| Thread Tools |
23rd August 2019, 08:46 | #1 |
[M] Reviewer Join Date: May 2010 Location: Romania
Posts: 153,575
| RubyGems maintainers pull packages 11 Ruby libraries had a backdoor Maintainers of the RubyGems package repository have pulled 18 malicious versions of 11 Ruby libraries that contained a backdoor mechanism and were caught inserting code that launched hidden cryptocurrency mining operations inside other people's Ruby projects. The malicious code was discovered yesterday inside four versions of rest-client, an extremely popular Ruby library. Dutch Ruby developer Jan Dintel said that the malicious code found in rest-client would collect and send the URL and environment variables of a compromised system to a remote server in Ukraine. Depending on your setup this can include credentials of services that you use. for example database, payment service provider, Dintel said. The code contained a backdoor mechanism that allowed the attacker to send a cookie file back to a compromised project, and allow the attacker to execute malicious commands. A subsequent investigation by the RubyGems staff discovered that this mechanism was being abused to insert cryptocurrency mining code. RubyGems staff also uncovered similar code in 10 other projects. All the libraries, except rest-client, were created by taking another fully functional library, adding the malicious code, and then re-uploading it on RubyGems under a new name. All in all, all the 18 malicious library versions only managed to amass 3,584 downloads before being removed from RubyGems. https://fudzilla.com/news/49258-ruby...-pull-packages |
Similar Threads | ||||
Thread | Thread Starter | Forum | Replies | Last Post |
VW wants to ensure EVs are delivering your packages | Stefan Mileschin | WebNews | 0 | 30th November 2018 14:54 |
Amazon can deliver packages to the inside of your car | Stefan Mileschin | WebNews | 0 | 26th April 2018 13:07 |
Comcast is bundling Netflix into cable packages | Stefan Mileschin | WebNews | 0 | 16th April 2018 10:48 |
Fan config: Does it matter? Testing push vs pull vs push/pull | Stefan Mileschin | WebNews | 0 | 30th December 2016 09:53 |
Samsung builds 8GB LPDDR4 packages on its 10-nm process | Stefan Mileschin | WebNews | 0 | 21st October 2016 12:22 |
Sky's Now TV Combo packages go on sale | Stefan Mileschin | WebNews | 0 | 10th July 2016 15:23 |
How to Install and Manage Snap Packages on Ubuntu 16.04 LTS | Stefan Mileschin | WebNews | 0 | 27th April 2016 08:15 |
Shyp will now deliver your eBay packages, with no fee | Stefan Mileschin | WebNews | 0 | 3rd December 2015 08:13 |
PayPal now lets you pay for packages days after you order them | Stefan Mileschin | WebNews | 0 | 4th November 2014 12:25 |
Thread Tools | |
| |