
Post reply on HN