• just_another_person@lemmy.world
    link
    fedilink
    arrow-up
    53
    arrow-down
    3
    ·
    17 hours ago

    This isn’t really a supply chain attack. It’s more social engineering: fake users, forks, and non-verified code. They’re taking advantage of the fact that most people don’t use verified releases or packages code from open source projects.

    GitHub is not compromised, nor sending unintended payloads.

    • ikidd@lemmy.worldOP
      link
      fedilink
      English
      arrow-up
      3
      arrow-down
      1
      ·
      17 hours ago

      Many of the projects are backend dev tools, like the Atlas provider linked in the thread.

      • just_another_person@lemmy.world
        link
        fedilink
        arrow-up
        30
        ·
        edit-2
        17 hours ago

        But that’s not a supply chain attack. If projects or platforms are compromised and THEN their code is used by normal means of ingestion of said project, that would be a supply chain attack.

        These are unofficial channels created as forks of existing projects in an attempt to fool users into using these instead.

  • crystalwalrus@programming.dev
    link
    fedilink
    arrow-up
    18
    ·
    16 hours ago

    Another reason that star count is a terrible metric for quality / authenticity. Fake stars are a huge problem that not a lot of people take seriously.

  • Phoenixz@lemmy.ca
    link
    fedilink
    arrow-up
    4
    ·
    13 hours ago

    Yay, finally Linux is being attacked!

    And as expected it takes whole lot more than clicking on an email attachment

    Always check before you curl download something!

      • oo1@lemmings.world
        link
        fedilink
        English
        arrow-up
        9
        ·
        16 hours ago

        oh oh, I’m a below average arch user. I suspect i copied most of my hoome from debian or something.

        I’ll rename it to Dickuments as a security feature.

    • ikidd@lemmy.worldOP
      link
      fedilink
      English
      arrow-up
      5
      arrow-down
      1
      ·
      17 hours ago

      Me neither, I nuke the default freedesktop folders on an install because they clutter up my home folder. But I’d imagine we’re the exception.

  • MangoPenguin@lemmy.blahaj.zone
    link
    fedilink
    English
    arrow-up
    4
    ·
    16 hours ago

    It’s an interesting thing to think about, wouldn’t widespread desktop Linux malware be quite bad because of the lack of any AV/Malware detection typically used?

    • sylver_dragon@lemmy.world
      link
      fedilink
      English
      arrow-up
      6
      ·
      16 hours ago

      It depends on the environment. I’ve been in a couple of places which use Linux for various professional purposes. At one site, all systems with a network connection were required to have A/V, on-access scanning and regular system scans. So, even the Linux systems had a full A/V agent and we were in the process of rolling out EDR to all Linux based hosts when I left. That was a site where security tended to be prioritized, though much of it was also “checkbox security”. At another site, A/V didn’t really exist on Linux systems and they were basically black boxes on the network, with zero security oversight. Last I heard, that was finally starting to change and Linux hosts were getting the full A/V and EDR treatment. Though, that’s always a long process. I also see a similar level of complacency in “the cloud”. Devs spin random shit up, give it a public IP, set the VPS to a default allow and act like it’s somehow secure because, “it’s in the cloud”. Some of that will be Linux based. And in six months to a year, it’s woefully out of date, probably running software with known vulnerabilities, fully exposed to the internet and the dev who spun it up may or may not be with the company anymore. Also, since they were “agile”, the documentation for the system is filed under “lol, wut?”

      Overall, I think Linux systems are a mixed bag. For a long time, they just weren’t targeted with normal malware. And this led to a lot of complacency. Most sites I have been at have had a few Linux systems kicking about; but, because they were “one off” systems and from a certain sense of invulnerability they were poorly updated and often lacked a secure baseline configuration. The whole “Linux doesn’t get malware” mantra was used to avoid security scrutiny. At the same time, Linux system do tend to default to a more secure configuration. You’re not going to get a BlueKeep type vulnerability from a default config. Still, it’s not hard for someone who doesn’t know any better to end up with a vulnerable system. And things like ransomware, password stealers, RATs or other basic attacks often run just fine in a user context. It’s only when the attacker needs to get root that things get harder.

      In a way, I’d actually appreciate a wide scale, well publicized ransomware attack on Linux systems. First off, it would show that Linux is finally big enough for attackers to care about. Second, it would provide concrete proof as to why Linux systems should be given as much attention and centrally managed/secured in the Enterprise. I know everyone hates dealing with IT for provisioning systems, and the security software sucks balls; but, given the constant barrage of attacks, those sorts of things really are needed.

    • just_another_person@lemmy.world
      link
      fedilink
      arrow-up
      5
      ·
      16 hours ago

      Uhhhhh, there’s plenty of that being used. From the ground up. Security scanning out the wazzzz. Those are pattern-based scanners though, and this probably wouldn’t be detected because it’s a blob of binary junk with a script inside. GitHub should honestly put something on their storage backends to warn users, but that’s a whole ball of wax people probably don’t want to get into.

    • Nino477@lemmy.world
      link
      fedilink
      arrow-up
      10
      ·
      16 hours ago

      Tru. With Windows defender 💪 i can downloat evry .exe from ze internetz. I currently installing Gta 6 early 😎

    • sylver_dragon@lemmy.world
      link
      fedilink
      English
      arrow-up
      5
      ·
      16 hours ago

      I tried that, I ended up with this weird “Windows 11” adware installed and couldn’t get rid of it. There was also a problem with odd programs and advertising showing up in my Start Menu, even after I removed them. Also, my settings would occasionally just change, without my knowledge or permission.