Get all your news in one place.
100’s of premium titles.
One app.
Start reading
TechRadar
TechRadar
Sead Fadilpašić

This commonly-used Ubuntu tool can be hijacked to spread malware

Ubuntu.

Hackers can abuse Ubuntu’s “command-not-found” package suggestion system to deliver malware to users, researchers are saying. The attack surface is relatively large, and there are multiple ways threat actors can abuse the feature.

This is according to a new report from cybersecurity researchers Aqua Nautilus, which notes how when a Ubuntu user wants to run a specific program that’s currently not installed on the endpoint they can bring up the "command-not-found" utility and have it suggest packages to install.

The problem here is that there is no way of knowing if the suggested package is malicious or not. The tool suggests packages from an internal database, as well a frequently updated database from the Snap Store, for snap packages. So, in theory, a threat actor could force the system to suggest malicious packages to the user. 

Plenty of room for impersonation

There are three methods to abuse the tool, the researchers further said. The first one is to simply publish malicious snaps to the Snap Store and hope the review process isn’t as detailed as it is for Advanced Package Tool (APT) packages. Snap packages can be published as “strict” or “classic”, with the first one being only for a sandbox, and the second one with unrestricted access, similar to an APT package. The second ones are reviewed manually, opening up plenty of space to successfully hide malware, it was said.

The second method is similar to the first, as due to a loophole in the naming system, the attackers can register malicious snap packages for legitimate APT packages, forcing the tool to suggest both. After that, it’s only a matter of chance for the victim to pick the wrong one. 

The third method involves the threat actors registering unclaimed snap names that users might expect to exist, usually because of potential similarities to known commands. 

"Should a developer wish for their snap to execute a command that deviates from the . format and is not simply , they must request an alias," the researchers said. "Such a request initiates a manual review process in which the requested alias is voted on to ensure it aligns with the application."

But if the devs don’t have a snap registered under the alias, an attacker can move in with their own.

Aqua Nautilus says a quarter (26%) of APT package commands could potentially be impersonated, which is a major supply chain risk for both Linux, and WIndows Subsystem for Linux users. 

Via BleepingComputer

More from TechRadar Pro

Sign up to read this article
Read news from 100’s of titles, curated specifically for you.
Already a member? Sign in here
Related Stories
Top stories on inkl right now
One subscription that gives you access to news from hundreds of sites
Already a member? Sign in here
Our Picks
Fourteen days free
Download the app
One app. One membership.
100+ trusted global sources.