Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Firefox-patch-bin, librewolf-fix-bin AUR packages contain malware

lists.archlinux.org

Post reply on HN
Print view View original

61–70 of 142 posts

Re: Firefox-patch-bin, librewolf-fix-bin AUR packages contain malware

#61

Post by diggan »

jchoksi wrote: post #46

AUR packages are user-produced content i.e. packages built on their own machines. They have to be installed via "pacman -U package_file" Arch developers can code "pacman -U" such that it performs a VirusTotal scan before installation for each package. VirusTotal's API is free. - https://docs.virustotal.com/docs/api-scripts-and-client-libr... - https://docs.virustotal.com/docs/please-give-me-an-api-key - https://docs.…

> Arch developers can code "pacman -U" such that it performs a VirusTotal scan before installation for each package.

AFAIK, VirusTotal only flags known malware/viruses, any new/"looks-to-be-new" stuff wouldn't be flagged until they've picked it up, and once someone would have picked it up, it should be removed from the AUR anyways. So you'd have at least one user (most likely more) getting infected first, and once detected more users wouldn't be able to install it regardless.

Re: Firefox-patch-bin, librewolf-fix-bin AUR packages contain malware

#62

Post by h4ck_th3_pl4n3t »

Barrin92 wrote: post #53

There's always been this security theater of people recommending arch because they "don't trust the companies" or Canonical or what have you but frankly I'm surprised this hasn't happened sooner. Well or maybe it has and we don't know. Running random binaries on your computer uploaded by some anonymous dude has to be the equivalent of buying heart medicine on craigslist. And because Arch is so barebones to begin with…

Arch bugfix time is usually within 24 hours.

Not a single enterprise distro even reacts within that timeframe. OVAL advisories are weeks, sometimes months later.

As long as you don't have a virtualization approach similar to QubesOS, any linux distro will not fix this problem. Because that's not how separation of concerns works in the POSIX system. You need to have separate users for each and every program to isolate them, and that is practically unfeasible.

Re: Firefox-patch-bin, librewolf-fix-bin AUR packages contain malware

#63

Post by Shellban »

gpm wrote: post #4
jabjq wrote: post #2

> We strongly encourage users that may have installed one of these packages […] to take the necessary measures in order to ensure they were not compromised. How are they supposed to do that when you give them no information as to what the malware does?

It says what the malware does, it's a remote access toolkit... It gives control of your machine to the malware operator. The malware operator could have done anything with that access... There's no way for the maintainers to know what was done on any given infected machine.

This is really scary for those who manage multiple things. I'm considering running a factory reset on everything from my router to my Steam Deck and remote server.

Re: Firefox-patch-bin, librewolf-fix-bin AUR packages contain malware

#64

Post by jchoksi »

Tharre wrote: post #54
jchoksi wrote: post #46

AUR packages are user-produced content i.e. packages built on their own machines. They have to be installed via "pacman -U package_file" Arch developers can code "pacman -U" such that it performs a VirusTotal scan before installation for each package. VirusTotal's API is free. - https://docs.virustotal.com/docs/api-scripts-and-client-libr... - https://docs.virustotal.com/docs/please-give-me-an-api-key - https://docs.…

First of all, this is incorrect, the checking would have to happen _before_ even building the package since malware is already being executed at that point. But more importantly this is a terrible idea in regards to privacy/infosec. I do not want packages I build and install myself to be uploaded to a 3rd party website. And for what benefit? 99% of new malware won't be detected anyway, and once it is known it is way…

> malware is already being executed at that point

To ensure reproducible / clean builds, I thought makepkg would always be run in a sandbox/chroot environment. The damage done would be localised to that sandbox.

> this is a terrible idea in regards to privacy/infosec.

Ok. Devs could setup an option to pacman -U which allows it to bypass VT for privacy sensitive people. This just puts the onus on you to not ensure you aren't installing malware. The default Arch user should still be protected while allowing for your privacy needs.

> 99% of new malware won't be detected anyway, and once it is known it is way more effective to just remove the offending package from the AUR

Its too late then. People are already affected.

Re: Firefox-patch-bin, librewolf-fix-bin AUR packages contain malware

#65

Post by IlikeKitties »

johnisgood wrote: post #55
nilamo wrote: post #41

Earlier quoted context omitted.

Plenty of package managers (such as `yay`) install from AUR by default.

yay is a package manager that has been made for AUR. yay is not the official package manager for Arch Linux, pacman is, and it does not support AUR. yay is not installed on Arch Linux by default, its official package manager, pacman, is. AUR is for unofficial 3rd party packages, i.e. "use at your own risk". It has always been the case.

Yes, it is "use at your own risk" but most arch users just install from it without giving it a second thought, because availability of packages in the AUR is the one thing Arch is good at.

Re: Firefox-patch-bin, librewolf-fix-bin AUR packages contain malware

#66

Post by johnisgood »

akerl_ wrote: post #51
jchoksi wrote: post #46

AUR packages are user-produced content i.e. packages built on their own machines. They have to be installed via "pacman -U package_file" Arch developers can code "pacman -U" such that it performs a VirusTotal scan before installation for each package. VirusTotal's API is free. - https://docs.virustotal.com/docs/api-scripts-and-client-libr... - https://docs.virustotal.com/docs/please-give-me-an-api-key - https://docs.…

Is this accurate? My understanding is that the AUR does not host binary packages. It hosts pkgbuild files, which contain config and scripts that a user has to build on their own machine in order to install. The malicious code here is fetched as part of those scripts.

No, it is NOT accurate.

Pacman cannot be used to download, compile, or install AUR packages. You need the PKGBUILD file and use "makepkg -si" at the very least. If you want AUR packages, you'd install a package manager (in this context referred to as AUR helper) like "yay" that supports both official and unofficial (i.e. AUR) packages. FWIW AUR helpers are not even official packages, not even "yay" which is a popular one. You need to go out of your way to install "yay" (although it is one command away before, i.e. very easy).

TL;DR: Pacman does not download, compile, or install packages from the AUR, nor does it resolve their dependencies. "makepkg -si" builds and installs a package based on the PKGBUILD file, or use an AUR helper that overcomes the limitations of "makepkg". AUR helpers make it easy to install AUR (i.e. unofficial) packages.

Re: Firefox-patch-bin, librewolf-fix-bin AUR packages contain malware

#67

Post by jchoksi »

diggan wrote: post #61
jchoksi wrote: post #46

AUR packages are user-produced content i.e. packages built on their own machines. They have to be installed via "pacman -U package_file" Arch developers can code "pacman -U" such that it performs a VirusTotal scan before installation for each package. VirusTotal's API is free. - https://docs.virustotal.com/docs/api-scripts-and-client-libr... - https://docs.virustotal.com/docs/please-give-me-an-api-key - https://docs.…

> Arch developers can code "pacman -U" such that it performs a VirusTotal scan before installation for each package. AFAIK, VirusTotal only flags known malware/viruses, any new/"looks-to-be-new" stuff wouldn't be flagged until they've picked it up, and once someone would have picked it up, it should be removed from the AUR anyways. So you'd have at least one user (most likely more) getting infected first, and once de…

> So you'd have at least one user (most likely more) getting infected first, and once detected more users wouldn't be able to install it regardless.

This is where your and my intentions differ. I don't want the average Arch user to be infected when it can be prevented because the malware is known about.

Re: Firefox-patch-bin, librewolf-fix-bin AUR packages contain malware

#68

Post by lilly-lizard »

it should be noted that these are different from the popular librewolf-bin (513 votes) and zen-browser-bin (176). with this in mind it's cool that these got identified only 2 days after being uploaded. I wonder if the reporter actually intended to install it or just reads the PKGBUILDS of new packages to be a good samaritan...

Re: Firefox-patch-bin, librewolf-fix-bin AUR packages contain malware

#69

Post by diggan »

jchoksi wrote: post #67
diggan wrote: post #61

Earlier quoted context omitted.

> Arch developers can code "pacman -U" such that it performs a VirusTotal scan before installation for each package. AFAIK, VirusTotal only flags known malware/viruses, any new/"looks-to-be-new" stuff wouldn't be flagged until they've picked it up, and once someone would have picked it up, it should be removed from the AUR anyways. So you'd have at least one user (most likely more) getting infected first, and once de…

> So you'd have at least one user (most likely more) getting infected first, and once detected more users wouldn't be able to install it regardless. This is where your and my intentions differ. I don't want the average Arch user to be infected when it can be prevented because the malware is known about.

> I don't want the average Arch user to be infected when it can be prevented because the malware is known about.

Me neither, my argument would be that VirusTotal won't stop the initial users from getting infected, so not good enough in my mind.

Re: Firefox-patch-bin, librewolf-fix-bin AUR packages contain malware

#70

Post by Hackbraten »

IlikeKitties wrote: post #65
johnisgood wrote: post #55

Earlier quoted context omitted.

yay is a package manager that has been made for AUR. yay is not the official package manager for Arch Linux, pacman is, and it does not support AUR. yay is not installed on Arch Linux by default, its official package manager, pacman, is. AUR is for unofficial 3rd party packages, i.e. "use at your own risk". It has always been the case.

Yes, it is "use at your own risk" but most arch users just install from it without giving it a second thought, because availability of packages in the AUR is the one thing Arch is good at.

> most arch users just install from it without giving it a second thought

Citation needed.

Post reply on HN