Hacker News Reader

Comment by joecool1029 | Hacker News Reader

Nice read but nothing particularly special here and it happened months ago. The title is alarmist.

TL;DR: The user ran firefox as root and the attack happened through adobe-flash. Hardly a sophisticated attack.

Why does it matter if Firefox ran as root or not? I agree it's terrible practice in principle. But most people will run Firefox as their ordinary user, which normally has full access to the files in their home directory.

If someone gets arbitrary code execution under your user, they can erase/encrypt your files. Who cares if the OS files are safe. All the data you really care about will be gone.

There may be things an exploit can do as root that wouldn't work under your user to break out of the adobe flash "sandbox". But yeah, the real recommendation is to get rid of flash and kill it with fire. The security of free software isn't fullproof but good riddance from the web to that particular closed source blob.

It will come back as WebAssembly.

What makes you think that? WebAssembly will at least not be single implementation, closed-source, no-maintenance like Flash.

I am betting someone will bother to create a SWF to WebAssembly translator, maybe even Adobe.

The whole point of security and good practices is to make harder for those arbitrary codes to be executed (or for whatever other flaws to be exploited, until they're fixed). Running a browser as root is not good practice. Doesn't mean that something bad will happen, but it's more or less line laying the cheese on the ground and expecting mice not to go after it. Even if you have none around, you just shouldn't risk it. At all. Unless you know exactly what you're doing.

Firefox has some sandboxing on Linux, though it's quite recent.

It had level 2 content sandboxing from FF54, and level 3 (which has write and read access restrictions) with FF57. https://wiki.mozilla.org/Sandbox#Current_Status https://wiki.mozilla.org/Sandbox#Content_Levels_2

Thanks. The post is more than a few months old, it predates FF 54 (released in July 2017).

This is why I wish people took mandatory access control more seriously. But to make it really pervasive and useful you need something like what Android has, where the file format mandates MAC profiles for the app. Even Red Hat cannot maintain SELinux profiles for every package in every repo, and even then third parties would complain about having to write the profiles just for RHEL / Fedora packages.

It is something the entire ecosystem would have to, at once, agree to make happen, and then standardize mandated MAC profiles in every package format. So basically never.

agree. ordinary user is absolutely sufficient. I'll now present a sophisticated privilege escalation method that most of us won't notice (me included, sarcasm off):

  alias sudo='/usr/bin/sudo echo something evil && /usr/bin/sudo'

I don't think it matters that he used his root account.

Edit: Maybe I'm wrong with my opinion, you can disable ASLR using your root rights... https://askubuntu.com/a/318476

Edit: Last exploit for Linux remote exploitation with Flash is from 2015 https://www.rapid7.com/db/modules/exploit/multi/browser/adob... or did I miss something here?

I use /usr/bin/sudo <>

So they check .bash_history and then they realize they just need to also `alias /usr/bin/sudo`.

Hm. How about ‘sudo’ <> ? i.e. quote the command?

Based on the sibling comment to yours, I don't think bash supports this. zsh allows you to make a \'sudo\' alias though, so it depends on your shell.

At least in bash, quoting the command disables any alias. Maybe also in zsh?

zsh seems to have much more flexible alias rules than bash:

    > alias \'sudo\'='ls -a'
    > 'sudo'                
    .  ..

If they have access to your .bashrc they can also alter your PATH and create a script named sudo somewhere they have write access to that carries the malicious payload. So you're not gaining much by adding the quotes.

> So they check .bash_history and then they realize they just need to also `alias /usr/bin/sudo`.

    $ alias /usr/bin/sudo=whatever
    bash: alias: `/usr/bin/sudo': invalid alias name

Oh, fair point. Not all shells support this apparently. zsh does:

    -> alias /usr/bin/sudo='ls -a'
    -> /usr/bin/sudo
     .  ..

I'm going to make a separate account just to run the web browser, xhost +localhost && su -c web-browser unprivileged-user

If you're using xwindows they can just install a keylogger

As an attacker, I test for sudo -n. If it succeeds, I have root. In most cases I do not need it however. SSH key trusts, SSH multiplexing and bad posix permissions are more than enough to get me anywhere and grab anything.

There was a zero-day for Flash being exploited ITW just a few days ago.

I didn't think any browser on Linux still supported Flash.

Its possible to run firefox with fewer privileges so that the only thing it could delete are your recent downloads.

The title seems fine to me. I knew Linux ransomware was a theoretical possibility, but I didn't know it was out there in the world. Or, as they say, "in the wild".

stand up an old version of wordpress with poor admin/admin credentials on an external box, and wait a couple hours. You'll find all sorts of malware on a linux box. ransomware included. Pretty common, though it seems most people who compromise linux machines use them to launch further attacks, not ransomware. The ransomware linux variants I see all do about the same thing: wipe various /var/log/* logfiles, they encrypt all your mysql dbs, your homedir files, and your webserver docroot.

I'm not sure I agree with your anlaysis. True the user ran Firefox as root (which is terrible practice), but also had the same problems on a different system that never ran firefox:

> Interesting to note that another system, also a sister, seems to have caught the same, and I can't recall ever having run anything but VirtualBox VMs on that one, it's turned off right now until I figure out a recovery plan, so at least 2 systems to recover, and have one clean one to do so from.

That said, it could easily be explained if SSH private keys weren't encrypted (passphrase protected) and allowed an easy hop from infected to sister. And if somebody is running Firefox as root, it doesn't seem too extreme to assume they might have unencrypted private keys...

So it may just be from running Firefox as root, but it's still possible it could be from other things.

> TL;DR: The user ran firefox as root and the attack happened through adobe-flash. Hardly a sophisticated attack.

That has been speculated but far from proven. On the last page they are still talking about the point of entry and how they are in no way convinced it was FF/Flash.

First time I've seen ransomware on Linux though ... maybe I'm not paying attention...

Yeah I thought I was doing alright dual adblock and virtual box.

Isn't that how most ransomware spreads?

Here's a detailed view on Angler exploit kit which spreads through ad networks[1].

What's a good way to browse safely without using something like tails? There's firejail[2] and obviously I can run it as a different user

[1]: https://news.sophos.com/en-us/2015/07/21/a-closer-look-at-th...

[2]: https://firejail.wordpress.com/

Also, don't run ads (at least not without protection).

I assumed that was implied for every HN reader. But even though I have noscript and ublock with a lot of things blocked you never have 100% coverage.

People claim to run noscript but every page calls js from 10 different domains. How on earth do you navigate what to let through and what to block? And at some point, to me, it’s just too many mouse clicks!

You learn with the time and also sometimes when its not so obvious, what to activate and what not, I just close the tab and don't bother with the content.

It is tedious, but I do it. If I ever get lazy I always select "temporarily add..."

For the most part here are some patterns I've noticed:

1. when pages don't work at all, try looking for cloudflare links. They might have their JS and CSS hosted there

2. When you want to play videos or audio look for *cdn domains (aliexpress has alicdn for example). These ones I tend to add to my whitelist.

3. If you have something like google apis you can add it to the whitelist and add a sitespecific conditional in adblock or ublock.

It can be tedious; but so can waiting for somebody's poorly written javascript to lag your browser.

I started blocking all JS by default for security, but I've actually found it to be a much better user experience as well. You deal with the annoyance of having to whitelist domains, and sure a lot of SPAs don't work at all until you enable JS for the client-side rendering, but many, many websites work far better because all the content I care about is server-side rendered and JS is used to load ads that disrupt the experience (this is especially true on mobile. For that I highly recommend the Brave browser). You'd be surprised how much better it can make parts of the web tho to have no JS :-)

Try uMatrix.

The uMatrix UI makes managing this a lot easier.

Yes, and it has a CSS-like flexibility. E.g. you can allow *.cloudfront.net _if_ the top-level site is one you trust

I use the built-in script blocking in Chrome, it's fairly quick to whitelist any scripts i actually want to run. It's by domain though, so not really perfect. I also block ad servers at the DNS level, and run an an blocker. Until recently I didn't need the blocker, but ad networks have gotten better at serving from legitimate hosts, so I can't just block them anymore.

There are lots of services I would be glad to outright pay for, or have some sort of flattr-type service attached to. I don't feel one iota guilty for blocking ads, given the risks and costs.

I always assumed that everyone on HN would be using uMatrix. Strangely it doesn't seem very popular.

I don't run JS at all except for very few webpages (think gmail log in page, etc).

EDIT: Now that I think about it, I haven't really stressed how good uMatrix is. It really has changed the way I use the internet.

> It really has changed the way I use the internet.

I agree so much. I cannot recommend umatrix highly enough. It has put me completely back in control of what sites can and can't do. I block everything by default except for first-party CSS and images (e.g. *.ycombinator.com when I visit news.ycombinator). It's great, and not at all as bothersome as I thought.

No more HTML5 pop-ups, deceptive ads, no more auto loading videos, no more sneaky audio, no more weird javascript that slows my browser to a crawl, no more tracking.

Honestly people, give it a shot. It's amazing.

On my laptop, I block all images by default, while I don't on my desktop (like you, I load CSS and images there).

I find myself more and more liking to use my laptop for browsing, which makes me think I could block images by default on my desktop as well and rarely ever notice it anymore.

Its a worthy of the time endeavor, trust me. White listing very carefully over time enhances the browser experience, but you are right there are sites that go excessive on the off-domain js callS, but I choose to just get content elsewhere. Its time people were pickier about this stuff and pushed back more to the companies.

Running NoScript is a real eye-opener, even if you don't stick with it, because the about of bullshit that is pulled down from visiting a common website is incredible.

Try RequestPolicy and you will see the other 80% of crap...

I hadn't heard of that. Thanks.

I run umatrix, and I block everything. Cookies, CSS, images, scripts, media, XHR, etc. Everything, except for CSS and images from the thirst-party domain (e.g. *.ycombinator.com).

Most sites actually work better with this. They're faster, there's less clutter, no ads, less risk. Some need a little convincing by unblocking some CSS or images. Umatrix makes this super easy. If a site requires javascript to run, I just skip that content. It's different for web apps like trello or github of course. Those get much more permissions.

> How on earth do you navigate what to let through and what to block?

umatrix gives a nice matrix (duh) that shows exactly what's trying to load. I dont often need to unblock things, but when I do, it's usually obvious right away. Takes maybe two clicks. Worth the effort IMHO

On my Linux desktop, I run firefox with uMatrix and if a page isn't readable without javascript then I don't bother, except a very few handful of sites that are whitelisted. If it's content that I really feel like I need to see, then I run chromium with just an ad blocker. They are each run from separate chroot instances, though with firefox container tabs that won't be as necessary anymore maybe.

On my macbook, I run Safari with no loading of JS or images at all, and firefox with uMatrix again. And again, if a page isn't readable without JS, then I don't read it, or I wait until I can use chromium on my desktop, assuming that I'm not going to allow the scripts in uMatrix, which I usually don't.

On my phone, I run Safari with JS always disabled, which is actually perhaps surprisingly fine for the vast majority of mobile websites.

And I run firefox for iOS with JS enabled if I really really need to look at something that doesn't work on non-JS Safari.

You get used to it. Most JS on the web is junk anyway. I don't have any FOMO by avoiding JS almost entirely, but maybe that's just me (and people like me)?

Not to mention noscript breaks well over half the web for most folks. Very few people have a web experience primarily serviced by plain text.

Chrome has a better sandbox than Firefox, for one.

A notch better would be running Qubes OS.

>TL;DR: The user ran firefox as root and the attack happened through adobe-flash. Hardly a sophisticated attack.

While possible, this sounds so spectacularly unlikely that I can’t help but think that you’re just speculating.

The article itself mentions running Firefox as root, but there's no way the user can be sure that's the infection vector.

Reply on news.ycombinator.com