The results of the experiment to seize control over packages in the AUR (Arch User Repository), used for distributing packages by third-party developers without including them in the main repositories of the Arch Linux distribution, have been published. The researchers prepared a script that checks the expiration of domain registrations appearing in the PKGBUILD and SRCINFO files. During the execution of this script, 14 expired domains were identified, which were used in 20 packages for downloading files.
Simple domain registration is insufficient to replace the package, as the downloaded content is verified against the checksum already uploaded in AUR. However, it turned out that around 35% of the packages in AUR use the 'SKIP' parameter in the PKGBUILD file to bypass checksum verification (for example, indicating sha256sums=(‘SKIP’)). Out of the 20 packages with expired domains, the SKIP parameter was used in 4.
To demonstrate the possibility of carrying out an attack, the researchers purchased a domain from one of the packages that do not check checksums and hosted an archive with code and a modified installation script on it. Instead of the actual content, a warning about executing third-party code was added to the script. Attempting to install the package led to the download of tampered files and, as the checksum was not verified, resulted in the successful installation and execution of the code added by the experimenters.
Packages with domains whose code has expired:
- firefox-vacuum
- gvim-checkpath
- wine-pixi2
- xcursor-theme-wii
- lightzone-free
- scalafmt-native
- coolq-pro-bin
- gmedit-bin
- mesen-s-bin
- polly-b-gone
- erwiz
- totd
- kygekteampmmp4
- servicewall-git
- amuletml-bin
- etherdump
- nap-bin
- iscfpc
- iscfpc-aarch64
- iscfpcx
Source: opennet.ru
