northernlights comments on Arch Linux's AUR Sees More Than 400 Packages Compromised With Malware

[–] northernlights@fedia.io 7 points 4 months ago (6 children)

how did this happen? the linked thread show people identifying the infected packages and cleaning them up but no word about how it happened or how to prevent it.

permalink

fedilink

source

hideshow 6 child comments

[–] rozodru@piefed.world 29 points 4 months ago (5 children)

I think it was essentially orphaned stuff that got "picked up" by a "new maintainer" and that's how it happened.

permalink

fedilink

source

parent

hideshow 5 child comments

[–] northernlights@fedia.io 4 points 4 months ago (4 children)

oh I saw "clang" in the list of packages and got worried

permalink

fedilink

source

parent

hideshow 4 child comments

[–] Telorand@reddthat.com 1 point 4 months ago (3 children)

You're only affected if you use the AUR. As far as I understand it, the core packages themselves are fine, so this is more of a MitM attack, where somebody compromised the package download streams

permalink

fedilink

source

parent

hideshow 3 child comments

[–] cobalt32@lemmy.blahaj.zone 4 points 4 months ago (2 children)

This is not a MitM attack.

permalink

fedilink

source

parent

hideshow 2 child comments

[–] Telorand@reddthat.com 1 point 4 months ago (1 child)

How is it not? They didn't take over the core projects, they took over the midstream distribution.

permalink

fedilink

source

parent

hideshow 1 child comment

[–] northernlights@fedia.io 8 points 4 months ago*

A MitM attack defines the attack technique, not the target. It's when the target wants to connect to something but it connects through you first, and you forward while collecting/altering data. My question was about the attack used. But yeah, a mass takeover of everything orphaned would do it.

permalink

fedilink

source

parent