If you've downloaded from the Palemoon archive server you'll want to know about this: https://forum.palemoon.org/viewtopic.php?f=17&t=22526

I don't use it personally, just a heads up for anyone that does.

Thanks for the heads-up. I don't use it, I browse with FF and Chrome.

Thanks, drgibbon! It sounds like only Windows executables were infected, so Linux-only users should be in the clear.

1 members found this post helpful.

I don't think the point is that Linux is not affected, but...

https://www.bleepingcomputer.com/new...lware-dropper/

How does something like this go undetected for 2 years? Makes me wonder what else has not already been discovered.

2 members found this post helpful.

When I looked into the project way back it seemed a bit flakey to me. Anyway the compromised server was running Windows, of all things!

Stuff gets discovered well after the fact all the time. Not saying it's the norm, but it happens far too frequently. Too many outfits (I'm not saying this applies to Palemoon because I don't use it and I don't know) see security as overhead, not as best practice.

2 members found this post helpful.

This is not some one liner backdoor that someone hide in their source code, but long since compromised binaries on their archive server which simple md5sums should of revealed...

The skeptic in me makes me want to consider that this wasn't mere incompetence, but the malware was intentionally placed and the breach is a cover story.

2 members found this post helpful.

Remember when kernel.org got breached, that too must have been an inside job by Linus himself!
Too much wailing over some archived windows binaries, AFAIK the git repo's not affected.

4 members found this post helpful.

I am assuming you mean this?

https://www.eweek.com/security/suspe...ization-breach

There is a huge difference in a breach that is discovered in a few months and one that is discovered two years later.

2 members found this post helpful.

It only effected users who intentionally used older versions; and grabbed them from the archive server instead of the main distribution channels.

Also Its likely the breech wasn't that long

https://forum.palemoon.org/viewtopic...170903#p170903

3 members found this post helpful.

And we've (the FOSS community) had security problems that went UNdetected for longer, like the major (Heartbleed) one in openssl
Open source does not always mean all problems in the code are detected sooner.

This one, by the way, affected not just Linux, but a majority of ALL ssl using applications as most of them did use the affected code, either directly or indirect by encorporating it in their own code.

5 members found this post helpful.

At the risk of repeating myself heartbleed was a missing bounds check, this was a 3 mb payload.

To put this in perspective this would be equivalent to someone replacing binaries in a well used Slackware mirror for no one to actually verify the packages for another 2-3 years... I personally would be surprised if something like that ever happened.

5 members found this post helpful.

Does anyone know what has happened since then? I searched for more information on this issue but could not find anything. Has the guy been tried yet? Has he been released?

Not quite the equivalent of the example of a Slackware mirror, because Windows users generally don't compare checksums and are so used to ignoring unsigned binaries that a big yellow warning doesn't phase them. It usually just means that someone couldn't be arsed to jump through Microsoft's hoops. Most of the time it's legit. (Even shit like HP uninstallers did that)

Guilty... a few years back the ClassicShell repository got trojaned (more prankish than malicious). I was so used to installing that program on systems, and so used to yellow warnings about unsigned binaries that I thought nothing of it (huh... the installer doesn't work), until I rebooted to a modified MBR with bootstrap halted and some prankish text. Fortunately that was all they did and I just had to use bootrec to fix it. I ended up blowing it away for other reasons anyway, but that got me back in to continue troubleshooting problems. I was actually quite butthurt over that, because it was the FIRST time I ever infected any computer system (other than on purpose in house for testing cleanup software) and that was a customer system too.

2 members found this post helpful.

When you can replace the binaries, it is easy enough to replace all md5sum or sha*sum files too, and probably the private keys were available too on that server to generate corrected gpg signatures. Remember, it WAS the master archive server AND a Windows hosted one, so doesn't have the protection a Linux one would have had.

And no, it has never happened on the master Slackware mirror server (as far as we know....).