Supply chain attack on Github, malware injected in fork ransomwares Linux machines

[email protected]

Many of the projects are backend dev tools, like the Atlas provider linked in the thread.

[email protected]

Me neither, I nuke the default freedesktop folders on an install because they clutter up my home folder. But I'd imagine we're the exception.

[email protected]

But that's not a supply chain attack. If projects or platforms are compromised and THEN their code is used by normal means of ingestion of said project, that would be a supply chain attack.

These are unofficial channels created as forks of existing projects in an attempt to fool users into using these instead.

[email protected]

Jokes on them, I don't keep shit in ~/Documents, all my goodies are on a network share mounted at ~/Netstore

[email protected]

Tru. With Windows defender i can downloat evry .exe from ze internetz. I currently installing Gta 6 early

[email protected]

Hahaha. Was about to comment nearly the same thing. My NFS share has a different mount. ~/Documents is an empty directory

[email protected]

It's an interesting thing to think about, wouldn't widespread desktop Linux malware be quite bad because of the lack of any AV/Malware detection typically used?

[email protected]

I'd rather have ass-cancer.

[email protected]

OK, fair enough.

[email protected]

I was going to say that too, ha!

[email protected]

Sounds legit, thank you.

? Offline

Another reason that star count is a terrible metric for quality / authenticity. Fake stars are a huge problem that not a lot of people take seriously.

[email protected]

Uhhhhh, there's plenty of that being used. From the ground up. Security scanning out the wazzzz. Those are pattern-based scanners though, and this probably wouldn't be detected because it's a blob of binary junk with a script inside. GitHub should honestly put something on their storage backends to warn users, but that's a whole ball of wax people probably don't want to get into.

[email protected]

It depends on the environment. I've been in a couple of places which use Linux for various professional purposes. At one site, all systems with a network connection were required to have A/V, on-access scanning and regular system scans. So, even the Linux systems had a full A/V agent and we were in the process of rolling out EDR to all Linux based hosts when I left. That was a site where security tended to be prioritized, though much of it was also "checkbox security". At another site, A/V didn't really exist on Linux systems and they were basically black boxes on the network, with zero security oversight. Last I heard, that was finally starting to change and Linux hosts were getting the full A/V and EDR treatment. Though, that's always a long process. I also see a similar level of complacency in "the cloud". Devs spin random shit up, give it a public IP, set the VPS to a default allow and act like it's somehow secure because, "it's in the cloud". Some of that will be Linux based. And in six months to a year, it's woefully out of date, probably running software with known vulnerabilities, fully exposed to the internet and the dev who spun it up may or may not be with the company anymore. Also, since they were "agile", the documentation for the system is filed under "lol, wut?"

Overall, I think Linux systems are a mixed bag. For a long time, they just weren't targeted with normal malware. And this led to a lot of complacency. Most sites I have been at have had a few Linux systems kicking about; but, because they were "one off" systems and from a certain sense of invulnerability they were poorly updated and often lacked a secure baseline configuration. The whole "Linux doesn't get malware" mantra was used to avoid security scrutiny. At the same time, Linux system do tend to default to a more secure configuration. You're not going to get a BlueKeep type vulnerability from a default config. Still, it's not hard for someone who doesn't know any better to end up with a vulnerable system. And things like ransomware, password stealers, RATs or other basic attacks often run just fine in a user context. It's only when the attacker needs to get root that things get harder.

In a way, I'd actually appreciate a wide scale, well publicized ransomware attack on Linux systems. First off, it would show that Linux is finally big enough for attackers to care about. Second, it would provide concrete proof as to why Linux systems should be given as much attention and centrally managed/secured in the Enterprise. I know everyone hates dealing with IT for provisioning systems, and the security software sucks balls; but, given the constant barrage of attacks, those sorts of things really are needed.

[email protected]

oh oh, I'm a below average arch user.
I suspect i copied most of my hoome from debian or something.

I'll rename it to Dickuments as a security feature.

[email protected]

You can't get a virus if your computer's already dependent on one!

[email protected]

I tried that, I ended up with this weird "Windows 11" adware installed and couldn't get rid of it. There was also a problem with odd programs and advertising showing up in my Start Menu, even after I removed them. Also, my settings would occasionally just change, without my knowledge or permission.

[email protected]

Hackers gonna wanna Netflix and chill

[email protected]

Finally, Linux is popular enough to get targeted by malware!

[email protected]

Yay, finally Linux is being attacked!

And as expected it takes whole lot more than clicking on an email attachment

Always check before you curl download something!

agnos.is Forums

Supply chain attack on Github, malware injected in fork ransomwares Linux machines