|
Malware campaign on GitHub...
Quote:
Should be a piece of cake for the Ms AI one would perhaps think? Otoh, saw a couple of years ago that Ms would use AI to help with Ms updates and anyone following how that circus has turned out, then perhaps not. Secure supply chain is of utmost importance these days... |
Speaking of secure supply chains... https://popey.com/blog/2024/02/exodu...-490k-swindle/
|
Quote:
|
From the daily news...
How to use hallucinating AI to inject poisoned software into the supply chain... https://www.theregister.com/2024/03/...ware_packages/ Walled gardens under attacks are nothing new, here's snap store "After multiple waves of cryptocurrency credential-stealing apps were uploaded to the Snap store, Canonical is changing its policies." https://www.theregister.com/2024/03/...p_store_scams/ Totally unrelated, but a fun AI event :D https://futurism.com/the-byte/ai-pow...less-screaming |
|
"...XZ security vulnerability due to malicious code making it into the codebase."
https://www.phoronix.com/news/XZ-CVE-2024-3094 "The resulting malicious build interferes with authentication in sshd via systemd. " Updated: .... "Access to this repository has been disabled by GitHub Staff due to a violation of GitHub's terms of service. If you are the owner of the repository, you may reach out to GitHub Support for more information." The ToS violation presumably due to the compromised upstream commit access. https://www.phoronix.com/news/GitHub-Disables-XZ-Repo |
Just came across this interesting post on the inner workings of the attacking code...
https://lwn.net/ml/oss-security/2024...3.anarazel.de/ |
Found by chance...
"Someone put a lot of effort for this to be pretty innocent looking and decently hidden. From binary test files used to store payload, to file carving, substitution ciphers, and an RC4 variant implemented in AWK all done with just standard command line tools. And all this in 3 stages of execution, and with an "extension" system to future-proof things and not have to change the binary test files again. I can't help but wonder (as I'm sure is the rest of our security community) - if this was found by accident, how many things still remain undiscovered." https://lwn.net/ml/oss-security/2024...@openwall.com/ Everyone _really_ should read the entire thread. :hattip: |
| All times are GMT -5. The time now is 12:42 PM. |