{"id":113601,"date":"2024-02-15T04:02:43","date_gmt":"2024-02-15T02:02:43","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/sczenarij-ataki-na-obrabotchik-ne-ustanovlennyh-prilozhenij-v-ubuntu"},"modified":"2024-02-15T04:02:43","modified_gmt":"2024-02-15T02:02:43","slug":"sczenarij-ataki-na-obrabotchik-ne-ustanovlennyh-prilozhenij-v-ubuntu","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/sczenarij-ataki-na-obrabotchik-ne-ustanovlennyh-prilozhenij-v-ubuntu","title":{"rendered":"Attack Scenario on the Handler for Uninstalled Applications in Ubuntu","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
Researchers from Aqua Security have noted the possibility of attacking users of the Ubuntu distribution by exploiting the implementation features of the 'command-not-found' handler, which provides suggestions when attempting to run a program not present in the system. The issue is that when evaluating commands that are not available in the system, 'command-not-found' chooses recommendations not only from packages in the official repositories but also from snap packages in the snapcraft.io catalog. <\/p>\n
When generating recommendations based on the content of the snapcraft.io catalog, the 'command-not-found' handler does not consider the status of the package and includes packages added to the catalog by unverified users. Thus, an attacker can upload a package to snapcraft.io with hidden malicious content and a name that overlaps with existing DEB packages, programs that are initially missing from the repository, or fake applications whose names reflect common typos and user errors when typing the names of popular utilities. <\/p>\n
For example, one could upload packages named 'tracert' and 'tcpdamp' expecting that users will make a mistake when typing the names of the utilities 'traceroute' and 'tcpdump', and 'command-not-found' will recommend installing these malicious packages uploaded by the attacker from snapcraft.io. The user may not notice the trick and assume that the system is recommending only verified packages. An attacker could also upload a package to snapcraft.io with a name overlapping with existing deb packages, and in this case, 'command-not-found' would issue two installation recommendations for both deb and snap, and the user might choose the snap, believing it to be more secure or tempted by a newer version.
<\/center> <\/p>\n
Applications in the snap format, which are subject to automatic review on snapcraft.io, can only run in an isolated environment (snap packages without isolation are only published after manual review). It may be sufficient for an attacker to operate in an isolated environment with network access, for example, for cryptocurrency mining, launching DDoS attacks, or sending spam. <\/p>\n
An attacker can also use methods in malicious packages to bypass isolation, such as exploiting unpatched vulnerabilities in the kernel and isolation mechanisms, leveraging snap interfaces to access external resources (for covert audio and video recording), or capturing keyboard input when using the X11 protocol (to create functioning keyloggers in a sandbox environment). \n Source: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"
![\"Attack](\"\/wp-content\/uploads\/2024\/02\/5ed4b661fcc1bf13a7edc101b829b185.png\")
<\/center> <\/p>\n