Arch Linux AUR Hit By Another Wave Of Now More Sophisticated Malware Attack

submitted by

https://www.phoronix.com/news/Arch-Linux-AUR-More-Malware

38
13
3

Log in to comment

Hot Top New Old

Comments in Arch Linux@lemmy.ml

this is awful. the aur is my favorite feature of arch based distros.

 reply
14

Really? Not pacman?

 reply
4

most distro package managers strike me as about the same. having a massive library of obscure stuff packed up to work on my system was a big plus. disnt have to compile hardly anything from source anymore

 reply
1

I think this shows that the process of changing ownership of an orphaned package needs to be a manual process.

Of course, AUR packages also need to be thoroughly vetted by the end users to avoid unexpected changes.

🎯
1
 reply
17

So you remember how your helper asks you to see diffs … you take a look at those and understand them before approving, right?

Because I’m getting the sense that people are not doing that

 reply
12

And if you’re not a developer?

 reply
2

Then don’t use an automatic AUR helper. Use chaotic aur if you must. Or use aurto

 reply
7

Even if you aren’t a dev, any user that chooses to use the aur should do their due diligence. There is a reason why I prefer flatpacks over aur, I don’t want to have to check diff’s every update.

 reply
2

Then learn to read the diffs. Most of the time they are changing the version number and package hash which is mundane and nothing to worry about. If more than that changed then that should make you curious why and dig deeper.

 reply
3

I know how, I’m just saying, not everyone has the technical acumen.

 reply
2

Right, and I’m saying that a lot of updates are mundane and easy for anyone to read. And if they aren’t mundane then look into it. Try to learn. The alternative is to run code you don’t understand and hope for the best which didn’t work out for people here. So if you don’t want to try to learn, and you don’t want to blind trust, then the alternative is to not use the AUR.

Like one of the attack vectors was adding a “post install” step that was a bunch of obsfucated gibberish which should’ve been a red flag for anyone, technical acumen or not

 reply
1

You don’t need to be a developer to read diffs and package builds. I have memory and cognitive impairment and manage fine. I’m also not remotely into software programming.

 reply
1

I wonder if this is because of steamOS switching to Arch, and they have a wider target now.

 reply
3
edited

Steam OS is immutable and does not enable AUR use by default.

Unless you’re a power user you probably won’t be using AUR on Steam OS.

 reply
3
OP

Another thing is perhaps GenZ does not grok PC security. Security-wise, a Linux PC is very different from an iPhone, because everything shares the home folder.

 reply
2

Comments in Linux@programming.dev

What is even the goal here? It’s just such a weirdly specific target. You could easil hit more people by supply chain attacks. Feels like some butthurt hacker wants to get their revenge on just Arch in general. I want to start a Manjaro-Takeover conspieacy theory rn

 reply
39
edited

It seems like a continuation from the DDOS attacks that still happen from time to time. If I was going down the conspiracy rabbit hole, I’d think some group is trying to keep linux in the press with bad/scary news to drive away growing interest and arch seems like the easiest target atm.

 reply
48

That is one dumb fucking conspiracy theory.

Ok I guess it fits with the others…

 reply
1
edited

I think we’re going to see a lot more of this kind of thing because supply chain attacks are “cheap” to hack together with LLMs now. The attackers are just fishing, if 1 in a million of the people who get infected has a valuable or monetizable credential that they can exfiltrate, they’ll make their money back. Just like phone and text spam became ubiquitous when jank-ass phones and sims became cheap, supply chain and low effort hacking campaigns will become prevalent when jank-ass programming becomes cheap.

 reply
7
edited

As a new arch user how do I check PKGBUILD and install script changes? And what am I looking for out of the ordinary?

Feel free to point me to a wiki page if possible

Nevermind I just searched pkgbuild

 reply
19

Using the AUR largely expects users to understand the basics of shell/BASH scripts, which is what a PKGBUILD is. The most obvious source to check is what URL(s) the PKGBUILD is pulling in for a package’s source(s). Are these URLs sourced from official or otherwise trusted sources for the application or component (such as from the app author’s download site or their git forge)? Does the PKGBUILD make any claims of what is being downloaded and does the target URL’s contents match that? If either of these checks fail, it’s best to avoid that package.

Additionally, does the PKGBUILD attempt to do things like obfuscate data such as URLs or tokens for downloading? Does it attempt to recklessly delete or modify files/directories (rm -rf, other recursive functions)? Does the PKGBUILD make use of any arbitrary execution statements such as exec or spawning subshells? If any of these check true, the package should seriously be revised before attempting to install it. System-level software installs on Linux systems should never be complicated enough to need fancy execution techniques nor reckless file management.

 reply
26

Thank you I wasn’t expecting such a deep answer the wiki was kinda confusing cuz its dry

 reply
5

If you are concerned with security, you can install postmaster or any other firewall force block all the internet connection and deny all the connections and then manually start allowing apps and process access to internet.

It’s an annoying process. It takes a lot of time to set up, but once it gets going, you will be mostly secure from this type of attack.

So, sort of security over convenience.

 reply
12

I would add using as much as possible flatpak, and only using aur in special circumsrances, also using selinux if possible.

 reply
6

Honestly I take no issue with the malware attack. I find it more offensive that many publications write it like it’s the end of Arch. Like bro, AUR is NOT what I’d recommend to beginners to get their packages from. Some of the obscure packages include browser extension. Like, why would you install an extension from the AUR instead of the browser extension marketplace? This is why easy and braindead AUR helpers need to die. It encourages bad practice

 reply
39
edited

CachyOS, which is one of the fastest growing distros and gets haphazardly recommended to tons of gaming refugees, ships with paru by default. Millions of forums, search results and LLM outputs encourage those same users to install stuff from AUR.

Any arch distro that has a sizeable non technical user base should know better than to ship or encourage using AUR. Shit like this is how we kill the “Year of the Linux desktop”.

 reply
12

This is exactly how we make the year of linux happen. For an alternative OS to enter mainstream it needs to be at the level os windows, so should have lots of malware around.

 reply
6
edited

The problem is the delivery mechanism. Malware is quite rare in linux because we trust the maintainers. Unlike in windows where you’re normalized to download executable off of the internet

Edit: What I meant is that notice almost always all of the attack on linux is supply chain based and not direct malware download. Be it via typosquat, package manager repository hijacking, or even long game like xz

 reply
4
edited

The question here is why the f’ didn’t they shut down AUR packages takeover procedure? It makes no sense facing an attack of such a large scale.

 reply
37

It’s the USER repositories. If you go, right now, to aur.archlinux.org, the very first section on the page after the header says

DISCLAIMER: AUR packages are user produced content. Any use of the provided files is at your own risk.

That’s always been there and every official messaging I’ve ever seen about the AUR has conformed. Read the changelogs because everything in the AUR is just a shell script some stranger wrote.

 reply
4

Why should they? AUR is still working as intended. It’s basically a public wiki of shell scripts, it was never intended to be secure in the first place. It has always been the user’s responsibility to review everything or avoid using it.

 reply
2

I am thankful I have been away from my arch machine this past week and so never got the chance to install infected updates from the AUR, because I for sure have gotten complacent with checking entire PACKAGEBUILDs. The checker scripts the community has put together found a single potential infected package on my machine - alvr-git - but I had last installed/updated that one on may 21 (so in theory it’s clean).

When the script is three pages long on a 4k screen, and I have ten other packages to review, I have found it’s really hard to stay committed to checking it all with my own eyes. The threat of needing to nuke my entire machine and rotates all my creds will certainly help with that, sadly.

 reply
7

people can install malware from untrusted source

how is this news even worthy?

 reply
12
edited

“AUR is such a great feature but why the fuck would anyone use it?” seem to be the general reaction for Arch community. (I use Debian BTW).

 reply
3

More like warnings are plastered all over to not use easy helper and to always check, verify, and trust package carefully. But ohh, that sign can’t stop me because I can’t read apparently

 reply
10
Insert image