This smacks of a compromised something or other...
-
This smacks of a compromised something or other... why is an apt upgrade of firmware-b43-installer going to a childcare blog. A violin shop? Hmm... reinstalling this entirely.
(Update: this apparently WAS a bug, but has been fixed in more recent versions of Debian... but not old ones h/t @alienghic )
https://salsa.debian.org/debian/b43-fwcutter/-/commit/5a328aadbd836a27ea3c320645fede7f1d272905
-
Wait why is that in your apt sources file?
Normally your sources should just be pointing to the distro?
-
@alienghic This, it turns out, is a package which pulls a firmware for a specific Broadcom card from an arbitrary URL. However, the source code for Debian is pulling from a URL which is NOT an actual repository... it's an arbitrary URL. Which appears to be part of a link farm of some sort.
-
@ai6yr @alienghic
In case somebody else is wondering what happened like I did, this is what I've foundI see that there was a bug (bugs.debian.org/cgi-bin/bugrep…) and it was fixed with this commit (salsa.debian.org/debian/b43-fw…), but possibly only in oldstable (bookworm) and more recent releases.
And in the comments on the two links there are also reasons why the package is doing this download (lack of licensing permission for debian to host the firmware on their own infra :( ).
I believe that the system is probably still safe, because the downloader was checking a checksum of the downloaded file, unless it was using a compromised checksum algorithm, but then it would have been mentioned in the bug comments? I hope?
