25
China-Linked Hackers Backdoored Linux Login Software to Hide for Nearly a Decade (thehackernews.com)
submitted 5 months ago by to c/linux@programming.dev
13 comments fedilink hide all child comments

all 13 comments

sorted by: hot top controversial new old
[–] 135 points 5 months ago (4 children)

The headline is a little misleading, this story is about the group Velvet Ant breaking into devices and replacing the login software in those devices with backdoored copies.

It is not them backdooring linux login software in the distro supply chain..

  • permalink
  • fedilink
  • source
  • hideshow 4 child comments
    •
  • [–] 16 points 5 months ago (1 child)

    I'm so tired of news articles that hype up fairly mundane stuff, acting like it's the next big bomshell.

    In addition to that, by misrepresenting what is happening, it's literally actively harmful to consume this kind of news, which is so common on the cybersecurity news cycle.

    Yet another cyberslop article.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 2 points 5 months ago

    It also makes the impression that linux are insecure and prone to malware, backdoor, and all sort of nasty stuff. Things that are relevant in the current time of people moving away from windows. The AUR news too is making it seems like AUR is a primary repo for many of arch packages

  • permalink
  • fedilink
  • source
  • parent
    • [–] 6 points 5 months ago

    LOL, here I am, too lazy to use any, but just the default CLI thing which autostarts Sway from bash, for like a decade.

  • permalink
  • fedilink
  • source
    •
    [–] 3 points 5 months ago (5 children)

    what are we meant to do?

  • permalink
  • fedilink
  • source
  • hideshow 5 child comments
    •
  • [–] 2 points 5 months ago* (last edited 5 months ago) (3 children)

    Go to something immutable.

    Apparently this is not as strong a solution as I thought. Apologies.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 3 child comments
    •
  • [–] 4 points 5 months ago

    I don't know that the current crop of immutable distros would be able to prevent something like this. rpm-ostree, at least, lets you install out-of-tree rpm packages to the base system, you just have to reboot for them to take effect.

  • permalink
  • fedilink
  • source
  • parent
    • [–] 1 point 5 months ago

    Is there install verify for package manager? Or linux infect/virus scanner?

  • permalink
  • fedilink
  • source
    •