Hacker News Reader

Hacker News

Comment by acatton | Hacker News Reader

Parent Full thread

acatton

This is installed by adding a shady repository to your apt sources.list...

How is this a supply chain attack? My official debian repository have never been breached so far.

This is no different from downloading an .exe off a shady website and blindly running the .exe.

Also: https://packages.debian.org/search?keywords=download+manager... lists:

• uget: https://sourceforge.net/projects/urlget/

• kget: https://apps.kde.org/en-gb/kget/

• persepolis: https://persepolisdm.github.io/

why use "Free Download Manager" when high quality ones are already officially packaged by debian? Is this targeting new-comers from windows?

View on HN

Basically, as per everything these days, the entire software industry is based on "download and run any old shit off the Internet" with little to no fucks given about the source or trustworthyness or correctness. End users are no better because for most people, including a lot of novice Linux users, this isn't even considered as part of fixing or dealing with any particular problem. Cut / paste / job done.

Worst is I've seen CD/CI systems which just pull unsigned unverified binaries off the internet and build software from github, random APT and YUM repos, all sorts of shit. This is then all thrown together and pushed into production systems.

Other than reputation analysis by Snyk, I honestly don’t know how to objectively analyze one repo/package versus another.

Obviously I can make some basic heuristics, but I can’t reasonably evaluate all of the components of trust for every library, package, container, framework, repo even at a regular interval, let alone fast enough to just maintain patch levels (nevermind being reasonably productive).

I actually considered first steps in making a business out of this idea, but I’m convinced that every developer overestimates their ability to identify untrustworthy repos/packages and companies aren’t willing to pay the actual cost (with either subscription dollars or in the friction it would add to reject almost all 3rd party code because it doesn’t meet high standards of quality and security in a transparent and verifiable way).

>Obviously I can make some basic heuristics, but I can’t reasonably evaluate all of the components of trust for every library, package, container, framework, repo even at a regular interval, let alone fast enough to just maintain patch levels (nevermind being reasonably productive).

Related: have you tried throwing a file (or a hash) at VirusTotal lately? If it's executable, they'll run it in a sandbox and give you a forensic report of everything it touched and did.

I'm so suspicious of software I can't at least review the source code of that originates outside of trusted channels that I probably wouldn't run anything meeting that description that I couldn't compile myself if it weren't for that (and similar) tools.

Virus scan is only 1% of security.

Eg. How do I know with any certainty that a library passes all OWASP best practices? Or is well documented? Or is maintained? Or is responsive to security reports? [… and dozens of other similar properties]

Reviewing code is an insurmountable task if you're using more than a few very simple packages.

It doesn't have to be. Corporations which are FedRAMP[1] compliant, have to build software reproducibly in a fully isolated environment, only from reviewed code.[2]

[1] https://en.wikipedia.org/wiki/FedRAMP

[2] https://slsa.dev/

Ah, I remember when we all did that. It was just part of basic due diligence - pull all your dependencies into your own build system, review and check compatibility, then build completely locally.

Of course a lot of what we built wasn’t public facing or exposed to the internet at all, so addressing the latest vulnerabilities in record time wasn’t quite as important as known-good builds.

I’ve worked in one or two places recently (big bank) that are large enough to have their own internal repo systems and teams of security/compliance reviewers. Their versions of things can be a bit behind but are at least under control of the same org. Everywhere else, well, it feels a bit like cowboy country…

(edit - the other trade-off was of course that you wrote a lot more of everything yourself, rather than pulling in whatever you felt like. This slows down the development cycle significantly but it does mean people had a greater understanding of everything in their stack, and products were often more lean as a result.)

In theory, yes. Who has really reviewed and analyzed every line of Kafka or Spark? Even the bigcos.. don't.

I personally believe this is going to be the biggest security nightmare of the next ten years. All those npm/gem/pip/deb packages that are imported by thousands of projects and Docker images, with maintainers who are retiring. So easy for a malicious actor to just slip in some code, and who has time to audit all those dependencies for every single update?

Or all those `curl install.sh | bash -` scripts that nobody checks that could do pretty much anything, esp when they ask you to sudo

I never understand why people get more upset about the bash script running arbitrary code than the program it's actually installing.

Oftentimes the installer needs greater system access than the code you're running, particularly on Windows

IME most of the randomly-downloaded software I've used does what it says on the tin. But there is a whole screening process: where did it come from? Does the originating site look legit? What are the possible motivations for the creator?

Besides there is no signing mechanism for your random install.sh. Maybe you check the SHA256 but if an attacker alters the script why not alter the website with the hashes too?

Aren't the most interesting things to steal already in the user's home folder, so having admin rights won't really give you that much more.

Depends on the malware. Not all of them aim to steal, some may want to turn your PC into a botnet node, or a remote proxy for illegal activities.

You're absolutely right

https://xkcd.com/1200/

It’s not that the bash script is worse than the installed program. The problem is that the bash script risks installing a malicious program.

Who is running random curl scripts without checking the code first? Is this common now?

Considering:

- Not everyone is proficient in bash.

- Some install scripts can easily go on for thousands of lines, especially if they are designed to work with multiple distro or architecture, or both.

- Said install script might be integrated deep down into someone else's build pipeline.

- ... that's assuming they aren't the type that would blindly download and run random exe from the web in the first place

Pretty common, I would say.

Quite so. A quick example from k3s installation page (https://docs.k3s.io/quick-start):

``` curl -sfL https://get.k3s.io | sh - ```

It bugs me to no end that they (those that give those instructions) are normalizing this.

Nobody reads the source code of all software they are running.

My own estimations and observations say - 80% of programmers do. It's called "great DX" nowadays

Ever install docker on a pet Linux box? That script saves a lot of time.

Unless that is the only way that was possible to save that time, this doesn't matter.

It's like 80% of non distro Linux installers

> How is this a supply chain attack?

It's a supply-chain attack because the article has a section about how the official website for "Free Download Manager" was serving malware to a percentage of people.

> While checking videos on Free Download Manager that are hosted on YouTube, we identified several tutorials demonstrating how to install this software on Linux machines. We observed the following actions that happen in all these videos:

> - The video makers opened the legitimate website of Free Download Manager (freedownloadmanager[.]org) in the browser;

> - They afterwards clicked on the Download button for the Linux version of the software;

> - They were redirected to the malicious https://deb.fdmpkg[.]org/freedownloadmanager.deb URL that hosts the infected version of Free Download Manager.

It's a supply-chain attack on Free Download Manager, rather than on linux itself. The truncated HN headline makes this seem like it's a general linux problem.

| uget: https://sourceforge.net/projects/urlget/

Appreciate sf.net isn't as shady now, but ironic it should be listed as that used to spread malware. https://www.howtogeek.com/218764/warning-dont-download-softw...

Greetings from the Free Download Manager team! Here is our latest update regarding the issue. We have created a bash script that you can use to check the presence of the malware in your system. Please review our instructions on our official page: https://www.freedownloadmanager.org/blog/?p=664 We once again sincerely apologize for any inconvenience that might have been caused.

> This is installed by adding a shady repository to your apt sources.list...

How is this possible? Aren't the packages signed like on ArchLinux so that you can use any mirrorlist?

Yes, they are signed, but not with the official key. If you add it through the UI, it will auto-accept the key from the repository. (I'm not sure how it exactly works, it might ask the user for the confirmation)

If you do it from the command line, by editing files, you will have to add the key manually.

But most inexperienced users will just copy/paste and run the "curl | sudo apt-key add" command from the shady repository website, because they want to run the software.

This is not much different from downloading an .exe from an untrusted website, and ignoring the warning from windows when running the .exe.

Until recently (when apt-key was deprecated), this has been a large security hole (and it will continue to be as long as apt-key is still used). Basically unless a repository in your sources.list includes a signed-by attribute referencing a specific key, then it can install packages signed by any public key you've added via apt-key. Also, sources.list defines an implicit priority order (IIRC it's top-to-bottom), so that when two repositories include a package with the same name, the package from the highest priority repository is installed. You can imagine the security issues that arise from a system dependent on the order of lines in a file that many people manually edit while frustrated and reading a tutorial online.

More here: https://medium.com/@glegoux/ubuntu-22-04-jammy-jellyfish-apt...

"people who walk on the sidewalk often cross the street in front of traffic THEREFORE walking on the street is just like walking in front of traffic"

maybe you intend to deeply explore the behavior of "the most inexperienced" as if it is Typical of Desktop Linux admins?

This is more like using AUR (except the packages are prebuilt with no way to inspect source). They are entirely user submitted.

No. This is not AUR, this is an entire third party repository. It would be the equivalent of these https://wiki.archlinux.org/title/Unofficial_user_repositorie...

If you run Arch, I highly recommend checking out ALHP and chaotic-aur.

>This is installed by adding a shady repository to your apt sources.list...

In the article they show a video which shows the user downloading FDM from the official website, and the file coming from that repo.

Reply on news.ycombinator.com