Snap Trap: The Hidden Dangers Within Ubuntu's Package Suggestion System
Snap Trap: The Hidden Dangers Within Ubuntu's Package Suggestion System
Aqua Nautilus researchers have identified a security issue that arises from the interaction between Ubuntu’s command-not-found package and the snap package repository. While command-not-found serves as a convenient tool for suggesting installations for uninstalled commands, it can be inadvertently m...
Aqua Nautilus researchers have identified a security issue that arises from the interaction between Ubuntu’s command-not-found package and the snap package repository. While command-not-found serves as a convenient tool for suggesting installations for uninstalled commands, it can be inadvertently manipulated by attackers through the snap repository, leading to deceptive recommendations of malicious packages.
You're viewing a single thread.
Does canonical not verify snaps when they're submitted to them like flathub does now?
Nope. It's automated and doesnt detect malicious name-squatting (what caused the last security drama within snap)
Doesn't help that unlike flatpak, snaps are pretty much exclusively used on Ubuntu so many Devs won't bother porting their apps to it so snaps are rife with dodgy repacked apps and people squatting official names of popular flatpak apps
That's messed up. I'm going to stay away from them for sure.
FWIW Flatpak also does it automated, but as others said they manually verify new entries, and since it's such a widely adopted standard there's less opportunity to name-squat a popular app that isn't already available.
I don't know what flatpak does to stop, say, someone releasing a legit/dummy app to pass manual verification before replacing it with a malicious app and a new name, so can't comment on how effective their security is beyond the initial release