Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Firefox-patch-bin, librewolf-fix-bin AUR packages contain malware

lists.archlinux.org

Post reply on HN
Print view View original

81–90 of 142 posts

Re: Firefox-patch-bin, librewolf-fix-bin AUR packages contain malware

#81

Post by johnisgood »

akerl_ wrote: post #77
johnisgood wrote: post #66

Earlier quoted context omitted.

No, it is NOT accurate. Pacman cannot be used to download, compile, or install AUR packages. You need the PKGBUILD file and use "makepkg -si" at the very least. If you want AUR packages, you'd install a package manager (in this context referred to as AUR helper) like "yay" that supports both official and unofficial (i.e. AUR) packages. FWIW AUR helpers are not even official packages, not even "yay" which is a popular…

And even with 3rd party package managers like yay, the package manager is pulling the pkgbuild definition locally, running makepkg for you, and then installing that.

Yeah, it is called an "AUR helper" officially because it just automates these processes for you.

Re: Firefox-patch-bin, librewolf-fix-bin AUR packages contain malware

#82

Post by andrelaszlo »

ASalazarMX wrote: post #20
WD-42 wrote: post #12

As Arch seemingly explodes in popularity I’m afraid we’ll start seeing more of this.

The only thing I've seen Arch exploding in popularity has been memes. It's a fun distro for hobbyists, but too inconvenient as a daily driver.

I've been using Arch as my daily driver for over fifteen years. I'm not a fanatic, it just works really well.

Re: Firefox-patch-bin, librewolf-fix-bin AUR packages contain malware

#83

Post by Tharre »

jchoksi wrote: post #64
Tharre wrote: post #54

Earlier quoted context omitted.

First of all, this is incorrect, the checking would have to happen _before_ even building the package since malware is already being executed at that point. But more importantly this is a terrible idea in regards to privacy/infosec. I do not want packages I build and install myself to be uploaded to a 3rd party website. And for what benefit? 99% of new malware won't be detected anyway, and once it is known it is way…

> malware is already being executed at that point To ensure reproducible / clean builds, I thought makepkg would always be run in a sandbox/chroot environment. The damage done would be localised to that sandbox. > this is a terrible idea in regards to privacy/infosec. Ok. Devs could setup an option to pacman -U which allows it to bypass VT for privacy sensitive people. This just puts the onus on you to not ensure you…

> To ensure reproducible / clean builds, I thought makepkg would always be run in a sandbox/chroot environment. The damage done would be localised to that sandbox.

makepkg runs in a fakeroot environment, but this is not a security barrier. There is also support for building inside systemd containers, offering at least limited security, but most AUR helpers don't use that yet.

> Ok. Devs could setup an option to pacman -U which allows it to bypass VT for privacy sensitive people. This just puts the onus on you to not ensure you aren't installing malware. The default Arch user should still be protected while allowing for your privacy needs.

You mistake the target group of Arch Linux. Users are expected to read the documentation and to know what they're doing. Protecting users from themselves at the expense of those who know what they're doing is not what Arch is about.

> Its too late then. People are already affected.

That doesn't make sense, it's too late for people if new malware isn't detected by VirusTotal as well.

Re: Firefox-patch-bin, librewolf-fix-bin AUR packages contain malware

#84

Post by johnisgood »

gpm wrote: post #73
Shellban wrote: post #63

Earlier quoted context omitted.

This is really scary for those who manage multiple things. I'm considering running a factory reset on everything from my router to my Steam Deck and remote server.

Uh... did you install these AUR packages? It seems quite unlikely you installed these on either a router or a steam deck... That said, if you did, yeah being hacked is scary and I feel for you.

I wonder if he even has any unofficial packages installed.

Re: Firefox-patch-bin, librewolf-fix-bin AUR packages contain malware

#85

Post by Shellban »

gpm wrote: post #73
Shellban wrote: post #63

Earlier quoted context omitted.

This is really scary for those who manage multiple things. I'm considering running a factory reset on everything from my router to my Steam Deck and remote server.

Uh... did you install these AUR packages? It seems quite unlikely you installed these on either a router or a steam deck... That said, if you did, yeah being hacked is scary and I feel for you.

As @lillylizard pointed out, it turns out that these are new packages, not comprised existing packages like I first thought. Still, the nature of the hack is a Remote Execution, as you pointed out elsewhere, meaning the hacker could pull my router password from the password manager, or grab my SSH keys and log into whatever machine is listed in the known_hosts, or just mess with my Ebay account and the credit card saved on there. The hacker could in theory do literally anything I could do.

Re: Firefox-patch-bin, librewolf-fix-bin AUR packages contain malware

#86

Post by tojumpship »

jchoksi wrote: post #64
Tharre wrote: post #54

Earlier quoted context omitted.

First of all, this is incorrect, the checking would have to happen _before_ even building the package since malware is already being executed at that point. But more importantly this is a terrible idea in regards to privacy/infosec. I do not want packages I build and install myself to be uploaded to a 3rd party website. And for what benefit? 99% of new malware won't be detected anyway, and once it is known it is way…

> malware is already being executed at that point To ensure reproducible / clean builds, I thought makepkg would always be run in a sandbox/chroot environment. The damage done would be localised to that sandbox. > this is a terrible idea in regards to privacy/infosec. Ok. Devs could setup an option to pacman -U which allows it to bypass VT for privacy sensitive people. This just puts the onus on you to not ensure you…

> Devs could setup an option to pacman -U which allows it to bypass VT

Goes against the very nature of the distro. I very rarely see assumed defaults in Arch, and they are almost always opt-in. Mind you, you need community provided helpers to automate AUR building, its that barebones and I'm sure there are people who manually build / use custom scripts to build every package.

Re: Firefox-patch-bin, librewolf-fix-bin AUR packages contain malware

#87

Post by Shellban »

johnisgood wrote: post #84
gpm wrote: post #73

Earlier quoted context omitted.

Uh... did you install these AUR packages? It seems quite unlikely you installed these on either a router or a steam deck... That said, if you did, yeah being hacked is scary and I feel for you.

I wonder if he even has any unofficial packages installed.

I had the regular librewolf-bin package installed on a couple of my machines. It took me a bit of time to note that librewolf-fix-bin is something separate.

Re: Firefox-patch-bin, librewolf-fix-bin AUR packages contain malware

#88

Post by npteljes »

I wonder how popular these packages were. Librewolf and Firefox sure are popular, so this sounds scary, but for example searching for "firefox-patch-bin aur" yields no results, aside from sites talking about how it contained malware.

My impression is that the malice was spotted timely, and not many people were affected. Which is a pretty good thing!

Re: Firefox-patch-bin, librewolf-fix-bin AUR packages contain malware

#89

Post by johnisgood »

Shellban wrote: post #87
johnisgood wrote: post #84

Earlier quoted context omitted.

I wonder if he even has any unofficial packages installed.

I had the regular librewolf-bin package installed on a couple of my machines. It took me a bit of time to note that librewolf-fix-bin is something separate.

Yeah do not worry, you are fine.

https://aur.archlinux.org/packages/librewolf-bin#comment-103...

Re: Firefox-patch-bin, librewolf-fix-bin AUR packages contain malware

#90

Post by npteljes »

jabjq wrote: post #2

> We strongly encourage users that may have installed one of these packages […] to take the necessary measures in order to ensure they were not compromised. How are they supposed to do that when you give them no information as to what the malware does?

In case of any infection, the necessary measures are to take the affected machines offline, extract whatever data you need, and then wipe.
Post reply on HN