Privacy News Arch Linux PDF Reader Package Poisoned

[upnorth]

Content source

https://www.theregister.co.uk/2018/07/11/someone_modified_arch_linuxs_acrobat_reader_adds_security_warning/

Arch Linux has pulled a user-provided AUR (Arch User Repository) package, because it contained malware. If you're an Arch Linux user who downloaded a PDF viewer named "acroread" in the short time it was compromised, you'll need to delete it. While the breach isn't regarded as serious, it sparked a debate about the security of untrusted software. The user repository included the acroread package, which had been abandoned by its maintainer. Someone using the handle “xeactor” adopted the package and modified it to download malicious scripts from a remote server. When that was discovered, maintainer Eli Schwartz reverted the commits, suspended xeactor's account, and discovered (and removed) two other packages with similar modifications.

A later post in the Arch Linux mailing list suggested the “attack” was a warning of another issue. As Bennett Piater wrote: “A script that creates 'compromised.txt' in the root and all home folders looks like a warning to me.”

 

[shmu26]

These Linux guys are too innocent. They need to start learning how to protect their sources. This hacker made mincemeat out of Linux "security", and not the first time, either.

Quote from link:
On 07/08/2018 05:00 PM, Eli Schwartz via aur-general wrote:
> Side note on the acroread pastes: https://ptpb.pw/~x was executed by the
> PKGBUILD, which in turn executed https://ptpb.pw/~u. But the thing it
> installed declares an upload() function then tries to execute the
> contents of $uploader to actually upload the data collection.
>
> So it basically wouldn't work as-is anyway.

for x in /root /home/*; do
if [[ -w "$x/compromised.txt" ]]; then
echo "$FULL_LOG" > "$x/compromised.txt"
fi
done

Looks to me like this is more of a warning than anything else, no?
Why would he create those files otherwise, given how much attention that
would attract?