It’s a different world now. I can’t help but feel there used to be honor among hackers. You didn’t go after your own. What kind of jerk would attack Arch Linux?
This has absolutely not ever been the case.
EDIT: Rereading, maybe it's that other kind of "hacker"...
I think it was. Eg: on most russian warez forums in the 2000s, it was a bannable offense to crack russian-authored software.
That being said, I think the particular example you provided is kind of weak. It's my understanding that the behavior you speak of was driven primarily by the Russian government's unofficial policy of ignoring cybercrimes committed by their citizens so long as the targets were not domestic. They were ensuring their ability to continue operation by banning discussion of targeting Russians. This is how groups like the Russian Business Network have been able to flourish.
If 1:10,000 people is an axe murderer, when your community reaches 20,000 people... You have to create an axe-murderer-captcha.
The answer is: Russians
Source: I'm the guy that built the antimiasma mitigation tool [1] and tracked their malware campaign iterations very closely.
Set LANG to ru_RU.* and the malware implant stops spreading itself, as with all APT28/29 malware.
[1] https://github.com/cookiengineer/antimiasma
[2] https://cookie.engineer/projects/cyber-defense/antimiasma.ht...
That is why I linked my blogposts, the tool, and the whitepaper that I published about it. You have to read it first to come to your own conclusions.
If you come to conclusions without reading either of it, there's no point in arguing with you because you made up your mind anyways, and are not interested in learning about malware reversing :)
Incorrect. ASCII is 0000-007F and the BMP is 0000-FFFF
There have been a variety of cultural elements to people doing security research / hacking on their own systems / etc.
There has never been "honor" among criminals looking to use technology to steal money or steal things that can be converted to money.
What’s more likely is the effort required for large scale attacks is easier now than ever thanks to LLMs.
My assumption is these aren't so much hackers, as modern day script kiddies armed with LLMs and too much free time.
That is never how the AUR was supposed to work. Updates were intended to be a manual process where the user reviewed changes to the PKGBUILD.
It's definitely an outlier, but more in terms of being something that doesn't really exist anywhere else, so of course the security model for it will also be an outlier. That's not an excuse for any security issues, but it's not like Arch doesn't have official repos with maintainers who are just as diligent as any other distro. They just also happen to provide a public git server that people can publish packages to with a UI for seeing some of the package metadata; people could just as easily write toolling to automate package management where it looks for a GitHub repo instead of an AUR one to fetch the build files.
And no, "people using one Linux distro can opt in to possibly getting pwned by each other by making use of a third-party software depot" does not reflect upon the entirety of the Linux world.
And unfortunately that’s how arch is mainly marketed by its users. “Arch has the latest everything, if it’s not in the repos it’s on AUR” is one of the standard selling points.
Of course that speaks to how people use linux insecurely not how Linux is insecure.
Maybe most users just ignore that and always answer yes without inspecting it. I don't know. But the wiki for the AUR and Readmes for many of these tools have warning banners telling you not to blindly trust AUR packages.
Nonetheless, the full tray is just one yay away, which also speaks git.
How you use such tools is totally up to you.
So far I've been unaffected by the AUR hickups, running Cachy for about 2 years now.
But I've been always wary about the AUR, trying to minimize its use. Even in the phase where I used pure Arch for several years. It tends to get messy. So less AUR is less mess.
There are more ways to attack people than third party software depos.
significantly so. Windows has a coherent story when it comes to permissions and access. Differentiated out access controls, least privilege, UAC, mandatory integrity control and all configured out of the box.
Without AppArmor or SElinux correctly configured, which it isn't on most desktop distributions in the linux world most of your apps can still read anything, there's little sandboxing. The NT Kernel was designed with an object model in mind so you always had the abilities to have rich descriptions and policies for whatever you're handling where all of that is bolted on unix systems after the fact.
Maybe I’m a minority, but the tools are very mature and easy to use IMO. In windows land people are still installing random EXEs, that’s the reality.
Yet that doesn't seem to matter much for stealer malware.
Of course Windows regardless has taken the brunt of the attacks because it ran virtually every desktop machine in the world so people go after users anyway. Desktop Linux systems where never economically interesting for malware. But now that they have gained a modicum of traction they're going to get the exact same treatment, hence this thread.
Microsoft doesn't advertise it much but they do have the advantage of controlling their build environments, software is signed etc. A system like the AUR where you pull in unsigned packages from anonymous people with so many arch users relying on it is not going to be easy to address. It lived on security through obscurity.
It's not meaningfully reduced. The stealer just has to call CryptUnprotectData before uploading it. It's not even like it will show a suspicious prompt to the user, without having to do anything extra the stealer can silently decrypt it.
I agree with the rest of the post though.
Now it got more popular but still low entry attack.
> It’s a different world now. I can’t help but feel there used to be honor among hackers. You didn’t go after your own. What kind of jerk would attack Arch Linux?
Not sure why hacker would waste their time fiddling with Arch instead of hacking stuff, everything that they need can run just fine on any of the Debian derivatives.
I also believe this is the main reason why web took off: effortless distribution and sandboxing.
It's weird that installing software is weird to you.