Canonical's Snap store found to be distributing malware
Canonical, the software company behind Ubuntu, came under scrutiny this week with regards to its Snap software repository and the processes by which software authors can publish packages in their curated store. One of the reasons Linux distributions tend to provide central software repositories is to provide users with software which has been tested and verified as safe to use in some fashion. This past week Alan Pope reported a Snap package claiming to be a Bitcoin wallet called Exodus was downloaded from Canonical's Snap repository and used to steal digital coins from its user. An examination of the malicious package revealed it was a low effort piece of malware which should have been caught if Canonical had any vetting processes in place. Pope's overview of the malicious package reveals the details:
"I wanted to take a look at the application itself. So on my workstation, in a separate virtual machine, I ran 'snap download exodus' to download, but not install the application. I don't have any cryptocurrency wallets on my system, but I didn't know what the application might try to do, so for safety I didn't run it directly on my computer. A snap is just a squashfs file, typically containing an application, libraries, assets and metadata. I unpacked the snap with unsquashfs and briefly poked around at the resulting files. Notably much of the metadata in the snap.yaml file was still the developer defaults such as 'Single-line elevator pitch for your amazing snap'. Further investigation revealed this was an application developed using Flutter. The application binary was quite small, and there weren't a lot of bundled libraries beyond the essentials, potentially indicating limited features." The offending application has since been quarantined to prevent it from spreading.