Arch Linux Disables Adoption of “Orphaned” AUR Packages After Attacks

The DevOps team behind the Arch Linux distribution has announced that the ability to adopt “orphaned” packages — those left without a maintainer — has been disabled in the AUR (Arch User Repository) user repository. The reason given is “the current influx of malicious package adoptions and subsequent commits via the AUR.”

What's going on

Michael Taggart has published a brief analysis of the malicious code added to a long list of packages during this wave of attacks. According to his findings, the payload is a remote access trojan (RAT): it receives commands over the TOR network and attempts to exfiltrate a wide range of user data.

By its very nature, the AUR is vulnerable to scenarios like this: it is a repository populated by users themselves, and build scripts run on the machines of whoever installs the packages. All it takes is seizing a popular or abandoned package, and the malicious code lands on the systems of trusting users at the very first update.

Not the first attempt

The current measures are a continuation of a fight that has been dragging on for several months now. In June the project suspended registration of new accounts. At the time, that was a response to a campaign in which one or more attackers created fresh accounts, adopted orphaned packages, and pushed out malicious updates to them that installed malware on users' systems.

Registration reopened on July 13, with some restrictions added on the creation of new accounts. However, as is dryly noted, those measures turned out to be “minor and apparently ineffective” — the attacks resumed, and the team had to shut down the package adoption mechanism itself.

While the transfer of orphaned packages remains disabled, AUR users should treat updates with particular caution, especially packages that have recently changed maintainers.

Source: LWN.net