Please create an account to participate in the Slashdot moderation system

 



Forgot your password?
typodupeerror
×

Submission + - Large Scale Phishing Attack Floods OpenSource Repositories with 144,000 Packages (linuxsecurity.com)

Carl Gibson Jr writes: Researchers have identified that a massive 144,294 phishing-related packages have been uploaded by unknown threat actors on widely used open-source package repositories including NPM, PyPi, and NuGet. This large-scale attack, which promotes fake apps, prize-winning surveys, gift cards, giveaways, and more, was made possible by automation. The phishing packages were uploaded in troves within a couple of days from accounts using a particular naming scheme, featured similar descriptions, and led to the same cluster of 90 domains that hosted over 65,000 phishing pages. This malicious campaign impacting the open-source software ecosystem is a high-profile example of the growing threat that phishing attacks, which account for over 90% of today’s cyberattacks, pose to all users and organizations.

NuGet had the largest share of malicious package uploads at 136,258, PyPI had 7,894 infections, and NPM only had 212. The package descriptions contained the URL to the phishing sites, urging users to click links to get details about alleged gift card codes, applications and hackings tools. This tactic demonstrated an effort by the attackers to increase the SEO of their phishing sites. Almost all of these sites request visitors to enter their email, username, and account passwords, resulting in victims unknowingly sharing this sensitive information that can be monetized for personal and financial gain with attackers. This then initiates a series of redirects to survey sites, finally landing on legitimate e-commerce websites using affiliate links that generate revenue for the malicious actors. If victims went on to make purchases on these sites while the referral codes were active, the threat actors would receive referral awards. Thus, redirecting users from the phishing sites to these legitimate sites served both as a distraction from the theft of victims’ login credentials, and as a secondary exploitation scheme.

The phishing packages used in this campaign have since been removed from the repositories, except in the case of NuGet, where the packages were unlisted from the repository’s search results. These unlisted packages are still available, but not easily accessible. Regardless, the automated methods used in this campaign to upload a very large number of packages over a short period of time with relative ease raise concern that the cybercriminals behind this operation could reintroduce the threat using new accounts and different package names at any time. Linux security expert Dave Wreski advises, “To protect their digital security, users should always engage in cybersecurity best practices and remain vigilant when browsing package repositories.”

For the complete list of the URLs used in this campaign, check out this IoC text file on GitHub https://gist.github.com/jossef...

Be sure to visit LinuxSecurity.com frequently and subscribe to our weekly newsletters to stay up-to-date on the latest security news and information impacting the open source community!
https://linuxsecurity.com/news...

Comment Re:Yes, obviously? (Score 1) 177

To be honest I think the term law applies perfectly:

Just like "normal" laws they can be clarified later on with more specific laws / descriptions to handle the edge cases the current law doesn't. Even in the field of law its not impossible for a law to be overturned / updated. It might take allot of evidence / support to perform that change but its still doable (even if you take the extreme case of a constitutional amendment in the US). As such it shows the progress of the society as a whole, even Einstein's theories got major push back initially but as more experiments proved he was correct the snowball forced the change of thinking. Newton's laws still are simpler to calculate and still produce sufficiently correct answers once you aren't in the subatomic or super massive arenas, which once again is no different to a "Limitation of Scope", "Limitation of Use" or "Limitation on Scope of Use" clauses in a traditional law (all of which say "this law only applies in these circumstances").

What scientist are looking for are the laws that have no such limitations (essentially the real-life equivalent of a mathematical proof) but the limited versions we have discovered in the mean time have proven their worth to society in my opinion immeasurable ways. They also restrict the search space for that universal law and assist in focusing the search and making it easier to find as the universal law has to adhere to previous observations as well as the new ones. Until better is found they stand as "the law of the land".

Comment Re:Daytime? (Score 1) 198

It could very well be US daytime as the majority of the ground stations are there (or nearby time zones) for downlinking the traffic and connecting it to the rest of the internet.

I'm quite sure the bottleneck is on the relatively fewer ground stations vs the link to customers (I'm assuming near fiber speeds on the mesh between sats):
https://www.researchgate.net/f...

Shows where the ground stations are, so even if you are in Ukraine you are connecting to the rest of the internet at one of those locations:
- US
- Australia
- New Zealand
- Chile
- Looks to be UK although https://satellitemap.space/ shows some in the EU

Swap Chile for Canada and you have the entire 5 eyes alliance present. Whenever he decided to start peering with local ISPs and keeping traffic local (IXes exist for a reason) the performance will likely increase again, also at that point the local daytime would matter more as some downlinking would actually be in that timezone.

Comment Re:At least there's no transmission loss (Score 1) 97

Biggest state where the crypto miners are going is Texas and given that bills are now being introduced to try to cut down on its use (HB 896 and HB 897 introduced in Dec 2020) which were introduced by Democrats (which pretty much means they are going nowhere in Texas) kind of tells me the crypto miners have nothing to worry about for at least a couple of years.

Comment Re:Because we externalize costs (Score 1) 97

"shows how stupid Bitcoin is" - To me not really, there is enough money in bitcoin mining that they are able to use power sources that would otherwise go to waste.

I guess we both would prefer those trailers to be full of servers that run something like AWS spot instances (doing "real" work vs mining a crypto currency). If anything Bitcoin mining is trailblazing power sources for data centers (Google's Carbon-Aware Computing already does stuff like this for renewables, shifting workloads as needed).

I can't see the sources listed above being so unstable that someone can't schedule the outages in, the good news is technologies / business models like that work for renewables as well so its not like its a sunk cost that is lost when we finally move off of fossil fuels. The waste coal burning could be avoided but in the case of the natural gas it was going to be flared off anyway.

Comment Re:Repealing Section 230 (Score 1) 401

Its a bad idea no matter which side of the fence you are on.

The problem with Trump suggesting it (as he did multiple times) is it would be absolutely obvious that he had not put a second of thought into the implications, his account would be the first to be kicked off as I'm absolutely sure there would be nothing brought in to replace it. As with the various policies he rolled out there would be mass panic as everyone tried to figure out what the withdrawal actually meant. Sites that require user input would probably have to go to a "moderator approval for all posts" style approach and wipe out anything remotely controversial which would still require a shitload of manpower and slow as hell but its better than a lawsuit.

Biden's reasoning is unfortunately sound, and something the social media sites have been fighting for years which is why they have attempted everything to self-regulate. Look to the various adpocalypse on youtube for ways bad actors have made life worse for everyone else, this is just that but on a MUCH larger scale. The problem is Trump showed how far a bad actor can twist the system to their whim and issues previously waved away as "no one that crazy would ever reach such a position of power" (the fact that the question of "what is a legal order" in the military context even came up is worrying to say the least). I expect allot of "norms" will get coded into law to prevent another Trump.

I want to see Poland's social media 'free speech' law (this is coming from a right-wing government), almost by definition it would provide the legal shield to the tech giants to allow whatever on their platforms with no need to regulate any of it until they get a court order (similar to telcos and ISPs who will just forward it on / terminate service accordingly to maintain their safe harbor).

What remains to be seen is what will replace section 230, if nothing does and sites remain liable will social media migrate to distributed forms of communication like Gab? That would just shift the problem back to ISPs to play wack-a-mole like we did with BitTorrent again, is that tingling happy memories or PTSD?

Comment Re:By using dollar signs (Score 1) 136

I think the difference is what incentive structure are you using vs the non-technical managers.

Especially as developers we feel the pain for longer term projects / tasks and we try to avoid technical debt where possible but you have to remember the CEO's goal is to just make the next quarter look good or he may not be in charge for the following quarter, that mindset permeates all the way down.

The technical debt is practically invisible to the non-techs so is not a deterrent to them.

Comment Re:It's a heirarchy. But yes, the (soft) end (Score 1) 283

IPv6 firewall rules are simpler if all you are attempting to do is replicate the side effects of PAT / NAT-P (the specific form of NAT in use by most users) in IPv4.

Rule #1: Is the connection originating from the outside / WAN port (i.e. packet came in via WAN port and isn't in the connection table)? If Yes, drop it.
Rule #2: End firewall rules

That's literally it if all you want is the security that NAT provides. It has even less of an effect than NAT as no re-writing of the packet has to occur (including the band-aids for IPSEC, SIP, FTP, etc) and the connection table is smaller as at least the column of what port the connection got mapped to on the public side is no longer required (on cisco devices its actually 4 columns that disappear).

Side effects of this approach? You still can't connect from outside:
1. Your VoIP phone has to deal with keepalives to be able to receive calls as there is no other way for the VoIP provider to reach the handset, but its no worse than what happens in IPv4 NAT world so no real loss.
2. Peer-to-peer protocols still have to go punching holes like they did with NAT, once again no worse than the current IPv4 world.

What you are mixing up is buggy implementations with something fundamental to the protocol. The pressure to switch to IPv6 is ramping up, and this round I'm pretty sure it will push through. I know at least 3 other ASNs that no longer issue public ip space to residential customers, even normal business links don't always get, those that are unable / unwilling to switch will get charged more to get access to the limited IPv4 space and normal users will get priced out of the conversation, its as simple as that. the registries and IETF have done what they can to make the transition as smooth as possible, from what I've seen they have mainly thrown their hands in the air and are going to leave the market to sort this out.

I've had to justify to both ARIN and LACNIC in the past year for IP space when the registries run out no amount of sad story you go to them with will help. What is also being mixed up here is the technical guys willingness to make this process as problem free as possible to avoid fragmenting the internet which is why formerly unusable chunks of the IPv4 address space were re-classified. There are going to be routers out there that are not going to be aware of the rule change and those parts of the internet will be inaccessible to those re-classified chunks but the alternative is not being able to allocate an address at all.

Slashdot Top Deals

Elliptic paraboloids for sale.

Working...