[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-ID: <CAGUWgD8LDusq3PyWeMd-RoDhOtfiebVtKKV_39GhG+8c0QYFYg@mail.gmail.com>
Date: Tue, 19 Nov 2019 13:33:48 +0200
From: Georgi Guninski <gguninski@...il.com>
To: oss-security@...ts.openwall.com
Subject: Mitigating malicious packages in gnu/linux
As end user and contributor of gnu/linux, I am concerned about malicious
packages (either hostile developers or hacked developers or another reason)
and have two questions:
* What do linux vendors to avoid malicious packages?
* As end user what can I do to mitigate malicious packages?
Some thoughts and rants:
1. This already happened in 2003 with the micq package in debian: unnoticed
easter egg causing DOS, see [1].
2. This already happened to Redhat in 2008? see [5], Red Hat OpenSSH Backdoor
Vulnerability
3. In 2015 Microsoft issued weird update, see [6],[7].
4. Portable malware in portable languages (Java, Javascript), taking the
worst from windoze.
5. Google play. Google play has about 2.8M packages [2] for android. Debian
has about 31K packages [3] XXXold_stat. To our surprise google play is only
about 90 times bigger than debian per number of packages and the metrics
is unclear for size of binary packages or lines of code. Google scans for
malware, not sure how effective is this.Google's permissions of applications
are mitigating factor.
6. The art of backdooring: sufficiently sophisticated backdoor is
indistinguishable from secure code, see Obfuscation contest [4].
7. Getting root vs reading $HOME vs euid == DAEMON. Getting root is important,
but there is more interesting in user's $HOME.
[1](https://lists.debian.org/debian-devel/2003/02/msg00771.html)
[2](https://www.statista.com/statistics/266210/number-of-available-applications-in-the-google-play-store/)
[3](https://sources.debian.org/stats/)
[4](https://ioccc.org/)
[5](https://www.securityfocus.com/bid/30794/info)
[6](https://j.ludost.net/blog/archives/2015/10/03/cheers_windows_admins_did_the_weird_garbled_windows_7_update_contains_message_to_microsoft/index.html)
[7](https://j.ludost.net/blog/archives/2015/10/02/cheers_windows_admins_weird_garbled_windows_7_update/index.html)
--
CV: https://j.ludost.net/resumegg.pdf
site: http://www.guninski.com
blog: https://j.ludost.net/blog
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
