Canonical to manually approve new Snap package names

posted by Roy Schestowitz on Mar 29, 2024,
updated Mar 30, 2024

Part of the problem is that these apps look legitimate to casual inspection because the Snap Store badges them as "safe." Unfortunately, that just means the apps are strictly confined in a sandbox, but for the scammers' purposes, that doesn't matter. The apps look like the real thing and use simple social engineering to extract users' credentials, which they then use to siphon off the victim's funds. But the apps can't touch your system, so by Snap confinement rules, they're "safe."

Read on

Two More:

• Ubuntu will manually review Snap Store after crypto wallet scams

  The Snap Store, where containerized Snap apps are distributed for Ubuntu's Linux distribution, has been attacked for months by fake crypto wallet uploads that seek to steal users' currencies. As a result, engineers at Ubuntu's parent firm are now manually reviewing apps uploaded to the store before they are available.

  The move follows weeks of reporting by Alan Pope, a former Canonical/Ubuntu staffer on the Snapcraft team, who is still very active in the ecosystem. In February, Pope blogged about how one bitcoin investor lost nine bitcoins (about $490,000 at the time) by using an "Exodus Wallet" app from the Snap store. Exodus is a known cryptocurrency wallet, but this wallet was not from that entity. As detailed by one user wondering what happened on the Snapcraft forums, the wallet immediately transferred his entire balance to an unknown address after a 12-word recovery phrase was entered (which Exodus tells you on support pages never to do).

• Oh Snap! Canonical now doing manual reviews for new packages due to scam apps

  After repeatedly suffering issues with scam apps making it onto the Snap Store, Canonical maker of Ubuntu Linux have now decided to manually look over submissions.

  I've covered the issues with the Snap Store a few times now like on March 19th when ten scam crypto apps appeared, got taken down and then reappeared under a different publisher. Also earlier back in February there was an issue where a user actually lost their wallet as a result of a fake app. Multiple fake apps were also put up back in October last year as well, so it was a repeating issue that really needed dealing with properly.

TechRadar:

• Canonical announces Snap Store crackdown after crypto scam apps overload | TechRadar

  No more automatic publishing after multiple security incidents