B (47:36)
So I don't know people who listen in here who are. Have their ears on the community. Everybody hates Snaps. Not everybody, but, you know, but just for those of you who do, just when you thought you heard it all, you know, they're bloated canonical forces us to use them and I don't know what else but Everybody hates them. Well, I'm here today to help you add to that list. At least with one more reason to be at least a little wary of Snaps. And yes, one of my sources is from the blog of Snap aficionado himself, Alan Poppy. Snaps, in theory are a modern Linux packaging system, compressed cryptographically, science sandbox, and easy to roll back on paper. It all sounds great, but in practice, Canonical Snapstore has been dealing with relentless waves of scammers publishing malware lately, especially fake cryptocurrency wallet apps. And this isn't just annoying junkware, you know, these are, they're straight up theft tools. You know, the scam is simple. The fake wall looks legit, like Exodus Ledger Live or Trust Wallet. And once you install it, it asks for your wallet recovery phrase. If you type it in, it gets sent to the criminals and then the app throws an error. And by the time you realize what happened, your wallet is empty. Alan documents at least one confirmed case where a victim lost 490,000. I just wish I had that much to lose. But Canonical has tried to fight it. You know, there are filters, reviews, takedowns, but it's the classic security whack. A mole problem. And the scammers keep changing the tactics. You know, first they published convincing look alike or convincing looking fake apps with good screenshots and, and, and, and store pages. And when text filter started catching them, they switched to Unicord UDA code. Look alike characters swapping letters with similar looking symbols from other alphabets to sneak past the automated detection. Then came the bait and switch. Publish something harmless under a random name, get approved, and later push a second update that turns it into a fake wallet. But now things are really starting to escalate. The scammers aren't just creating new accounts anymore, they're taking over old trusted publisher accounts. They, they monitor the Snap store for publishers who used a domain name in their identity, like Cool project Tech. And, and if that domain expires, the scammers re register it. And once they control the domain, they trigger a password reset, take over the Snap publisher account and push malicious updates from a publisher that looks legitimate and established. You know, and this is one reason why I still own domains for old abandoned projects that I'm not even no longer doing anything with. I haven't touched in like a decade. I, I still keep renewing the domain every year. Domains are cheap and as long as you don't have hundreds of projects, eventually I'll let it go. You know, eventually no one's going to have A clue what Live Client 2 is. So that's the domain that I have and there's nothing there. So. Because, well now I just brought the name back and you people are going to remember for another decade. But anyway, Alan says he's already identified this happening with at least two domains, storewise tech and vague entertainment.com and he suspects there are more. The scary part, you know, undermines one of the only trust signals users had. You know, before they could at least be cautious about brand new publishers. Now a Snap you installed years ago could get a malicious update tomorrow if a publisher's account gets hijacked, you know, I guess or as we've seen libraries that they use get hijacked or something. So. So I guess so much for auto updates, huh? Auto updates are so good. But be careful. Alan built a tool called Snapscope that I talked about a few weeks ago, originally for sbobs and vulnerability scanning. But it also helped highlight just how widespread and persistent this malware problem is. Canonical likely needs stronger protections around publisher accounts, monitoring domains, requiring stronger verification for domain accounts and pushing or requiring two factor authentication. And for everyone listening, if you are a publisher, you know, remove, renew your domain and turn on two fa. You know, like I've done. If you're a user, be extremely cautious with crypto wallets and really any app store, especially you know, if it's has access or you're giving it access to some pretty, some data that could really be taken advantage of. You know, best not to install any wallet apps from the store at all. You know, get them directly from the official project site and because yeah, everybody hates snaps. So now you have another reason. But you know, like I said, it's a good idea to be cautious with anything you install. These issues have hit many app stores on all OSes. You know, Windows, Mac OS, Android, iOS, they've all had malicious stuff. You know, it's not just limited to Snaps or Linux, you know, gotta consider what access they have, information you have. It's just that right now the story behind Snaps is being brought to the forefront. So.