Privacy

hideshow 18 child comments

[–] terabyterex@lemmy.world -3 points 2 months ago* (17 children)

has not been immune to this type of attack. this is a trusted delivery mechanism being hijacked.

hideshow 17 child comments

parent

[–] victorz@lemmy.world 10 points 2 months ago (15 children)

What is the symptom of a Linux machine being attacked by this? What can even happen? Doesn't the operating system need to support whatever is being installed, and also allow it to happen?

hideshow 15 child comments

parent

[–] Turret3857@infosec.pub 5 points 2 months ago (6 children)

To play devils advocate for them, if whoever is packaging fwup for the monitor either doesnt catch LG packaging malicious shit with it, or is for some reason allowing it to happen, it could happen.

but then you'd have the wrath of at least a thousand enraged linux nerds on your ass and their stock would probably get tanked for a day.

hideshow 6 child comments

parent

[–] victorz@lemmy.world 4 points 2 months ago* (last edited 2 months ago) (5 children)

But I'm saying, what path does the installation take in order to even end up on disk? How would it get permission to run sudo/doas or gain root access in order to install shit, without my user/admin input?

hideshow 5 child comments

parent

[–] Turret3857@infosec.pub 2 points 2 months ago (4 children)

Most linux distros have a program called fwupd that installs hardware related updates. That was my example of the way in because most hardware updates are proprietary.

hideshow 4 child comments

parent

[–] deadcream@sopuli.xyz 4 points 2 months ago

Fwupd is for updating on-device firmware AFAIK. This "attack" uses windows update mechanism for automatic installation of drivers to push additional software directly on users' PCs.

parent

[+] natecox@programming.dev 1 point 2 months ago* (last edited 5 days ago) (2 children)

[deleted]

hideshow 2 child comments

parent

[–] Turret3857@infosec.pub 2 points 2 months ago (1 child)

Discover has shown me a UEFI update before in the list of updates its wants to do and ive confirmed it. If people aren't paying attention to updates and just updating its very much possible they could get something like that accidentally

For example, AMD recently removed RAM encryption without telling anyone via an update.

parent

[+] natecox@programming.dev 1 point 2 months ago* (last edited 5 days ago)

[deleted]

parent

[–] Natanael@infosec.pub 2 points 2 months ago (3 children)

Technically, Ubuntu counts as they have had some ads for commercial (even closed) services. Assuming you wanted to set up your system as pure as possible.

The OS itself doesn't generally know if the upstream organization pushing updates has broken their promises or not.

hideshow 3 child comments

parent

[–] victorz@lemmy.world 2 points 2 months ago (2 children)

Ubuntu counts as they have had some ads for commercial (even closed) services.

Did those ads show up because of something a monitor chose to install?

hideshow 2 child comments

parent

[–] Natanael@infosec.pub 1 point 2 months ago (1 child)

Not that time, but some Linux distros can also pull additional software automatically for connected hardware

parent

[–] victorz@lemmy.world 1 point 2 months ago

The whole point of this comment thread is that Linux is or isn't supposedly immune to this type of attack. Has this ever happened to a Linux machine that anyone knows of, that a monitor has installed software like this? If not, I think it's safe to say we can recommend Linux over others.

https://youtu.be/aoag03mSuXQ

parent

[–] terabyterex@lemmy.world -1 points 2 months ago (3 children)

so, this driver is delivered part of microsofts store system. linux app repos are vulnerable to library take over. there have been a few stories but this ine almost made it into red hads enrerprise lts

hideshow 3 child comments

parent

[–] victorz@lemmy.world 2 points 2 months ago (2 children)

I don't get it, what does the xz lib being attacked have to do with delivering and installing software on Linux, by the command of a connected monitor? Feels like a different kind of attack surface, or? Pardon my ignorance.

hideshow 2 child comments

parent

[–] terabyterex@lemmy.world 2 points 2 months ago (1 child)

i meant that if it made it in the rhel, it would have arrived through a trusted path. this malware came theough a trusted path in windows. their update delivery system.

parent

[–] victorz@lemmy.world 2 points 2 months ago*

Okay well I'm asking how specifically Linux would be vulnerable to this thing in particular. Is it?

parent

[–] Vorpal@programming.dev 5 points 2 months ago

Actually, unlike on Windows, fwupd itself contains the code to flash firmware on various types of devices, and all the manufacturer provides is the firmware file itself.

On Windows you can (apparently) provide an arbitrary installer yourself instead. That said, theoretically a UEFI upgrade could mess with your system since that firmware ends up running on the main CPU itself.

It is also conceivable that you could have rogue firmware on some other device that can mess with the system via DMA (direct memory access). But then we are talking full on hacking, and likely unreliable across different kernel versions etc. Notably monitors don't have such access. Enabling the IOMMU should also help protect against this (since that restricts what RAM addresses each peripheral can access).

parent

[–] captain_aggravated@sh.itjust.works 13 points 2 months ago (1 child)

Why is McAfee still a company? What is the business case for such fuckrot software? Who even pays who here?

[–] FatherPeanut@pawb.social 3 points 2 months ago

Tl;Dr: I believe it takes advantage of tech-illiteracy.

My experience has been that McAfee pays for PC hardware manufacturers to include their service as an install with their drivers. This results in people seeing "Oh my new PC has McAfee antivirus," and it becomes their main antivirus by merit of always being in-your-face, then it eventually throws popups that say "Your antivirus is expiring, pay us!" To which if that's become your go-to, you'd likely pay without thinking much of it. Most people just aren't tech literate enough to take action on things. It always blows me away just how bad the common human's tech literacy is, like even 2FA services aren't understood by most people, heck most people dont even know how to uninstall a program on Windows.

parent

[–] core@leminal.space 7 points 2 months ago

Microsoft is like "why didn't we think of that?"

[–] Absolute_Slayer@lemmy.world 3 points 2 months ago

Windows and hardware bloatware combining forces? Next thing you know, your monitor will blue screen because McAfee detected your desktop wallpaper as a threat.