Hackers can abuse Ubuntu’s “command-not-found” package suggestion system to deliver malware to users, researchers are saying. The attack surface is relatively large, and there are multiple ways threat actors can abuse the feature.
This is according to a new report from cybersecurity researchers Aqua Nautilus, which notes how when a Ubuntu user wants to run a specific program that’s currently not installed on the endpoint they can bring up the "command-not-found" utility and have it suggest packages to install.
