Alpha - One Click Install for Ubuntu Packages

[hornett]

As a hacker I am going to say this once.

Do it right or don't bother at all.

I don't give a **** how easy it is.

You are allowing others to compromise linux systems.

Fscking end this ******** or people are going to get pwned

Sorry if I'm missing the point here but how is clicking a link to install worse than being told the name of a package to install on a forum?

[manicka]

No!, this script is JUST a front end for synaptic simiar to how gnome-application-install works.

In this case, I don't see any difference between firing up a web browser or gnome-application-install. If both do essentially the same job it seems like a reinvention of the wheel to me.

[ewl1217]

Personally, I think this would be a great idea. I don't see why everyone sees this as a security issue because it only installs software that's in the repositories. Barring any bugs, this wouldn't allow for anyone to install software outside of the repositories,so this is really just as secure as Synaptic. We just need a dialog box to make sure that users actually know what they are installing, so someone can't trick a user into installing edubuntu-desktop, kubuntu-desktop, and xubuntu-desktop, or anything crazy like that.

Also, I think this would be great for migrating Windows and Mac users. They're so used to going to a website to download the software they want. They would never think to use Synaptic simply because they're not used to that. It would also help keep new users out of the terminal, which none of them are familiar with.

[IbeeX]

Nice idea

only I am using aptitude! Will it suport it?

[scenestar]

Why this whole clink thing is a very bad idea in its current form
Since the protocol is installed as a regular user and not as root i can simply use a remote exploit for mozilla to replace the protocol handler (install_hacked_handler.sh)

so as a quick example

lets say someone runs an old unupdated firefox

I use the exploit found at http://www.milw0rm.com/id.php?id=1474

to install install a new handler

----install_hacked_handler.sh----

#!/bin/bash
LOCATION=`pwd`


gconftool-2 -t string -s /desktop/gnome/url-handlers/install/command "$LOCATION/install-hacked-protocoll_handler.py %s"
gconftool-2 -t bool -s /desktop/gnome/url-handlers/install/enabled true
gconftool-2 -t bool -s /desktop/gnome/url-handlers/install/needs_terminal false

-------

It really is that simple to hijack it without any security mechanism holding me back.

Now here is the part where I can do the juicy things.
The protocol handler asks the user for admin priviledges effectively giving me root.

for the hell of it lets place the sources.list file


All I have to do is add

import shutil
shutil.copyfile(evilsources.list, /etc/apt/sources.list)

to install-hacked-protocol_handler.py after the user has given permission for the script to execute.

I can now effectively have the user install my own (trojanised) binaries.
It will take some time before the user finds out while serious damage can be done.


other funky ideas are having the protocol handler startup vnc deamons or upload their personal files to a remote ftp.

This is probably a bit of an unclear explanation but right now I'm too hungover to go into it more indepth.

[lime4x4]

just curious if someone installs this and then decides they no longer want it how do u uninstall?

[Hg80]

seems like a great idea, would like to see more point and click as this is the only way linux will become main stream, i know for a fact my non geek ideas hate the way i install software under linux and as such will not try it

[KillerKiwi]

Why this whole clink thing is a very bad idea in its current form
Since the protocol is installed as a regular user and not as root i can simply use a remote exploit for mozilla to replace the protocol handler (install_hacked_handler.sh)

so as a quick example

lets say someone runs an old unupdated firefox

I use the exploit found at http://www.milw0rm.com/id.php?id=1474

to install install a new handler

----install_hacked_handler.sh----



-------

It really is that simple to hijack it without any security mechanism holding me back.

Now here is the part where I can do the juicy things.
The protocol handler asks the user for admin priviledges effectively giving me root.

for the hell of it lets place the sources.list file


All I have to do is add


to install-hacked-protocol_handler.py after the user has given permission for the script to execute.

I can now effectively have the user install my own (trojanised) binaries.
It will take some time before the user finds out while serious damage can be done.


other funky ideas are having the protocol handler startup vnc deamons or upload their personal files to a remote ftp.

This is probably a bit of an unclear explanation but right now I'm too hungover to go into it more indepth.

I see your point , I'm guessing that the mailto protocol etc get around this by installing as root. So guess that would be the best option...

Thanks for the helpful feed back

EIDT: Also whats stopping you from doing this with mailto, http etc as they are also just keys in gconf?

Ie some one with an evil mind could replace the mailto protocol with a call to a script...

[KillerKiwi]

just curious if someone installs this and then decides they no longer want it how do u uninstall?

Just remove the gonf keys and delete the files

gconftool-2 -u /desktop/gnome/url-handlers/install/command
gconftool-2 -u /desktop/gnome/url-handlers/install/enabled 
gconftool-2 -u /desktop/gnome/url-handlers/install/needs_terminal

[scenestar]

EIDT: Also whats stopping you from doing this with mailto, http etc as they are also just keys in gconf?

Because sending an email doesn't have the same impact for the system as installing new software.