Aqua Nautilus researchers have identified a security issue that arises from the interaction between Ubuntu’s command-not-found package and the snap package repository. While command-not-found serves as a convenient tool for suggesting installations for uninstalled commands, it can be inadvertently manipulated by attackers through the snap repository, leading to deceptive recommendations of malicious packages.

  • jbk@discuss.tchncs.de
    link
    fedilink
    arrow-up
    6
    arrow-down
    1
    ·
    9 months ago

    Since you need to pass a manual review during initial submission of the app, no, you can’t

    • ryannathans
      link
      fedilink
      arrow-up
      2
      ·
      9 months ago

      A fake malware password manager made it on to Apple’s app store, passed manual review. Manual reviews are not bulletproof

        • ryannathans
          link
          fedilink
          arrow-up
          1
          ·
          edit-2
          9 months ago

          That’s exactly what they did, imitated lastpass or something

            • ryannathans
              link
              fedilink
              arrow-up
              1
              ·
              edit-2
              9 months ago

              Example of strict manual reviews including source code not catching malware masquerading as existing reputable software, it’s the exact same scenario minus Apple being a commercial entity. Goes to show that even when commercial interests are at stake to keep these malicious apps out, they can still get in. It’s just demonstrating manual reviews aren’t a 100% bulletproof solution, the commenter was saying it’s not possible for malware to get past manual review

              • Baut [she/her] auf.@lemmy.blahaj.zone
                link
                fedilink
                arrow-up
                1
                ·
                9 months ago

                This isn’t the point of the review. Verified apps only say this is the application as offered by the original vendor.
                If the original vendor were to bundle malware, then that’s a bad vendor, but still verified official software. Not that I actually think this will happen. Most user install malware such as Discord willingly. /j