mirror of
https://github.com/LCTT/TranslateProject.git
synced 2025-02-03 23:40:14 +08:00
translated
This commit is contained in:
geekpi
parent
c22951110e
commit
5ac68ea168
@ -1,45 +0,0 @@
|
||||
translating---geekpi
|
||||
|
||||
Malware Found On The Arch User Repository (AUR)
|
||||
======
|
||||
|
||||
On July 7, an AUR package was modified with some malicious code, reminding [Arch Linux][1] users (and Linux users in general) that all user-generated packages should be checked (when possible) before installation.
|
||||
|
||||
[AUR][3] , or the Arch (Linux) User Repository contains package descriptions, also known as PKGBUILDs, which make compiling packages from source easier. While these packages are very useful, they should never be treated as safe, and users should always check their contents before using them, when possible. After all, the AUR webpage states in bold that "AUR packages are user produced content. Any use of the provided files is at your own risk."
|
||||
|
||||
The [discovery][4] of an AUR package containing malicious code proves this. [acroread][5] was modified on July 7 (it appears it was previously "orphaned", meaning it had no maintainer) by an user named "xeactor" to include a `curl` command that downloaded a script from a pastebin. The script then downloaded another script and installed a systemd unit to run that script periodically.
|
||||
|
||||
**It appears [two other][2] AUR packages were modified in the same way. All the offending packages were removed and the user account (which was registered in the same day those packages were updated) that was used to upload them was suspended.**
|
||||
|
||||
The malicious code didn't do anything truly harmful - it only tried to upload some system information, like the machine ID, the output of `uname -a` (which includes the kernel version, architecture, etc.), CPU information, pacman information, and the output of `systemctl list-units` (which lists systemd units information) to pastebin.com. I'm saying "tried" because no system information was actually uploaded due to an error in the second script (the upload function is called "upload", but the script tried to call it using a different name, "uploader").
|
||||
|
||||
Also, the person adding these malicious scripts to AUR left the personal Pastebin API key in the script in cleartext, proving once again that they don't know exactly what they are doing.
|
||||
|
||||
The purpose for trying to upload this information to Pastebin is not clear, especially since much more sensitive data could have been uploaded, like GPG / SSH keys.
|
||||
|
||||
**Update:** Reddit user u/xanaxdroid_ [mentions][6] that the same user named "xeactor" also had some cryptocurrency mining packages posted, so he speculates that "xeactor" was probably planning on adding some hidden cryptocurrency mining software to AUR (this was also the case with some Ubuntu Snap packages [two months ago][7]). That's why "xeactor" was probably trying to obtain various system information. All the packages uploaded by this AUR user have been removed so I cannot check this.
|
||||
|
||||
**Another update:**
|
||||
|
||||
What exactly should you check in user-generated packages such as those found in AUR? This varies and I can't tell you exactly but you can start by looking for anything that tries to download something using `curl` , `wget` and other similar tools, and see what exactly they are attempting to download. Also check the server from which the package source is downloaded from and make sure it's the official source. Unfortunately this is not an exact 'science'. For Launchpad PPAs for example, things get more complicated as you must know how Debian packaging works, and the source can be altered directly as it's hosted in the PPA and uploaded by the user. It gets even more complicated with Snap packages, because you cannot check such packages before installation (as far as I know). In these latter cases, and as a generic solution, I guess you should only install user-generated packages if you trust the uploader / packager.
|
||||
|
||||
|
||||
--------------------------------------------------------------------------------
|
||||
|
||||
via: https://www.linuxuprising.com/2018/07/malware-found-on-arch-user-repository.html
|
||||
|
||||
作者：[Logix][a]
|
||||
选题：[lujun9972](https://github.com/lujun9972)
|
||||
译者：[译者ID](https://github.com/译者ID)
|
||||
校对：[校对者ID](https://github.com/校对者ID)
|
||||
|
||||
本文由 [LCTT](https://github.com/LCTT/TranslateProject) 原创编译，[Linux中国](https://linux.cn/) 荣誉推出
|
||||
|
||||
[a]:https://plus.google.com/118280394805678839070
|
||||
[1]:https://www.archlinux.org/
|
||||
[2]:https://lists.archlinux.org/pipermail/aur-general/2018-July/034153.html
|
||||
[3]:https://aur.archlinux.org/
|
||||
[4]:https://lists.archlinux.org/pipermail/aur-general/2018-July/034152.html
|
||||
[5]:https://aur.archlinux.org/cgit/aur.git/commit/?h=acroread&id=b3fec9f2f16703c2dae9e793f75ad6e0d98509bc
|
||||
[6]:https://www.reddit.com/r/archlinux/comments/8x0p5z/reminder_to_always_read_your_pkgbuilds/e21iugg/
|
||||
[7]:https://www.linuxuprising.com/2018/05/malware-found-in-ubuntu-snap-store.html
|
||||
@ -0,0 +1,44 @@
|
||||
在 Arch 用户仓库（AUR）中发现恶意软件
|
||||
======
|
||||
|
||||
7 月 7 日，AUR 软件包被修改了一些恶意代码，提醒 [Arch Linux][1] 用户（以及一般 Linux 用户）在安装之前应该检查所有用户生成的软件包（如果可能）。
|
||||
|
||||
[AUR][3] 或者称 Arch（Linux）用户仓库包含包描述，也称为 PKGBUILD，它使得从源代码编译包变得更容易。虽然这些包非常有用，但它们永远不应被视为安全，并且用户应尽可能在使用之前检查其内容。毕竟，AUR在网页中以粗体显示 “AUR 包是用户制作的内容。任何使用提供的文件的风险由你自行承担。”
|
||||
|
||||
|
||||
包含恶意代码的 AUR 包的[发现][4]证明了这一点。[acroread][5] 于 7 月 7 日（看起来它以前是“孤儿”，意思是它没有维护者）被一位名为 “xeactor” 的用户修改，它包含了一行从 pastebin 使用 `curl` 下载脚本的命令。然后，该脚本下载了另一个脚本并安装了systemd 单元以定期运行该脚本。
|
||||
|
||||
**看来[另外两个][2] AUR 包以同样的方式被修改。所有违规软件包都已删除，并暂停了用于上传它们的用户帐户（在更新软件包同一天注册了那些帐户）。**
|
||||
|
||||
恶意代码没有做任何真正有害的事情 - 它只是试图上传一些系统信息，比如机器 ID、`uname -a` 的输出（包括内核版本、架构等）、CPU 信息、pacman 信息，以及 `systemctl list-units`（列出 systemd 单位信息）的输出到 pastebin.com。我说“尝试”是因为第二个脚本中存在错误而没有实际上传系统信息（上传函数为 “upload”，但脚本试图使用其他名称 “uploader” 调用它）。
|
||||
|
||||
此外，将这些恶意脚本添加到 AUR 的人将脚本中的个人 Pastebin API 密钥以明文形式留下，再次证明他们不确切地知道他们在做什么。
|
||||
|
||||
尝试将此信息上传到 Pastebin 的目的尚不清楚，特别是原本可以上传更加敏感信息的情况下，如 GPG / SSH 密钥。
|
||||
|
||||
**更新：** Reddit用户 u/xanaxdroid_ [提及][6]同一个名为 “xeactor” 的用户也发布了一些加密货币挖矿软件包，因此他推测 “xeactor” 可能正计划添加一些隐藏的加密货币挖矿软件到 AUR（[两个月][7]前的一些 Ubuntu Snap 软件包也是如此）[7]。这就是 “xeactor” 可能试图获取各种系统信息的原因。此 AUR 用户上传的所有包都已删除，因此我无法检查。
|
||||
|
||||
**另一个更新：**
|
||||
|
||||
你究竟应该在那些用户生成的软件包 (如 AUR 中找到的) 检查什么？情况各有相同，我无法准确地告诉你，但你可以从寻找任何尝试使用 `curl`、`wget`和其他类似工具下载内容的东西开始，看看他们究竟想要下载什么。还要检查从中下载软件包源的服务器，并确保它是官方来源。不幸的是，这不是一个确切的“科学”。例如，对于 Launchpad PPA，事情变得更加复杂，因为你必须知道 Debian 打包，并且可以直接更改源，因为它在 PPA 中托管并由用户上传。使用 Snap 软件包会变得更加复杂，因为在安装之前你无法检查这些软件包（据我所知）。在后面这些情况下，作为通用解决方案，我猜你应该只安装你信任的用户/打包器生成的软件包。
|
||||
|
||||
|
||||
--------------------------------------------------------------------------------
|
||||
|
||||
via: https://www.linuxuprising.com/2018/07/malware-found-on-arch-user-repository.html
|
||||
|
||||
作者：[Logix][a]
|
||||
选题：[lujun9972](https://github.com/lujun9972)
|
||||
译者：[geekpi](https://github.com/geekpi)
|
||||
校对：[校对者ID](https://github.com/校对者ID)
|
||||
|
||||
本文由 [LCTT](https://github.com/LCTT/TranslateProject) 原创编译，[Linux中国](https://linux.cn/) 荣誉推出
|
||||
|
||||
[a]:https://plus.google.com/118280394805678839070
|
||||
[1]:https://www.archlinux.org/
|
||||
[2]:https://lists.archlinux.org/pipermail/aur-general/2018-July/034153.html
|
||||
[3]:https://aur.archlinux.org/
|
||||
[4]:https://lists.archlinux.org/pipermail/aur-general/2018-July/034152.html
|
||||
[5]:https://aur.archlinux.org/cgit/aur.git/commit/?h=acroread&id=b3fec9f2f16703c2dae9e793f75ad6e0d98509bc
|
||||
[6]:https://www.reddit.com/r/archlinux/comments/8x0p5z/reminder_to_always_read_your_pkgbuilds/e21iugg/
|
||||
[7]:https://www.linuxuprising.com/2018/05/malware-found-in-ubuntu-snap-store.html
|
||||
Loading…
Reference in New Issue
Block a user