From efa8c788f24a61414bfa8981257f62c8f5b8d7b4 Mon Sep 17 00:00:00 2001 From: Ezio Date: Fri, 25 May 2018 09:21:54 +0800 Subject: [PATCH] Delete 20180517 What You Need to Know About Cryptocurrency Malware Found on Ubuntus Snap Store.md --- ...ncy Malware Found on Ubuntus Snap Store.md | 118 ------------------ 1 file changed, 118 deletions(-) delete mode 100644 sources/tech/20180517 What You Need to Know About Cryptocurrency Malware Found on Ubuntus Snap Store.md diff --git a/sources/tech/20180517 What You Need to Know About Cryptocurrency Malware Found on Ubuntus Snap Store.md b/sources/tech/20180517 What You Need to Know About Cryptocurrency Malware Found on Ubuntus Snap Store.md deleted file mode 100644 index 7d7479c31c..0000000000 --- a/sources/tech/20180517 What You Need to Know About Cryptocurrency Malware Found on Ubuntus Snap Store.md +++ /dev/null @@ -1,118 +0,0 @@ -What You Need to Know About Cryptocurrency ‘Malware’ Found on Ubuntu’s Snap Store -============================================================ - -Recently, it was discovered that a couple of apps in the Ubuntu Snaps store contained cryptocurrency mining software. Canonical swiftly removed the offending apps, but several questions are left unanswered. - -### Discovery of Crypto Miner on Snap Store - -![Crypto Miner Malware on Ubuntu Snap Store](https://4bds6hergc-flywheel.netdna-ssl.com/wp-content/uploads/2018/05/ubuntu-snap-malware-800x450.jpeg) - -On May 11, a user named [tarwirdur][8] opened a new issue on the [snapcraft.io repository][9]. In the issue, he noted that a snap entitled 2048buntu created by Nicolas Tomb contained a cryptocurrency miner. He asked how he could “complain about the application” for security reasons. tarwirdur later posted to say that all the others snaps created by Nicolas Tomb also contained cryptocurrency miners. - -It appears that the snaps used systemd to automatically launch the code at boot and run it in the background with the user none the wiser. - -{For those unfamiliar with the terminology, a cryptocurrency miner is a piece of software that uses a computer’s main processor or graphics processor to “mine” digital currency. “Mining” usually involves solving a mathematical equation. In this case, if you were running the 2048buntu game, the game used additional processing power for cryptocurrency mining.} - -The Snapcraft team responded by quickly removing all apps created by the offender. They also started an investigation. - -### The Man Behind the Mask Speaks - -On May 13, a Disqus user named Nicolas Tomb [posted a comment][10] on OMGUbuntu’s coverage of the news. In this comment, he stated that he added the cryptocurrency miner to monetize the snaps. He apologized for his actions and promised to send any funds that had been mined to the Ubuntu foundation. - -We can’t say for sure if this comment was posted by the same Nicolas Tomb since the Disqus account was just recently created and only has one comment associated with it. For now, we’ll assume that it is. - -### Canonical Makes a Statement - -On May 15, Canonical issued a statement on the situation. Entitled [“Trust and security in the Snap Store”][11], the post starts out by restating the situation. They add that the snaps have been [reissued with the cryptocurrency mining code removed][12]. - -Canonical then attempts to examine the motives of Nicolas Tomb. They note that he told them he did it in an attempt to monetize the apps (as stated above) and stopped doing it when confronted. They also note that “mining cryptocurrency is not illegal or unethical by itself”. They are however unhappy about the fact that he did not disclose the cryptocurrency miner in the snap description. - -From there Canonical moves to the subject of reviewing software. According to the post, the Snap Store uses a quality control system similar to iOS, Android, and Windows: “automated checkpoints that packages must go through before they are accepted, and manual reviews by a human when specific issues are flagged”. - -However, Canonical says “it’s impossible for a large scale repository to only accept software after every individual file has been reviewed in detail”. Therefore, they need to trust the source, not the content. After all, that is what the current Ubuntu repo system is based on. - -Canonical follows this up by talking about the future of snaps. They acknowledge that the current system is not perfect. They are continually working to improve it. They have “very interesting security features in the works that will improve the safety of the system and also the experience of people handling software deployments in servers and desktops”. - -One of the features they are working on is the ability to see if a publisher is verified. Other improvements include: “upstreaming of all the AppArmor kernel patches” and other under-the-hood fixes. - -### Thoughts on the ‘Snap store malware’ - -Based on all that I’ve read, I’ve got a few thoughts and questions of my own. - -### How Long Was This Running? - -First of all, how long have these mining snaps been available on the Snap Store? Since they have all been removed, we don’t have that data. I was able to grab an image of the 2048buntu page from the Google cache, but it doesn’t show much of anything. Depending on how long it ran, how many systems it got installed on, and what cryptocurrency was being mined, we could either be talks about a little bit of money or a pile. A further question is: would Canonical have been able to catch this in the future? - -### Was it Really a Malware? - -A lot of news sites are reporting this as a malware infection. I think I might have even seen this incident referred to as Linux’s first malware. I’m not sure that term is accurate. Dictionary.com defines [malware][13] as: “software intended to damage a computer, mobile device, computer system, or computer network, or to take partial control over its operation”. - -The snaps in question did not damage or take control of the computers involved. it also did not infect other computers. It couldn’t have because all snaps are sandboxed. At the most, they leached processor power, that’s about it. So, I wouldn’t call it malware. - -### Nothing Like a Loophole - -The one defense that Nicolas Tomb uses is that the Snap Store didn’t have any rules against cryptocurrency mining when he uploaded the snaps. {I can bet you that they are rectifying that problem right now.} They didn’t have that rule for the simple reason that no one had done it before. If Tomb was trying to do things correctly, he should have asked if this kind of behavior was allowed. The fact that he didn’t seems to point to the fact that he knew they would probably say no. At the very least, they would have told him to put it in the description. - -### -![](https://4bds6hergc-flywheel.netdna-ssl.com/wp-content/uploads/2018/05/2048buntu.png) - -### Something Looks Hinkey - -As I said before, I got a screenshot of the 2048buntu page from Google cache. Just looking at it raises several red flags. First, there is almost no real description. This is all it says “Game like 2048\. This game is clone popular game – 2048 with ubuntu colors.” Wow. {That’ll bring in the suckers.} When I read something as empty as that, I get nervous. - -Another thing to notice is the size of it. Version 1.0 of the 2048buntu snap weighs almost 140 MB. Why would a game this simple need that much space? There are browser versions written in Javascript that probably use less than a quarter of that. There other snaps of 2048 games on the Snap Store and none of them has half the file size. - -Then, you have the license. This is a clone of a popular game using Ubuntu colors. How can it be considered proprietary? I’m sure that legit devs in the audience would have uploaded it with a FOSS (Free and Open Source Software) license just because of the content. - -These factors alone should have made this snap, in particular, stand out and call for a review. - -### Who is Nicolas Tomb? - -After first reading about this, I decided to see what I could find out about the guy who started this mess. When I searched for Nicolas Tomb, I found nothing, zip, nada, zilch. All I found were a bunch of news articles about the cryptocurrency mining snaps and information about taking a trip to the tomb of St. Nicolas. There is no sign of Nicolas Tomb on Twitter or Github either. This seems like a name created just to upload these snaps. - -This also leads to a point in the Canonical blog post about verifying publishers. The last time I looked, quite a few snaps were not published by the maintainers of the applications. This makes me nervous. I would be more willing to trust a snap of say Firefox if it was published by Mozilla, instead of Leonard Borsch. If it’s too much work for the application maintainer to also take care of the snap, there should be a way for the maintainer to put their stamp of approval on the snap for their program. Something like Firefox snap published by Fredrick Ham, approved by Mozilla Foundation. Just something to give the user more confidence in what they are downloading. - -### Snap Store Definitely has Room to Improve - -It seems to me that one of the first features that the Snap Store team should have implemented was a way to report suspicious snaps. tarwirdur had to find the site’s Github page. The average user would not have thought of that. If the Snap Store can’t review every line of code, enabling the users to reports problems is the next best thing. Even rating system would not be a bad addition. I’m sure there would have been a couple people who would have given 2048buntu a low rating for using too many system resources. - -### Conclusion - -From all the I have seen, I think that someone created a number of simple apps, embedded a cryptocurrency miner in each, and uploaded them to the Snap Store with the goal of raking in piles of money. Once they got caught, they claimed it was only to monetize the snaps. If that was true, they would have mentioned it in the snap description. Hidden crypto miners are nothing [new][14]. They are generally a method of computing power theft. - -I wish that Canonical already have features in place to combat this problem and I hope they appear quickly. - -What do you think of the Snap Store ‘malware episode’? What would you do to improve it? Let us know in the comments below. - -If you found this article interesting, please take a minute to share it on social media. - -#### 关于作者 - -My name is John Paul Wohlscheid. I'm an aspiring mystery writer who loves to play with technology, especially Linux. You can catch up with me at [my personal website][15] - --------------------------------------------------------------------------------- - -via: https://itsfoss.com/snapstore-cryptocurrency-saga/ - -作者：[John Paul][a] -译者：[译者ID](https://github.com/译者ID) -校对：[校对者ID](https://github.com/校对者ID) - -本文由 [LCTT](https://github.com/LCTT/TranslateProject) 原创编译，[Linux中国](https://linux.cn/) 荣誉推出 - -[a]:https://itsfoss.com/author/john/ -[1]:https://itsfoss.com/author/john/ -[2]:https://itsfoss.com/snapstore-cryptocurrency-saga/#comments -[3]:https://itsfoss.com/category/news/ -[4]:https://itsfoss.com/category/opinion/ -[5]:https://itsfoss.com/tag/canonical/ -[6]:https://itsfoss.com/tag/cryptocurrency/ -[7]:https://itsfoss.com/tag/snaps/ -[8]:https://github.com/tarwirdur -[9]:https://github.com/canonical-websites/snapcraft.io/issues/651 -[10]:https://disqus.com/home/discussion/omgubuntu/malware_found_on_the_ubuntu_snap_store/#comment-3899153046 -[11]:https://blog.ubuntu.com/2018/05/15/trust-and-security-in-the-snap-store -[12]:https://forum.snapcraft.io/t/action-against-snap-store-malware/5417/8 -[13]:http://www.dictionary.com/browse/malware?s=t -[14]:https://krebsonsecurity.com/2018/03/who-and-what-is-coinhive/ -[15]:http://johnpaulwohlscheid.work/