Forgot your password?
Close
typodupeerror

Submission + - China's Dystopian "New IP" Plan Shows Need for Renewed US Commitment to Internet (justsecurity.org)

Submitted by schwit1
schwit1 writes: “Huawei’s plans for 6G and beyond make U.S. concerns over 5G look paltry: Huawei is proposing a fundamental internet redesign, which it calls “New IP,” designed to build ‘intrinsic security’ into the web. Intrinsic security means that individuals must register to use the internet, and authorities can shut off an individual user’s internet access at any time. In short, Huawei is looking to integrate China’s ‘social credit,’ surveillance, and censorship regimes into the internet’s architecture.”

Submission + - Malicious Actors are targeting Go packages on Github (michenriksen.com)

Submitted by ArghBlarg
ArghBlarg writes: Michael Henrikson describes his investigations into Go package manager 'supply chain' attacks and found at least one very suspicious package, typosquatting on one of the most popular logging libraries. The imposter package phones home to an IP he alleges belongs to the Chinese company Tencent:

It looks like the author utfave wants to know the hostname, operating system, and architecture of all the machines using their version of urfave/cli. The function extracts the system information and then calls out to the IP address 122.51.124.140 belonging to the Chinese company Shenzhen Tencent Computer Systems via HTTP with the system information added as URL parameters. While this code won’t give them any access to systems, it’s highly suspicious that they collect this information and the actor can quickly change this code to call back with a reverse shell if they identify a system to be valuable or interesting.

A good case for always going over your package imports, in any language, and ensuring you're either a) auditing them regularly, or b) keeping frozen vendored copies which you can trust.

Slashdot Top Deals

All theoretical chemistry is really physics; and all theoretical chemists know it. -- Richard P. Feynman

Close