Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Firefox-patch-bin, librewolf-fix-bin AUR packages contain malware

lists.archlinux.org

Post reply on HN
Print view View original

71–80 of 142 posts

Re: Firefox-patch-bin, librewolf-fix-bin AUR packages contain malware

#71

Post by johnisgood »

IlikeKitties wrote: post #65
johnisgood wrote: post #55

Earlier quoted context omitted.

yay is a package manager that has been made for AUR. yay is not the official package manager for Arch Linux, pacman is, and it does not support AUR. yay is not installed on Arch Linux by default, its official package manager, pacman, is. AUR is for unofficial 3rd party packages, i.e. "use at your own risk". It has always been the case.

Yes, it is "use at your own risk" but most arch users just install from it without giving it a second thought, because availability of packages in the AUR is the one thing Arch is good at.

N=1 but I rarely install from AUR and I have been using Arch Linux for decades. Using "yay" is akin to doing "curl | sh". You should inspect the PKGBUILD at the very least, and I do not believe "most users" is correct.

Re: Firefox-patch-bin, librewolf-fix-bin AUR packages contain malware

#72

Post by Shellban »

lilly-lizard wrote: post #68

it should be noted that these are different from the popular librewolf-bin (513 votes) and zen-browser-bin (176). with this in mind it's cool that these got identified only 2 days after being uploaded. I wonder if the reporter actually intended to install it or just reads the PKGBUILDS of new packages to be a good samaritan...

I only just noticed the difference myself. That was a scare!

Re: Firefox-patch-bin, librewolf-fix-bin AUR packages contain malware

#73

Post by gpm »

Shellban wrote: post #63
gpm wrote: post #4

Earlier quoted context omitted.

It says what the malware does, it's a remote access toolkit... It gives control of your machine to the malware operator. The malware operator could have done anything with that access... There's no way for the maintainers to know what was done on any given infected machine.

This is really scary for those who manage multiple things. I'm considering running a factory reset on everything from my router to my Steam Deck and remote server.

Uh... did you install these AUR packages? It seems quite unlikely you installed these on either a router or a steam deck...

That said, if you did, yeah being hacked is scary and I feel for you.

Re: Firefox-patch-bin, librewolf-fix-bin AUR packages contain malware

#74

Post by diggan »

IlikeKitties wrote: post #65
johnisgood wrote: post #55

Earlier quoted context omitted.

yay is a package manager that has been made for AUR. yay is not the official package manager for Arch Linux, pacman is, and it does not support AUR. yay is not installed on Arch Linux by default, its official package manager, pacman, is. AUR is for unofficial 3rd party packages, i.e. "use at your own risk". It has always been the case.

Yes, it is "use at your own risk" but most arch users just install from it without giving it a second thought, because availability of packages in the AUR is the one thing Arch is good at.

> most arch users just install from it without giving it a second thought

I'm not sure that's true. Neither I nor most people I know who use Arch (granted, most of them are professional software developers) install software from the internet willy-nilly and without reviewing anything, if by AUR or "curl | bash", especially when on their main computers.

Re: Firefox-patch-bin, librewolf-fix-bin AUR packages contain malware

#75

Post by diggan »

LeoPanthera wrote: post #38
ementally wrote: post #28

Earlier quoted context omitted.

CachyOS (Arch based distro), no.1 on https://distrowatch.com/

This is a slight aside, but CachyOS is a great example of the failure of Wikipedia politics. The "CachyOS" page was deleted[1], and replaced with a redirect to the Arch Linux page. But CachyOS is not mentioned anywhere on that page, nor on the "List of Linux distributions § Arch Linux-based" page. [1]: https://en.wikipedia.org/wiki/Wikipedia:Articles_for_deletio...

It links to https://en.wikipedia.org/wiki/Arch_Linux#Derivatives which indeed lacks any mention of CachyOS. Luckily, Wikipedia is free to register, and you can just edit pages you feel like could be better. Seems like you found the perfect first edit to make for yourself :)

Re: Firefox-patch-bin, librewolf-fix-bin AUR packages contain malware

#76

Post by bee_rider »

ASalazarMX wrote: post #20
WD-42 wrote: post #12

As Arch seemingly explodes in popularity I’m afraid we’ll start seeing more of this.

The only thing I've seen Arch exploding in popularity has been memes. It's a fun distro for hobbyists, but too inconvenient as a daily driver.

It this recent? I thought “I use arch btw” was more of a thing… 5 or so years ago.

I switched away from Arch (to Ubuntu) as a sort of side effect of switching computers a couple years ago (desktop->laptop, though Ubuntu would “bring the batteries along” more conveniently). Ubuntu is fine I guess, but I really miss the stability of rolling release and the user-friendliness of not having too many built in programs.

Re: Firefox-patch-bin, librewolf-fix-bin AUR packages contain malware

#77

Post by akerl_ »

johnisgood wrote: post #66
akerl_ wrote: post #51

Earlier quoted context omitted.

Is this accurate? My understanding is that the AUR does not host binary packages. It hosts pkgbuild files, which contain config and scripts that a user has to build on their own machine in order to install. The malicious code here is fetched as part of those scripts.

No, it is NOT accurate. Pacman cannot be used to download, compile, or install AUR packages. You need the PKGBUILD file and use "makepkg -si" at the very least. If you want AUR packages, you'd install a package manager (in this context referred to as AUR helper) like "yay" that supports both official and unofficial (i.e. AUR) packages. FWIW AUR helpers are not even official packages, not even "yay" which is a popular…

And even with 3rd party package managers like yay, the package manager is pulling the pkgbuild definition locally, running makepkg for you, and then installing that.

Re: Firefox-patch-bin, librewolf-fix-bin AUR packages contain malware

#78

Post by bee_rider »

nilamo wrote: post #41
johnisgood wrote: post #32

Earlier quoted context omitted.

FWIW this is AUR. These packages are not officially supported. AUR = Arch User Repository.

Plenty of package managers (such as `yay`) install from AUR by default.

On one hand, the distro developers can’t really prevent people from, say, hitting their computers with a sledgehammer or something. So to some extent, the users have to be trusted.

But, maybe it would be best not to have “yay” available. Using something like AUR without reading the package build files is… pretty bad, right? And it is bad for the community, because if there is a convention of doing that sort of thing, it makes the AUR a good target for attacking.

Re: Firefox-patch-bin, librewolf-fix-bin AUR packages contain malware

#79

Post by johnisgood »

ziml77 wrote: post #60
johnisgood wrote: post #29

Earlier quoted context omitted.

> Blazingly Fast & Customizable Linux distribution I love Arch Linux, but please... (Arch Linux is already "fast" (depends on what you install for your DE, if any) and customizable.)

But their differentiation is that to improve performance they compile all the packages with newer instruction sets as the target as well as enabling more optimizations like LTO. And some are even optimized with PGO.

I find it odd to call a specific Linux distribution blazingly fast.

Gentoo with make.conf (/etc/portage/make.conf[1]) having "CFLAGS="-O3 -march=native -flto"" means that Gentoo, a Linux distribution, is performant?

[1] It is not a good idea to build everything with LTO or PGO enabled because not all packages support LTO / PGO cleanly. Do it on the basis of per-package.

Re: Firefox-patch-bin, librewolf-fix-bin AUR packages contain malware

#80

Post by akerl_ »

jchoksi wrote: post #64
Tharre wrote: post #54

Earlier quoted context omitted.

First of all, this is incorrect, the checking would have to happen _before_ even building the package since malware is already being executed at that point. But more importantly this is a terrible idea in regards to privacy/infosec. I do not want packages I build and install myself to be uploaded to a 3rd party website. And for what benefit? 99% of new malware won't be detected anyway, and once it is known it is way…

> malware is already being executed at that point To ensure reproducible / clean builds, I thought makepkg would always be run in a sandbox/chroot environment. The damage done would be localised to that sandbox. > this is a terrible idea in regards to privacy/infosec. Ok. Devs could setup an option to pacman -U which allows it to bypass VT for privacy sensitive people. This just puts the onus on you to not ensure you…

It seems like you may not be familiar with Arch?

No, makepkg doesn’t run in a sandbox. The system tries to stop you from running it as root, but otherwise all validation of the trustworthiness of the pkgbuild and any sandboxing of the build process are left up to the user. This is part of why pacman, the 1st party package manager, does not fetch from the AUR.

Likewise, it would be generally against the Arch ethos to have the default behavior of the package manager interact with a 3rd party service. If a user wants that action, they’d need to perform it themselves.

Post reply on HN