11 ms·
Free Download Manager backdoored – a possible supply chain attack on Linux
- pixl97 3y agoWho uses a download manager in the days of high speed internet access and, in general, cloud services?
- aborsy 3y agoSimilar software is used in some products. For example, synology DSM has a package called download station. Who knows if it’s based on some obscure .deb (or scripts such as youtube-dl). It could give rise to a supply chain attack.
- jpc0 3y agoOn linux... I mean if I found something called free download manager on a technologically challenged family member's PC I would just assume its malware to start with.
- NoZebra120vClip 3y agoHonestly, there were several download managers which were essentially forced by folks like Microsoft and Logitech. If I remember correctly, when I had an educational license with Microsoft Imagine, the most challenging bit was getting the mandatory download manager working. IIRC, I didn't actually have a Windows machine to put it on or something. So, I had to jump through some hoops. The software was plain inaccessible without going through the proprietary download manager. Logitech did similar hijinks for a long time. I can't remember whether it was mandatory, but it sure was difficult to avoid.
- meepmorp 3y agoI'm trying to imagine the kind of user that's both able to blindly install a random .deb downloaded from a website, while also being willing to do so. Linux geeks with no sense of danger on the internet?
- lcnPylGDnU4H9OF 3y agoOne can google "install .deb fedora" and get a litany of web pages which will contain words explaining how to do this. Fedora (and other distributions) is easy enough to install that one doesn't really need to be a "Linux geek" in order to be on Linux and such a person is not quite so likely to wonder whether or not they trust the code they're running. Couple that with the fact that it works out well Most Of The Time[0] and you've got a pretty likely scenario even if it affects a relatively small number of people. [0] I mean in general when downloading software as well as in the context of this particular story[1]. [1] > Starting in 2020, the same domain at times redirected users to the domain deb.fdmpkg[.]org, which served a malicious version of the app.
- zem 3y agonot too terribly different from `sudo (curl | bash)`
- lstamour 3y agoIf you have a web browser and Linux, you can often install a .deb just by opening it in Software Centre or other graphical utilities to install apps. The comparison might be someone on windows trusting a random .msi or installer .exe or someone on Mac installing a random .app package. It’s somewhat normal these days. Package managers are sometimes harder to understand and app stores often don’t have the app you want or the newest version. Sometimes the app directs you to the website to install an update - or updates itself from a compromised location.
- mtillman 3y agoThis shocked me too. I kind of expect this to happen more on Arch because it gets marketed heavily to new users on Reddit but Debian seems geared more towards “olds” like me who just want a complete OS without a lot of effort. I couldn’t imagine using non-standard repos in a normal operating environment.
- dataflow 3y agoI do. Just because your internet access is fast that doesn't mean remote servers don't throttle on a per connection basis.
- pohuing 3y agoOr that everyone else also has fast Internet
- jandrese 3y agoPeople who are still on dialup modems or very slow wireless ISPs with flaky connections. High Speed Internet is not universal even today, despite what web developers seem to think. Ever try to surf raw Facebook on a 128kbps wireless link? It's not fun. Cloud services are a joke for these people. Hacker News is one of the last holdouts in the low bandwidth friendly website game.
- OfSanguineFire 3y agoA decade ago, I remember buying 500MB or 1GB of mobile internet credit and burning through that in an evening just reading news and stuff. Today, with uBlock Origin and NoScript, I can buy the same amount of mobile internet and it lasts me quite a while. I therefore concluded that, while website bloat does exist, what really consumes bandwidth is advertising, and that can be avoided. Moreover, a decade ago lazy loading of images was not common, but now the respective CSS tag exists, is supported by browsers, and widely implemented by CMSs like Wordpress.
- anthk 3y agoFor news I just head to gopher://magical.fish (the news section) and gopher://gopherddit.com under Lynx and the data usage gets down fast.
- blackhaz 3y agoHappy FileZilla user here, on my FreeBSD laptop. I move tons of files from remote astronomical observatory routinely, sometimes need to define custom rules - what to download, upload, filter across folders, etc. Sometimes I need to push a file from very low data-rate link from somewhere in the middle of nowhere to the observatory, sometimes over a satellite link. Sometimes I want a throttled download of a large queue so I won't overload my connection and leave some bandwidth to other users. Also, I have a directory of different FTP servers I work with, it's easy to keep them in one place. So, there you have it.
- postmodest 3y agoR sync has a --bwlimit option. But I suppose you're probably talking about devices that only know about internet protocols before 1991....
- archi42 3y agoAnd curl has --limit-rate and supports more protocols. But so what? If they are happy using FileZilla and it helps them getting stuff done, why berate them? It's not even like they're abusing a tool in an entirely unintended way, quite the opposite. I'm saying this as a shell-user.
- vorpalhex 3y agoIt's really handy to be able to kick bigger or automated file operations to a backend service.
- sneak 3y agoDownload managers are more important on high speed links than ever. The more bandwidth you have (and use), the less adequate the little "downloads" pane in your browser is.
- bubblethink 3y agoaxel -n 10
- deleted 3y ago[deleted]
- andersa 3y agoThey can be very useful for: - bypassing antiquated per connection throttles on otherwise fast servers by downloading chunks in parallel - downloading files such as videos from sites that don't really want you to download the file I have never heard of the program in the article, but this one still sees many active users on windows for the above reasons: https://jdownloader.org/ https://jdownloader.org/ There's even a little community still making and maintaining plugins for extracting files from uncooperative websites. Really does feel like the kind of program you only ever want to be running in a sandbox though!
- Isthatablackgsd 3y agoJD2 is great for cutting through redirect-er to get the source of the file. There are some sites that use multiple of redirect-ers for single link.
- dang 3y agoUrl changed from https://arstechnica.com/security/2023/09/password-stealing-linux-malware-served-for-3-years-and-no-one-noticed/ https://arstechnica.com/security/2023/09/password-stealing-l..., which points to this. Submitters: "Please submit the original source. If a post reports on something found on another site, submit the latter." - https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html
- fortran77 3y agoBut I thought there were no viruses or malware on Linux! For example: https://www.howtogeek.com/135392/htg-explains-why-you-dont-need-an-antivirus-on-linux-and-when-you-do/ https://www.howtogeek.com/135392/htg-explains-why-you-dont-n...
- yjftsjthsd-h 3y agoLook, if the malware spreads by users manually installing it, 1. it's not really an OS problem, 2. an AV wasn't going to save them.
- Gigachad 3y agoThat's how almost all malware was installed though. Linux really isn't any more resistant to malware than anything else.
- yjftsjthsd-h 3y agoReally depends on ecosystem and time; I remember when connecting an unpatched XP box to the internet got it infected with zero user interaction.
- SoftTalker 3y agoWithin minutes, sometimes. You couldn't even go online to get the updates if you didn't have a firewall.
- npteljes 3y agoYou would be wrong! https://en.wikipedia.org/wiki/Linux_malware https://en.wikipedia.org/wiki/Linux_malware
- bitwize 3y agoA typical Linux install is actually less secure than Windows nowadays, which in turn is less secure than macOS.
- codedokode 3y agoThis is one more reason to run every program in a sandbox rather than with full privileges.
- acatton 3y agoI disagree. This is more another reason to not run programs which are not from the official repository.
- throwaway71271 3y agowhy do you think this can not happen in the official repository?
- acatton 3y agoBecause the official repository has a strict vetting process. You cannot just show up and put your shaddy software in the official repository. Debian packagers have a mutual trust process which you need to gain. Only trusted Debian packagers can approve packages to be included. Also some Debian maintainers will just randomly check packages from time to time. (e.g. https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=792580 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=792580 )
- wfurney 3y agoNice classic email spam at the end of that thread! > "All we require from you is your willingness and ability to receive the funds in question"
- amenghra 3y agoYou can report the spam by clicking on the link at the very bottom (or just going to https://bugs-master.debian.org/cgi-bin/bugspam.cgi?bug=792580 https://bugs-master.debian.org/cgi-bin/bugspam.cgi?bug=79258... and confirming).
- 3y ago
- NotYourLawyer 3y agoIf you intentionally install something called Free Download Manager, you should not be surprised when it turns out to be malware.
- mulmen 3y agoYeah who would ever trust a free BSD?
- failuser 3y agoThat’s right, security-minded people trust OpenBSD instead.
- mulmen 3y agoAnd Open File Manager! The point here is it’s actually really hard to identify scammy software by name. It only seems that way with extensive domain knowledge. As adoption of Linux continues to grow more people will be duped.
- rollcat 3y ago...which conveniently routinely breaks binaries between stable releases ;) (Obviously joking, nothing but love for OpenBSD.)
- hobobaggins 3y agoAre you saying that maybe it should have been named Linux Download Manager to fool more people, or Debian Download Manager? Proving trust is hard.
- NotYourLawyer 3y agoI would only trust it if the name were some inscrutable string of lowercase letters, preferably referencing a programming in-joke about recursion.
- giancarlostoro 3y ago
- DiabloD3 3y agoWhy would you use a "Free Download Manager" when wget is right there? Or a web browser, such as Firefox? Or torrent clients to deal with large Linux ISO downloads? Or the various storefronts, like Steam? Or your own distro's package manager? This wasn't packaged on any distro, so this isn't even a meaningful attack: Users had to go out of their way to install it from a foreign source. This is no different than if you downloaded a random .exe and ran it on Windows with admin access. Its not a supply chain attack, its a PEBKAC attack.
- deleted 3y ago[deleted]
- ryandrake 3y agoFrom their website[1]: > FDM can boost all your downloads up to 10 times, process media files of various popular formats, drag&drop URLs right from a web browser as well as simultaneously download multiple files! No, I still don't a clue what it actually does that the OS and existing tools can't. It sounds like those scam "RAM doubler" programs from the 90s. Run this executable to boost your system's chakras. 1: https://www.freedownloadmanager.org https://www.freedownloadmanager.org
- _joel 3y agoSounds like, er, download managers from the 90's a la https://getright.com/ https://getright.com/
- jmprspret 3y agoIt might just parallelize multiple downloads or something like that?
- therein 3y agoI like axel for that. https://github.com/axel-download-accelerator/axel https://github.com/axel-download-accelerator/axel
- genter 3y ago
- acatton 3y agoThis is installed by adding a shady repository to your apt sources.list... How is this a supply chain attack? My official debian repository have never been breached so far. This is no different from downloading an .exe off a shady website and blindly running the .exe. Also: https://packages.debian.org/search?keywords=download+manager&searchon=all&suite=stable§ion=all https://packages.debian.org/search?keywords=download+manager... lists: • uget: https://sourceforge.net/projects/urlget/ https://sourceforge.net/projects/urlget/ • kget: https://apps.kde.org/en-gb/kget/ https://apps.kde.org/en-gb/kget/ • persepolis: https://persepolisdm.github.io/ https://persepolisdm.github.io/ why use "Free Download Manager" when high quality ones are already officially packaged by debian? Is this targeting new-comers from windows?
- sva_ 3y ago> This is installed by adding a shady repository to your apt sources.list... How is this possible? Aren't the packages signed like on ArchLinux so that you can use any mirrorlist?
- sudobash1 3y agoThis is more like using AUR (except the packages are prebuilt with no way to inspect source). They are entirely user submitted.
- acatton 3y agoNo. This is not AUR, this is an entire third party repository. It would be the equivalent of these https://wiki.archlinux.org/title/Unofficial_user_repositories https://wiki.archlinux.org/title/Unofficial_user_repositorie...
- cosmojg 3y agoIf you run Arch, I highly recommend checking out ALHP and chaotic-aur.
- acatton 3y ago
- professor_m221 3y agoI see free. I download!
- deleted 3y ago[deleted]
- deleted 3y ago[deleted]
- randombits0 3y agoA Linux user that would install a Free Download Manager? We need to bring back complicated Linux installation processes. Vendors have dumb down the process to the point that idiots are getting cooties from downloading bullish!t.
- hughw 3y agoA few years ago I asked a new hire to ssh to a certain machine from their new dev Linux laptop, and they said OK and began searching the web for PuTTY for Linux. Didn't work out with them.
- rahimnathwani 3y agoYears ago, I asked data scientist (with a PhD) whether his jupyter notebooks were only on his laptop or whether they were backed up on a server. He said they were on a server. I wanted to make sure whatever server that was had regular backups, so I asked for the server name. He looked at the URL bar and gave me the server's IP address: 127.0.0.1
- ndsipa_pomu 3y agoWhat a coincidence, that's where I store my backups too.
- vdfs 3y ago2 Years ago we hired an R developer to do some calculation on a CSV file input, he didn't understand the notion to save result on a CSV file, can only print it
- JuanPosadas 3y agoMy boss somehow uses vscode for SSH.
- CoolCold 3y agoPutty for Linux exists and even works to my knowledge, so had chances for success ;)
- whalesalad 3y agonever in my life have I heard of this tool and I have been using linux since the early 2000s
- untech 3y agoWhy did the authors blanked out “Ukraine” from an (apparent) statement “Glory to Ukraine” in the comments? Seemed weird to me, what’s the point?
- thenickdude 3y ago"securelist by Kaspersky", they are Russian.
- untech 3y agoWow. Given that Kaspersky leaders are very non-neutral, it makes these comments even fishier, because they look like a clumsy attempt to implicate Ukrainians in an attack. (Clumsy because, firstly, source code comments is a very strange place to write “Glory to Ukraine”, and secondly, because the whole section is written in Russian, except for the word “thanks”)
- firen777 3y agoA year or so ago I would say this is way too petty to the point of incompetence for them to do this. Knowing how the country actually functions since the invasion, I wouldn't rule this out at all.
- dskrvk 3y agoYes, if they’re unwilling to show a small detail like this due to sanctions that the Russian government supposedly would rain on them in retribution, one wonders what else they’re unwilling to disclose from their other investigations for the same reason.
- justsomehnguy 3y ago> SecureList by Kaspersky I'm more amused what it was in the malware code at all. Reminds me something..
- sinuhe69 3y agoFree Download Manager had a long history of being compromised. For a long time, their auto-update ini file (kind of configuration file) was manipulated to point to a compromised version, thus people installed a clean version but will get a malware infested version once they updated. I believe they are the target all along. I’m surprised that people installed them on Linux. Stop believing OSS is automatically clean and safe.
- Nursie 3y agoI'd request that the HN headline be changed - it doesn't match the article headline and sounds much more like an attack on linux itself, rather than a supply-chain attack on a particular piece of software - "Free Download Manager backdoored – a possible supply chain attack on Linux machines"
- jtvjan 3y agoIf you're curious what it says, I put the Russian text in a translator: > glory to Ukraine! > rel 20200126 15:15 > rel 20200126 15:46 added ubuntu 19.10 【thanks russkis】 > rel 20200127 02:46 removed upx, crashes often, unpacked version only now The bracketed text is written in Ukrainian
- NicuCalcea 3y agoInteresting that the built-in macOS OCR reads the first line as "слава нации" (glory to the nation).
- navyasingh96 3y ago[flagged]
- navyasingh96 3y ago[flagged]
- navyasingh96 3y ago[flagged]
- FDM-Team 3y ago[dead]
- deleted 3y ago[deleted]
- FDM-Team 3y agoDear Community, Here is the second update regarding the issue: We have prepared a bash script that you can use to check the presence of malware in your system. Launch Instructions: Download the linux_malware_check.sh script and give it execute permissions. You can do this by running: chmod +x linux_malware_check.sh. Execute the script by running: ./linux_malware_check.sh. Please note that this script only identifies whether the mentioned potential threats are present on your computer, it does not remove them. If malware is detected, it is highly recommended to reinstall the system. We once again sincerely apologize for any inconvenience that might have been caused.