Hacker News Reader

Comment by throwaway09223 | Hacker News Reader

Anti-virus software is utterly worthless in detecting previously-unknown rootkits. Not a factor.

The typical attack vector for any system would be compromising the inbound software. This is really easy to do when people are downloading and installing random programs from websites. This used to be less common, but popular cutting edge tools have popularized it recently "distro packaging is too slow, etc, curl|bash to install"

On linux, most base software comes from the distro repositories. The question there is how hard it would be to compromise these systems (including one of the mirrors). This includes ancillary packaging systems (pip, cpan, gems, conda, etc)

View on HN

> On linux, most base software comes from the distro repositories. The question there is how hard it would be to compromise these systems (including one of the mirrors). This includes ancillary packaging systems (pip, cpan, gems, conda, etc)

IMO if you're worried about the NSA, I assume they have access to root certificates and your package manager that uses TLS would be vulnerable. Wouldn't have to compromise any system or mirror to do so.

> IMO if you're worried about the NSA, I assume they have access to root certificates and your package manager that uses TLS would be vulnerable. Wouldn't have to compromise any system or mirror to do so.

Debian-derived systems use GPG signing so that wouldn't be enough, there's no central authority in the first place. There are hundreds of Debian developers, and most likely they could find one with poor opsec (or straight-up send a National Security Letter), but they would pretty much be burning that specific individual.

(Do distro package managers use Certificate Transparency? That would be the hope on the TLS-based side)

TLS isn’t a major pet of the security of say APT, the key which signs the Release/Pacakges files is, and the process that provides the checksums to those files, and if you’ve compromised the developer it’s over anyway.

With an NSA able to generate a root cert as you say, I’d trust an apt package from a known provider way before the curl|bash stuff or YetAnotherPackageManagerBecause13ArentEnough that people prefer today.

> your package manager that uses TLS would be vulnerable most distro package managers (dpkg, rpm, etc.) tend to use gpg which shouldn't suffer from those issues (but they could obviously still have some sort of other backdoor for gpg).

Still, I feel like distro packages are really secured compared to stuff you install via pip/npm/... as I don't believe they do anything beyond protecting downloads with TLS.

This seems like an extremely important point, which applies not just to desktop Linux (my OP,) but especially server Linux.

Since I am very much a Linux & infosec muggle, please indulge me with these possibly dumb questions:

What are the mitigations for the lack of provenance in pip/npm?

Does properly configured SELinux do enough? Or is the fact that many of these packages use 80/443 negate that? Or is the fact that a pip/npm package could be comprised after install, during update the main problem?

I always think of that left-pad NPM drama, could that single dev have comprised thousands of systems by changing his update to something much more nefarious, instead of just deleting the package?

Again, sorry if these are dumb questions.

Well, it depends on what you consider "properly configured". But I'd say most systems used by developers aren't secured against these attacks. This mostly boils down to (like discussed elsewhere in this thread) that the developer runs his tools as his user, thus malicious software can modify his .bashrc and using that hijack a later sudo invocation to gain full access.

The thing that "protects" you is package locking, where unless you explicitly update your packages, you'll stay on an uncomprimised version (this broke with leftpad, as every available version was deleted). Locking has the downside that you don't get security updates for your software, which might be even more harmful tho.

Oooof. Thanks. So let’s all pretend that everything is gonna be fine then I guess?

Say it was Ubuntu Desktop… would installing the supported EPP, ClamAV help in some regard? It would, right? Should this be a Tell HN type thing?

Maybe ClamAV being installed by default, like UFW, is the real (partial) solution?

I don't know what EPP provides (I doubt it'll help you in this case), but AFAIK least ClamAV only matches against known signatures (almost exclusively windows malware), so it can't detect newly created malware.

To protect a system, the only really reasonable approach is to not run code/binaries you don't trust. Once malicious software capable of writing files in ~, it's too late (those new sandboxing solutions are also not really solving this, as their interfaces to access files suck, so everyone continues to use the posix api with full access).

The only "Linux system" that can be considered secure in that regard is Android, as you don't have software that tries to execute "random" stuff in ~ and Apps tend to get away with using SQLite (not exposed to the user) over complex filesystem structures. Obv. you used to be able to access ~ rw, so malware could still upload/encrypt your Data, but most Users only have Pictures there (as other data was only stored in app-only storage [/data/data/<id>/] that couldn't be accessed by anyone else). Now you don't even have access to that, so malware is even more limited (but obv. legitimate software also suffered from that, for example WhatsApp used to store it's data there in ~/WhatsApp/ so you could simply access media sent/received on chat but now its far more hidden).

Now that I have had a chance to recall this story a bit more, I should not have mentioned the nation state actor aspect, it was distracting.

I believe the point was that they wouldn't have to do the paperwork, and wait to run it up the chain for the big guns.

Also, maybe the big guns would not be authorized for this particular op. I think what they were getting at was that there was probably no need for all that as there was no end point protection agent.

And, now I am inferring, that on desktop Linux, with all of the additionally installed attack surface combined with how often people actually run apt update && apt uprgade && apt dist-upgrade... "it was going to be (relatively) easy."

This mental model is oversimplified enough to be misleading, throwing up your hands too easily. See eg the Snowden revelations and pervasive passive eavesdropping, and the spectrum of increasingly risky/costly operations icreasingly valuable spoils that can't be had with easier methods. Rogue TLS certs are risky to use because the CA gets burned in the transparency logs.

I mean yeah, I would say that's one way to compromise those systems.

> Anti-virus software is utterly worthless in detecting previously-unknown rootkits.

Maybe the "this will be easy" part was that without AV software, there was a greater chance that they could just spin up Metasploit, and wouldn't even have to use one their stockpiled zero-days?

AV doesn't detect the exploit mechanism -- that's not how it works. It's only pattern matching existing binaries.

The difficulty level is "recompile with small changes and test that it doesn't match" not "develop a new attack vector"

It really is stupid and pointless against an attacker with even a bare minimum of competence (able to run a software build vs downloading binaries)

But AV (EPP) could detect a binary which was passed through a traditional vector, like phishing or gaining access to a "trusted" email account and attaching a compromised PDF, as a random example.

Just a reminder that I was originally talking about desktop Linux, and all of the additionally installed attack surface which that entails.

It would seem to me that it does not matter how "technical" a user is, they are still human, and some of the time anyone could fall for a well formed phishing attack. We all get tired, overworked, or click too fast, etc.

Not running AV on a desktop OS and relying on one's own superhuman technical ability seems like the exact type of hubris that would be ripe for attack.

> attaching a compromised PDF

This means either:

- a 0day, which would require the AV to have a PDF parser better than the standard document viewer, and the ability to sense that this PDF is "weird" -- I would expect AV companies to publish ads "our AV has detected a 0day in XXX"

- a vulnerability was recently discovered in a PDF viewer, and the AV company can push their definitions earlier than the standard "package the fixed version - send to debian-security - let users upgrade" route. This would shorten the attack window by a few hours. Again, I would expect AV companies to boast "we were X hours earlier than the official fix".

Which one is the case? Or is there another option?

Actually, this whole "buggy PDF parser" thing should be solved by application sandboxing -- there is no need that document viewer needs any other access to my system. Unfortunately, Linux is lagging behind. There are some AppArmor experiments with not so great UX, and then there is QubesOS, which is difficult to use. The average Linux desktop is AFAIK almost unsandboxed.

Thank you for replying.

I am now at the limits of my understanding...

I only ran Ubuntu as a desktop daily driver for a year or so, and I'm a muggle, so my understanding is limited. But, is there any real-world data on how often desktop Linux users run the equivalent of:

  sudo apt update
  sudo apt upgrade
  sudo apt dist-upgrade

versus the more automated update systems MacOS or Windows ?

I am genuinely curious which ecosystem is more likely to be up to date. In my limited experience, I ran into issues updating on Ubuntu, and have not on MacOS and Windows. It seems like MacOS does it best as most applications come via the App Store, and on Windows that's in the future leaving most apps to take care of their own updates. However, Windows makes up for that a little bit with excellent, and auto-updated EPP, so that's something at least.

In your view, which desktop OS is most likely to be up to date for OS and apps?

I think Ubuntu has some kind of notifier in "tray". For me, I am subscribed to debian-security mailing list and update when something that is running on systems that I manage seems to be affected.

> versus the more automated update systems MacOS or Windows

I'm not sure -- it is better with Microsoft Store, but other apps solve updates on their own, with various success. I have little experience with Windows and no with mac OS, so I cannot comment.

The point is that it offers absolutely no defense against an APT -- who can simply include a binary that won't match any known exploit pattern.

It is not a meaningful technical barrier. It's the equivalent of storing a big table of mean things people said in a chat and suggesting this could prevent a capable person from insulting someone. Any moderately competent person can think of a way to communicate without using previously blocked phrases with minimal effort.

The AV databases are known - it is trivial to test against them to ensure a binary won't match.

AV is a crude tool, good only for blocking the most basic of efforts. It has no utility against a nation state.

How many genuine issues (not nonsense like “blah.con has stored a cookie” does your av pick up?

It is very likely that a modern AV (I should have been saying EPP) will pick up your average re-encoded payload, or Metasploit fun time. Certainly they will pickup most known vulnerabilities. Endpoint Protection (EPP) orgs use the same CVE DBs that adversaries use.

See another user's comment: https://news.ycombinator.com/item?id=38594247

Security is an onion, perfect is the enemy of good, etc...

Why make it easier for the adversaries? While annoying, running EPP on your desktop OS is not exactly neuroscience.

Ideally, it's furnished by the OS provider so that there are fewer parties to trust. I hate to say it, but Microsoft is now teaching by example. MS has factually one of the best-in-class Endpoint Protection agents on the market.

If resources allowed, all other desktop OS providers should follow suit, otherwise they are just shirking responsibility.

So presumably you run it. How many bad things has it stopped in the last 2 months?

Any recommendations for a good AV/EPP for desktop linux (ubuntu)?

You have asked the most important question. I should have asked it as well.

Would love other input as I’m not an Ubuntu daily driver anymore.

It turns out 22.04 has ClamAV “provided and supported,” but not installed by default. So it should easily install manually. That’s what I would go with first, as it’s officially supported. An OS vendor supporting a specific AV vendor is a really big deal imho.

If that is not satisfactory by some metric, and this is just my personal and dated opinion… I used to like Eset.

I was naive before, but next time I install desktop Ubuntu, I will install ClamAV immediately.

This would fit my expectations of a classical 1990s antivirus, however I would expect modern ones to also employ heuristics against behaviours.

Are you referring specific'ly to a limitation ClamAV?

Why worry about stockpiled zero-days even for non-linux systems when they can just force MS or Apple to hand over data or inject whatever they want into an OS "update".

If I'm beginning to recall the story correctly, it's that your suggested route would involve more time, paperwork, and this particular op might not be important enough to get the big guns authorized by the higher-ups. Hence, "oh, this will be (relatively) easy..."

Most of the currently used AV software contains heuristic/ML components that are able to gather and analyze various indicators of compromise. Without something like that running, you're basically tied to manual review of systems running at the moment. Making malware for such scenarios is basically making a Base64-encoded script in the language of your choice and then exploiting something(either the user or some software) to get it to execute.

I know, because I've been writing small malware toys and it got blasted by both Bitdefender and ESET.

> Most of the currently used AV software contains heuristic/ML components that are able to gather and analyze various indicators of compromise

Ransomware runs just fine on corporate computers with the latest and greatest "antivirus" software.

I really lost hope some 10 years ago, when i saw that i have to manually remove malware from memory sticks, because macaffe was clueless. After more than a year they released an update that will detect and remove the malware (it was a virus speading through autorun.inf with exe names which did not have any sense like jhghjjj.exe)

I can't speak to that particular attack vector today, but it's interesting that McAfee isn't even on this Gartner chart, and that Microsoft is now a leader. Things have really changed in that space.

https://www.cybereason.com/blog/cybereason-named-a-leader-in...

Corporate Ransomware attacks typically use 0-days and social engineering to achieve goals. No system is perfect, but a system in place is better than not having anything in place.

Things have changed in the last 10 years. Long gone are the days of only using signature databases.

https://attackevals.mitre-engenuity.org/results/enterprise?v...

Reply on news.ycombinator.com