A reported Free Download Manager supply chain attack redirected Linux users to a malicious Debian package repository that installed information-stealing malware.

The malware used in this campaign establishes a reverse shell to a C2 server and installs a Bash stealer that collects user data and account credentials.

Kaspersky discovered the potential supply chain compromise case while investigating suspicious domains, finding that the campaign has been underway for over three years.

    • TrustingZebra@lemmy.one
      ·
      10 months ago

      It's still my favorite download manager on Windows. It often downloads file significantly faster than the download manager built into browsers. Luckily I never installed it on Linux, since I have a habit of only installing from package managers.

      Do you know of a good download manager for Linux?

      • FredericChopin_@feddit.uk
        ·
        10 months ago

        How much faster are we talking?

        I’ve honestly never looked at my downloads and though huh you should be quicker, well maybe in 90’s.

        • arglebargle@lemm.ee
          ·
          10 months ago

          just grabbed a gig file - it would take about 8 minutes with a standard download in Firefox. Use a manager or axel and it will be 30 seconds. Then again speed isnt everything, its also nice to be able to have auto retry and completion.

        • TrustingZebra@lemmy.one
          ·
          10 months ago

          FDM does some clever things to boost download speeds. It splits up a download into different chuncks, and somehow downloads them concurrently. It makes a big difference for large files (for example, Linux ISOs).

          • FredericChopin_@feddit.uk
            ·
            10 months ago

            Im curious as to how it would achieve that?

            It can’t split a file before it has the file. And all downloads are split up. They’re called packets.

            Not saying it doesn’t do it, just wondering how.

            • everett@lemmy.ml
              ·
              10 months ago

              It could make multiple requests to the server, asking each request to resume starting at a certain byte.

                • drspod@lemmy.ml
                  ·
                  10 months ago

                  The key thing to know is that a client can do an HTTP HEAD request to get just the Content-Length of the file, and then perform GET requests with the Range request header to fetch a specific chunk of a file.

                  This mechanism was introduced in HTTP 1.1 (byte-serving).

      • Xirup@lemmy.dbzer0.com
        ·
        10 months ago

        JDownloader, XDM, FileCentipede (this one is the closest to IDM, although it uses closed source libraries), kGet, etc.

      • arglebargle@lemm.ee
        ·
        10 months ago

        axel. use axel -n8 to make 8 connections/segments which it will assemble when it is done

    • u/lukmly013 💾 (lemmy.sdf.org)@lemmy.sdf.org
      ·
      10 months ago

      Gotta admit, it was me. I've only used a computer for short time.
      I've got my first laptop 3 years ago, and that broke after just 2 months. And anyway, with AMD Athlon 64 it greatly struggled with a browser. So really I only started seriously using computer at the start of 2021, when I got another, usable laptop. And that's when I downloaded freedownloadmanager.deb. Thankfully, I didn't get that redirect, so it was a legitimate file.

  • drspod@lemmy.ml
    ·
    10 months ago

    The article mentions how to check for infection:

    If you have installed the Linux version of the Free Download Manager between 2020 and 2022, you should check and see if the malicious version was installed.

    To do this, look for the following files dropped by the malware, and if found, delete them:

    /etc/cron.d/collect
/var/tmp/crond
/var/tmp/bs
  • rurb@lemmy.ml
    ·
    10 months ago

    I had to essentially read the same thing four times before there was any new information in this post. Not sure if that's a Jerboa thing or what, but probably could have been avoided.

    • drspod@lemmy.ml
      ·
      10 months ago

      Yeah I agree, sorry about that. I thought that the body-text field was mandatory to fill in, so I used the introductory paragraph from the article so as not to editorialize.

    • ipkpjersi@lemmy.ml
      ·
      10 months ago

      I kind of disagree. Applications often require root permissions to install themselves, since regular users can't access certain folders like /opt, etc.

      Also, do you really think that people would actually read the source and then compile all their software themselves? Do you do the same?

      Generally though I do agree, you're probably fine installing software from your distro's repos but even that's not bulletproof and also it's not like third-party repos are uncommon either.