oss-sec mailing list archives
Mitigating malicious packages in gnu/linux
From: Georgi Guninski <gguninski () gmail com>
Date: Tue, 19 Nov 2019 13:33:48 +0200
As end user and contributor of gnu/linux, I am concerned about malicious packages (either hostile developers or hacked developers or another reason) and have two questions: * What do linux vendors to avoid malicious packages? * As end user what can I do to mitigate malicious packages? Some thoughts and rants: 1. This already happened in 2003 with the micq package in debian: unnoticed easter egg causing DOS, see [1]. 2. This already happened to Redhat in 2008? see [5], Red Hat OpenSSH Backdoor Vulnerability 3. In 2015 Microsoft issued weird update, see [6],[7]. 4. Portable malware in portable languages (Java, Javascript), taking the worst from windoze. 5. Google play. Google play has about 2.8M packages [2] for android. Debian has about 31K packages [3] XXXold_stat. To our surprise google play is only about 90 times bigger than debian per number of packages and the metrics is unclear for size of binary packages or lines of code. Google scans for malware, not sure how effective is this.Google's permissions of applications are mitigating factor. 6. The art of backdooring: sufficiently sophisticated backdoor is indistinguishable from secure code, see Obfuscation contest [4]. 7. Getting root vs reading $HOME vs euid == DAEMON. Getting root is important, but there is more interesting in user's $HOME. [1](https://lists.debian.org/debian-devel/2003/02/msg00771.html) [2](https://www.statista.com/statistics/266210/number-of-available-applications-in-the-google-play-store/) [3](https://sources.debian.org/stats/) [4](https://ioccc.org/) [5](https://www.securityfocus.com/bid/30794/info) [6](https://j.ludost.net/blog/archives/2015/10/03/cheers_windows_admins_did_the_weird_garbled_windows_7_update_contains_message_to_microsoft/index.html) [7](https://j.ludost.net/blog/archives/2015/10/02/cheers_windows_admins_weird_garbled_windows_7_update/index.html) -- CV: https://j.ludost.net/resumegg.pdf site: http://www.guninski.com blog: https://j.ludost.net/blog
Current thread:
- Mitigating malicious packages in gnu/linux Georgi Guninski (Nov 19)
- Re: Mitigating malicious packages in gnu/linux Morten Linderud (Nov 19)
- Re: Mitigating malicious packages in gnu/linux Stuart D. Gathman (Nov 19)
- Re: Mitigating malicious packages in gnu/linux Tim Kuijsten (Nov 19)
- Re: Mitigating malicious packages in gnu/linux Ludovic Courtès (Nov 19)
- Re: Mitigating malicious packages in gnu/linux Morten Linderud (Nov 19)
- Re: Mitigating malicious packages in gnu/linux Pavel Heimlich (Nov 19)
- Re: Mitigating malicious packages in gnu/linux Jakub Wilk (Nov 19)
- Re: Mitigating malicious packages in gnu/linux Solar Designer (Nov 20)
- Re: Mitigating malicious packages in gnu/linux Russ Allbery (Nov 20)
- Re: Mitigating malicious packages in gnu/linux Solar Designer (Nov 20)
- Re: Mitigating malicious packages in gnu/linux Russ Allbery (Nov 20)
(Thread continues...)
- Re: Mitigating malicious packages in gnu/linux Morten Linderud (Nov 19)