Comment on A sneaky demonstration of the dangers of curl bash

• xylogx@lemmy.world ⁨19⁩ ⁨hours⁩ ago

  Not sure how else to explain this. Look at the CISA bulletin on Shai-Hulud the attacker published valid and signed binaries that were installed by hundreds of users.

  "CISA is releasing this Alert to provide guidance in response to a widespread software supply chain compromise involving the world’s largest JavaScript registry, npmjs.com. A self-replicating worm—publicly known as “Shai-Hulud”—has compromised over 500 packages.[i]

  After gaining initial access, the malicious cyber actor deployed malware that scanned the environment for sensitive credentials. The cyber actor then targeted GitHub Personal Access Tokens (PATs) and application programming interface (API) keys for cloud services, including Amazon Web Services (AWS), Google Cloud Platform (GCP), and Microsoft Azure.[ii]

  The malware then:

  • Exfiltrated the harvested credentials to an endpoint controlled by the actor.
  • Uploaded the credentials to a public repository named Shai-Hulud via the GitHub/user/repos API.
  • Leveraged an automated process to rapidly spread by authenticating to the npm registry as the compromised developer, injecting code into other packages, and publishing compromised versions to the registry.[iii]"

  source

  • ShortN0te@lemmy.ml ⁨19⁩ ⁨hours⁩ ago

    After gaining initial access, the malicious cyber actor deployed malware that scanned the environment for sensitive credentials.

    So as I said, the keys got compromised. Thats what i said in the second post.

    source

    • xylogx@lemmy.world ⁨18⁩ ⁨hours⁩ ago

      What you said is the key infra needs to get compromise. I do not need to own the PKI that issued the certs, I just need the private key of the signer. And again, this is something that happens. A lot. A software publisher gets owned, then their account is used to distribute malware.

      source

      • ShortN0te@lemmy.ml ⁨17⁩ ⁨hours⁩ ago

        To achieve a compromised update you either need to compromise the update infrastructure AND the key or the infratstructure AND exploit the local updater to accept the invalid or forged signature.

        As i said, to compromise a signature checked update over the internet you need to compromise both, the distributing infrastructure AND the key. With just either one its not possible. (Ignoring flaws in the code ofc)

        source

        • -> View More Comments