Password-stealing Linux malware served for 3 years and no one noticed (arstechnica.com)

70 points by ale42 2y ago ↗ HN

9 comments

[ 3.6 ms ] story [ 101 ms ] thread

skilled 2y ago ↗

dupe: https://news.ycombinator.com/item?id=37486946

smko 2y ago ↗

Yup, was posted earlier

ralferoo 2y ago ↗

Obviously someone noticed, or else there wouldn't be an article.

adr1an 2y ago ↗

Title says it took 3 years..

bigDinosaur 2y ago ↗

It's just a classic mathematician's answer: https://tvtropes.org/pmwiki/pmwiki.php/Main/MathematiciansAn...

neilv 2y ago ↗

Both the Ars Technica and securelist.com articles say "Debian", with no mention of "Ubuntu".

Given how much Ubuntu has ridden atop the shoulders of Debian, without much acknowledging it, it's a shame that "password-stealing Linux malware" is labeled as involving "Debian".

Would be nice to have numbers on how much each distro ended up infected.

hedora 2y ago ↗

The ars article says “debian package”, which is a file format. It doesn’t mention any distributions.

consoomer 2y ago ↗

Is anyone surprised a file called "free download manager" was malware? Anyone that lived through Kazaa isn't surprised :)

GoblinSlayer 2y ago ↗

It's a supply chain attack.