17

I read in the news about all the malware that is infecting Android OS. The malware is in Google's App Store and people are unknowingly downloading and installing it.

As I understand, Ubuntu's Main repository is safe for me to download from (I won't be infected with malware from doing so) because Canonical engineers review the software. But what about other repos, most notably the Universe repository? Does the Universe repo receive any sort of review to protect from malware? Is it advisable to avoid the Universe repo for fear of unknowingly downloading malware from it?

I've read PPAs are particularly dangerous because they are not reviewed. I'm assuming it is perfectly safe to use the Google Chrome PPA however.

So if I use nothing but the Main & Universe repositories and Google Chrome PPA, will I be protected from unknowingly downloading malware?

If Ubuntu does gain hundreds of millions of users like Mark Shuttleworth predicts, won't Ubuntu PPAs become the malware problem for Ubuntu like Google's App Store is today for Android?

4
  • 4
    You seem to ask several questions. This site works better with one question at a time. You might want to rewrite your question to a single question or split it into several questions.
    – N.N.
    Jul 12, 2011 at 22:01
  • Well, first of all Android=/=Ubuntu, then if you are adding a PPA you know the reason why you are doing it, therefore you know what's in it so the OS is as safe as long as you know what are you installing. Jul 13, 2011 at 0:40
  • you can trust all packages that they wont hack your computer, or harm it.
    – Alvar
    Mar 7, 2012 at 7:41
  • 2
    Related: Are Ubuntu packages security audited?
    – Kulfy
    Jan 16, 2021 at 6:06

3 Answers 3

25

All of the official Ubuntu repositories (encompassing anything that you can find on archive.ubuntu.com or its mirrors, as well as some others) are entirely curated. This means main, restricted, universe, multiverse, as well as -updates and -security. All packages in there have either come from Debian (and so have been uploaded by a Debian Developer) or have been uploaded by an Ubuntu developer; in both cases the package that is uploaded is authenticated by the gpg signature of the uploader.

You can therefore trust that every package in the official archives has been uploaded by either a Debian or Ubuntu developer. Furthermore, the packages you download can be verified by the gpg signatures on the files in the repository, so you can trust that each package you download has been built on the Ubuntu build farm from the source that was uploaded by an Ubuntu or Debian developer¹.

This makes outright malware unlikely - someone in a position of trust would need to upload it, and the upload would be easily tracable to them.

This leaves the question of more surreptitious nefariousness. Upstream developers could put backdoors into otherwise useful software and these could make it into the archive - in universe or multiverse, depending on the license. People do run security audits of the Debian archive, so if this software became popular it's likely that the backdoor would be discovered.

Packages in main have some extra checking and get more love from the Ubuntu security team.

PPAs have almost none of this. The guarantee you get from a PPA is that the packages you download were built on the Ubuntu build infrastructure, and were uploaded by someone with access to one of the GPG keys of the Launchpad account of the listed uploader. There's no guarantee that the uploader is who they say they are - anyone could make a “Google Chrome PPA”. You need to determine trust in some other way for PPAs.

¹: This chain of trust could be broken by an extensive intrusion into the Ubuntu infrastructure, but that's true of any system. The compromise of a developer's gpg key would also allow a black-hat to upload packages to the archive, but since the archive emails the uploader of each package this should be noticed quickly.

4
  • It should be noted that Google does maintain a Google Chrome repo though, and Google is a pretty trustworthy company. Jul 14, 2011 at 1:57
  • 4
    @ThomasBoxley XD
    – Solo
    Apr 8, 2019 at 21:19
  • 1
    @Solo lmao I take it back in retrospect. Apr 15, 2019 at 0:29
  • 2
    "All the packages in Ubuntu Repositories before being uploaded are checked and reviewed" -- this is not supported by everything else you write.
    – MWB
    Jan 15, 2021 at 22:19
13

All the packages in Ubuntu Repositories before being uploaded are checked and reviewed by MOTUs (Masters of the Universe). MOTUs are the brave souls who keep the Universe and Multiverse components of Ubuntu in shape. They are community members who spend their time adding, maintaining and supporting as much as possible the software found in Universe. Therefore there are no chances of these packages breaking into your computer and stealing your data. However these packages might have security bugs which are flaws found in the software. Also some security-comprising software are available in Ubuntu (for example key loggers) but these packages won't steal your data (unless somebody intentionally installed it on your computer).

Hope this helps. See the Ubuntu wiki page MOTU for more information.

5
  • "All the packages in Ubuntu Repositories before being uploaded are checked and reviewed" -- [citation needed]
    – MWB
    Jan 15, 2021 at 22:17
  • 1
    @MaxB You can read sarnold's answer on Are Ubuntu packages security audited?. sarnold is a member of Ubuntu security team.
    – Kulfy
    Jan 16, 2021 at 9:08
  • @Kulfy Note that he does not touch the subject of malware.
    – MWB
    Jan 17, 2021 at 18:14
  • 1
    @MaxB Aren't malware and security related things?
    – Kulfy
    Jan 17, 2021 at 18:38
  • The bottom line is that most Debian developers do not do a line by line audit of the code they are uploading. I don't know about Ubuntu MOTUs but I suspect the situation is similar. Frankly even if they did do a line by line audit I suspect a competent but evil upstream could slip something by them. Apr 17, 2023 at 19:25
4

Staying with the Main and Universe repositories is very safe, and so are PPAs if they're especially popular (most of the time), or you know that they're going to be safe (like the Google Chrome PPA. I doubt Google would put any type of malware in it.) If you use Main, Universe, and your Google Chrome PPA, you'll be safe.

If Ubuntu gains a ton of users, then yes, there will probably be more malware. I don't think there'd be enough to be a real problem though.

2
  • "Staying with the Main and Universe repositories is very safe" source?
    – MWB
    Jan 15, 2021 at 22:16
  • @MaxB I wrote this comment 9 years ago. If it's problematic please edit or flag it. Jan 20, 2021 at 4:56

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .