Fake Firefox spreads spyware as makers Mozilla retort

[NickStone]

Fake Firefox could be spying on you.

“If you’re being asked to pay for Firefox, it’s a scam.” Also, always make sure that you download Firefox straight from Mozilla, and not some sketchy site.

Does this mean we shouldn't be downloading from our repo's?

[eggbert]

I've seen something similar where scummy companies will take an open source product, repackage it, and put a bunch of crappy browser toolbars in the installer. I fell for this once while installing VLC using windows. I was in a hurry and not paying attention. I searched for VLC on google, clicked the first link and downloaded it, but ended up with a browser toolbar, new browser homepage, and a bunch of other crapware.

[HalationEffect]

Does this mean we shouldn't be downloading from our repo's?

I'd say it means the exact opposite - downloading Linux software from official repos is a great way to avoid getting stung by malware.

The advice about downloading direct from Mozilla is almost certainly aimed at users of Windows, not Linux.

[oshunluvr]

Fake Firefox could be spying on you.



Does this mean we shouldn't be downloading from our repo's?

Yeah - talk about sketchy!

p.s. Halation... get a sense of humour buddy! lol

[HalationEffect]

p.s. Halation... get a sense of humour buddy! lol

Heh, I couldn't decide if NickStone's comment was tongue-in-cheek or not, so I decided to give a serious reply.

I was also considering the possibility that someone new to Linux might come across this thread, get the wrong idea, and become needlessly worried that the repos aren't safe.

[oshunluvr]

Yeah - and actually, after I posted I re-read Nicks post and decided you might be right about the serious tone. Either way, I'm not retracting!

[SteveRiley]

Get a room, guys, will ya? Ick.

[NickStone]

Heh, I couldn't decide if NickStone's comment was tongue-in-cheek or not, so I decided to give a serious reply.

I was also considering the possibility that someone new to Linux might come across this thread, get the wrong idea, and become needlessly worried that the repos aren't safe.

Yes my comment was tongue in cheek. I was not asking a serious question.

[dmeyer]

On a side note, you should remember that PPAs are a way for nasty software to get on your system as is downloading packages off the internet. We are a lot safer that pretty much any other OS in this respect but we aren't immune.

[SteveRiley]

On a side note, you should remember that PPAs are a way for nasty software to get on your system

Have there been any actual reported cases of this happening? I'm just curious. I don't think I've ever read about it.

[dmeyer]

Have there been any actual reported cases of this happening? I'm just curious. I don't think I've ever read about it.

No, I've seen a PPA break a few systems before but I have never seen it used as a vector for computer germs. However; just because it hasn't happened yet, doesn't mean it won't. I like to err on the side of caution and stick to PPAs from recognized community members.

[SteveRiley]

No, I've seen a PPA break a few systems before but I have never seen it used as a vector for computer germs. However; just because it hasn't happened yet, doesn't mean it won't. I like to err on the side of caution and stick to PPAs from recognized community members.

Sage advice, indeed.

I would imagine that PPAs are not very attractive to bad guys anyway. It takes a nontrivial amount of work to configure source code for uploading into Launchpad and getting it to properly compile. Then anyone found intentionally uploading malware would be deemed in violation of the Ubuntu Code of Conduct and have their account immediately terminated and PPAs removed. It's far easier just to put $EVIL-BINARY on some sleazy download site and lure in your victims with cheezy emails.