Just curious what are the security implications if somebody uses AUR affected malware packages via Distrobox+Podman on traditional distribution (not immutable)?
By default Podman installs everything without root so not much to worry about but the Home directory is accessible to the attacker.
I don’t have a setup now but I’ve used Debian+ such setup in the past to access AUR packages in reasonably secure way.
PS: I understand it’s playing with fire. Unless you’re a security researcher it’s difficult to trace the behavior of malware, just want to hear the thoughts from the community.
How fool am I knowingly installing AUR Malware via Distrobox+Podman and exposing Home directory to the attacker?
Yes you are. Because there is a neet little thing called privacy escalation attack vectors. And guess what? Those little puppys are detected almost on a weekly basis…
If you are knowingly installing malware, I guess you have an specific goal in mind. What are trying to do do?
If you want strong isolation then distrobox is not the right tool for that. It is designed for integration with the host and not containment. It practically exposes many part of your host inside the box to achieve this integration.
For strong isolation you may be better of with a rootless podman (you have to explore what flags/options you need to achieve best isolation) or perhaps your best bet would still be using Virtual Machines.
Curious what the malware can do the system and to understand the intention behind the attacker.
Is there blog/article about the behavior analysis of recent AUR malwares?
Do you have any experience in Cybersecurity, post mortem anylsis, honeypotting or airgapping? Are you profund in process explorers, network analysis tools and have a dedicated network setup for this available? Without a yes to all of this questions you certainly get infected with something you can’t detect and can’t control…
No to all but there are people investigating it…Curious what kind of malwares are these, “ransomware” type encrypting your files or other type? Somebody put efforts in such mass attacks so there must be a reason.
The current ongoing attack installs something that acts almost like a rootkit, and then steals all kind of secrets and credentials. Tartgeted are devlopers, so .ssh keys, stored password wallets, and so on.
And yeah, there are people investigating it, but they use something that is not a productive environment, but something that is meant for analysis.
Let me change your mind: We allready did. Ask SAP. Or Grafana Labs. And that was just recently.
The gathering is like a shotgun, and with the gathered information a sniper is used…
Here is one article which is a few days old by now but describes what the malware is intended to do on the infected systems:
I let you do your own research into what would be the most secure method to create a well-isolated environment to experiment with bugs, worms and other creepy stuff.
