By Larry Cafiero
Bill Toulas of BleepingComputer.com reported on Friday that Arch is disabling its Arch User Repository – otherwise known as AUR – to stem the flow of malware and malicious takeovers of existing packages.
“The decision was announced on the distribution’s mailing list by contributor Robin Candau, who said that the situation is temporary until a solution is found,” the article said.
Quoting Candau, “Due to the current influx of malicious package adoptions and follow-up commits made via the AUR, package adoption is currently disabled while we are handling the situation. We will send a follow-up once we’re able to. In the meantime, feel free to report suspicious adoption events or commits that haven’t been dealt with yet, and stay vigilant!”
The article says that “Independent Federated Intelligence Network (IFIN) conducted a technical analysis of the malware and reported that the campaign began on July 29 with the package ‘openconnect-sso.’ ”
IFIN reports that the campaign bears many similarities to the last campaign, the article states, including the use of the Tor network for staging.
“In June, a separate campaign hit AUR via more than 400 packages, distributing a Linux rootkit and info-stealer malware to unsuspecting users,” the article says.
But in the latest attack, “the researchers identified a two-stage infection, with the first stage acting as the loader, and the second one being a Linux x86_64 payload described as stealer malware with remote administration (RAT) and SSH worm features,” the article explained.
But wait, there’s more on the Arch front . . .
Prominent Arch developer resigns
Michael Larabel at Phoronix reports on Saturday that Morton Linderud – otherwise known as “Foxboron” – announced he is resigning from the Arch Linux project after a 10-year run.
Linderud was an Arch Linux developer, security team member, AUR maintainer, and package maintainer for the distro.
“After a decade serving as an Arch Linux developer, package maintainer, and security team member, Morten Linderud has decided ‘it’s a good time to let go’ and move on from the project,” the article says. “He was responsible for debug packages on Arch Linux, initial work on their Git migration, and other contributions to the project over the years.”
While stepping back from his Arch Linux duties, Linderud “still intends to pursue his open-source work around TPMs, Secure Boot, and related security initiatives . . . In his resignation email among the Arch Linux packages now in need of a new maintainer include the likes of mkinitcpio, Bolt, nvme-cli, Go-Tools, Pacman, arch-install-scripts, archlinux-keyring, archlinux-repro, and others.”
And yet, despite all of the aforementioned . . .
Arch releases August ISO
Bobby Borisov at Linuxiac reported on Saturday that Arch Linux has released its monthly ISO for August, shipping with Linux kernel 7.1.5, glibc 2.44, Binutils 2.47, systemd 261.2, KDE Plasma 6.7.3, and updated packages.
“As usual, this is not a separate Arch Linux release or a new distribution version,” the article states. “Instead, the monthly ISO images are intended for new installations, giving users a more current starting point and reducing the number of packages to download immediately after installation.”
According to the article, the guided Archinstall installer remains at version 4.4, which was introduced shortly before the July image.
“Beyond the kernel, August’s snapshot includes several important changes to the system toolchain. GNU C Library moved from version 2.43 to 2.44, while GNU Binutils received a major update from 2.46.1 to 2.47,” the article says. “GCC remains on the 16.1.1 series, but Arch’s packages include a newer development snapshot from that branch.”
Regarding desktops, the article said repositories now include the latest KDE Plasma, Gnome, and Cinnamon, as well as the latest Cosmic 1.5 desktop.
And that’s all for today. Don’t forget: Distro of the Week appears Wednesday – and it’s always a good one on hand – and Bits and Bobs will return with news over the week on Friday.