A KDE theme just wiped out a user's data

[Stagger_Lee]

While this doesn’t appear to have been deliberate, it’s a sobering reminder of how simple it would be to inject some malicious code in themes or widgets.

The theme was called Grey Layout, and it has already been removed from the KDE store.

I just installed this Global Theme, innocently (Global Themes → Add New…)

It DELETES all your USER mounted drives data. It executes rm -rf on your behalf, deletes all personal data immediately. No questions asked.

A reply from a top KDE dev:

This particular theme has been removed. Too dangerous to live. We’re discussing a path forward for making sure this kind of thing can’t happen.

Most people would consider adding a theme (or widget) to be a perfectly safe, simple addition to their desktop. Be careful about blindly trusting things.

https://www.reddit.com/r/kde/comments/1bixmbx/do_not_install_global_themes_some_wipe_out_all/

[keybreak]

[Tiravian]

Sounds bad, what are the ways to guard against such stuff?
From what I understand rm -rf was executed before asking for root.

[Stagger_Lee]

@Tiravian

what are the ways to guard against such stuff?

At the moment, you’d have to download the package, unpack it, and sift through the code hoping to spot anything.

They’re looking at ways to prevent this from happening in the future.

[Schlaefer]

@Stagger_Lee

Most people would consider adding a theme (or widget) to be a perfectly safe, simple addition to their desktop. Be careful about blindly trusting things.

Important reminder. Plasma-store items have access to the CLI. Use common sense™ and treat it like the AUR. Check the description, reviews, ratings, age, … Source code should be provided but isn’t reviewed, so if possible take a quick look yourself. No source code, no installation!

[Tiravian]

How frequently rm -rf is used in the system specifically?
Is it configurable somewhere to make rm with specifically -rf to ask for root?
While it is weird to see such issue in the themes, I don’t think that it cannot pop up somewhere else.

[keybreak]

KDE at it’s best…quality control and common sense
Was it obvious before that any user-upload / update system is vulnerable to this…?

Well, it was

[Stagger_Lee]

Someone grabbed an archive of the theme and found this:

It contains, among others, a set of Plasmoids, which are from Plasma 5.

The “plasmaConfSaver” plasmoid contains:

> cd plasma/plasmoids/com.pajuelo.plasmaConfSaver/contents ; grep -r "rm -Rf" *
scripts/save.sh:rm -Rf "$configFolder"
ui/FullRepresentation.qml:                            if(cmd.indexOf("save.sh") != -1 || cmd.indexOf("rm -Rf") != -1) {
ui/FullRepresentation.qml:                                    executeSource.connectSource("rm -Rf " + savePath + "/" + model.modelData)

It is possible that Plasma 6 tries to execute this script without checking.

https://www.reddit.com/r/openSUSE/comments/1biunsl/comment/kvn0139/

EDIT: Some more conjecture/elaboration on how this happened; I haven’t read through it (it’s 4 AM here and I’m going to bed now) but here’s a link"

https://www.reddit.com/r/openSUSE/comments/1biunsl/comment/kvnf4f5/

[Schlaefer]

@keybreak

KDE at it’s best…quality control and common sense
Was it obvious before that any user-upload / update system is vulnerable to this…?

Companies holding your hand with anti-virus software and app-stores? - Mu freedom!

People giving you power to run everything you want? - Mu security!

[thefrog]

@Tiravian

Is it configurable somewhere to make rm with specifically -rf to ask for root?

It doen’t need root to remove your personal files as its being run with your privileges.

@Stagger_Lee

It DELETES all your USER mounted drives data

as pointed out here

[keybreak]

People who completely and deliberately misinterpret what i’ve said - Muh

[pebcak]

@Tiravian

Is it configurable somewhere…

Not sure if this is the most effective way but you could always alias rm to rm -i for it to require user intervention before the command is actually executed.

rm --help
-i prompt before every removal

Edit: Don’t know how to configure it in this way when you use sudo. Perhaps other more advanced users may be able to provide some insight.

[manfredlotz]

Thanks for this. I have no additional KDE theme installed but when reading something like this I am asking myself if this could also have happened to me.

Fortunately, I am very reluctant to install anything which is not in the repos. If in AUR I usually check where this package comes from aso.

But, if I would like to install a theme which was uploaded by some user I would at least check how often this theme has been used already.

This also could be insufficient, of course. So what is the best way here? Just to not install any such theme (which is my way)?

[Zesko]

@Stagger_Lee

It executes rm -rf

Of course, this can delete your data and non-root backups on the mounted disk without root permission.
This would not affect your data if it in its btrfs snapshot in the same system.

[Cphusion]

Now you will see all the KDE Plasma users switching to Gnome because of this

[Zesko]

It does not matter, an installed Gnome widget with malware can delete your data without root permission.

You need a good and secure backup solution.

[Cphusion]

I know I was just making a joke I don’t keep any important data in my desktop’s home directory but on my nas and I make a backup of that.

[Zesko]

This is similar to what happened

A Reminder to Backup All Important Data

I just watched a video about how, many years ago, Steam deleted someone’s entire computer, including an external backup drive that was plugged in, due to a poorly written Bash script. The script in question contained this (including the ominous comment): # Scary! rm -rf "$STEAMROOT/"* Earlier in the script, the variable STEAMROOT was set using some cd and pwd nonsense, which under unforeseen circumstances failed and left the variable empty, causing rm -rf / to execute thus destroying all user …

[Locutus]

The original thread is from Reddit, need I say more.

[h_d33r]

Oof. One more reason I’ll jump ship to Cosmic once that comes out.