Arch Linux’s AUR faces a fresh security scare, prompting another round of lockdown measures from the project’s DevOps team.
Just when you thought it was safe to get back in the water… they’re back.
You might remember that in mid-June, Arch Linux’s tech team was struggling with a malware attack that for a week or two seemed like it would never end. We covered it here on FOSS Force, in a series of articles that finally ended on June 16, when AUR maintainers temporarily blocked new registrations which allowed them to finally get the situation under control.
AUR is a secondary repository for Arch Linux that contains largely unvetted pacman packages contributed by Arch users. Starting about June 12 — the date we published our first report — black hat crackers seeded AUR with malware-laced packages. It was sort of a whack-a-mole situation. As soon as Arch devs thought they had the situation under control and issued an all clear, new infected packages would start showing up again — wash, rinse, and repeat.
By the time things got back to normal, more than 1,500 infected packages were found and removed.
It’s Deja Vu All Over Again
Here we are, a month and a half later….
The Linux Foundation Second Half Sale has been extended until July 31, 2026. Save 40% on Bundles: Use code JULY26BUN Save 35% on Courses and Certifications: Use code JULY26CC
Thursday morning I missed it when Robin Candau, an Arch Linux package maintainer, posted to the Arch Linux mailing list. He said that AUR package adoption had been disabled, “due to the current influx of malicious package adoptions and follow-up commits made via the AUR, package adoption is currently disabled while we are handling the situation.”
What I did catch was a post this morning, when Joe Brockmeier at LWN.net reported that AUR was again under attack. He mentioned a short post by Michael Taggart, the executive director of the not-for-profit threat intelligence organization called Independent Federated Intelligence Network, which pointed to some lists of packages affected.
Brockmeier also picked up where we left off back on June 16 with the blocking of AUR registrations, which seemed to have ended the first rounds of attack.
“AUR registration was reopened on July 13 after the DevOps team added some minor, and apparently ineffective, restrictions on creating new accounts,” he wrote.
Since then, news has been scarce. I’m guessing that for this round we’re not going to see escalating attacks like we did last month, because I doubt they’ll want to return public access to the AUR until after they have the situation firmly under control. That will likely mean something like establishing a vetting process on all contributions to the AUR going forward, which some users have been suggesting for a long time anyway.
Christine Hall has been a journalist since 1971. In 2001, she began writing a weekly consumer computer column and started covering Linux and FOSS in 2002 after making the switch to GNU/Linux. Follow her on Twitter: @BrideOfLinux
Be First to Comment