Ubuntu – Remote Access Trojan in Ubuntu

Every package's install script has root access to your system, so the mere act of adding a PPA or installing a package from one is an implicit statement of trust on your part of the PPA owner.

So, what happens if your trust is misplaced and a PPA owner wants to be naughty?

In order to upload to a PPA, a package must be signed by a GPG key unique to the launchpad user (indeed, the same key they signed the code of conduct with). So in the case of a known malicious PPA we would simply ban the account and shut down the PPA (affected systems would still be compromised, but there's no good way fix them at that point anyway).

To some extent Launchpad's social features can be used as a bit of a preventative measure of bad users -- someone who has a history of contributing to Ubuntu and some established Launchpad karma, for instance, is less likely to be setting up a trap PPA.

Or what if someone gains control of a PPA that isn't theirs?

Well, this is a bit tougher of a threat scenario, but also less likely since it requires an attacker getting both the launchpad users's private key file (generally only on their computer) as well as the unlock code for it (generally a strong password not used for anything else). If this happens, though, it's usually fairly simple for someone to figure out their account has been compromised (Launchpad will for instance email them about the packages they're not uploading), and the cleanup procedure would be the same.

So, in sum, PPAs are a possible vector for malicious software, but there are probably much easier methods for attackers to come after you.

Open source is not inherently safer. It might be a little bit, due to the following reasons:

• Potentially more people look at the code, so bugs allowing for security vulnerabilities are more easily spotted. (Also, it's not true that open source means attackers can just slip in hacks, as some people might be led to think - code is still checked before included in any project. Unless of course the project itself is malicious.)
• An openly governed project creates an ethos of contributing back, e.g. when a security flaw is found, this is reported (and subsequently fixed), rather than exploited).
• The creators of an open source project often have no incentive to deny that vulnerabilities exist until a fix is found -- the more people know about it, the more likely it is someone will know how to fix this.

This will only marginally make it safer, though, since bugs will still exist and people will be using their powers for Bad rather than Good.

When it comes to Ubuntu and all other Linux distributions, though, fact is that it has been designed from the ground up from a multi-user perspective, with one user being able to make modifications to the system and the rest only being allowed to change what's relevant to them - in Windows this was rather tacked on later on (though probably works pretty well by now (Windows 7)).

Still, one could easily write a virus that removes all of a user's personal files. The biggest reason for there being no virus for Ubuntu, is simply that it has a really, really small market share. Thus, there is little to gain and little incentive for a hacker to go through the extra trouble of supporting Ubuntu when they could just target Windows and gain a lot. That, and users of Linux are often more well-versed technically, so would be less likely to install something of which they do not know what it does (though then again, the absence of viruses may lead them to trust everything they download).

(Then again, Ubuntu's update model, among others, is much better than Windows's, meaning that fixed for vulnerabilities can be distributed far quicker.)