3 ms·
Mining for Malicious Ruby Gems
- bhaak 7y ago> The perfect candidate to succumb to this type of “spray-and-pray” supply chain attack is a Ruby developer whose environment of choice is a Windows system that’s also periodically being used to make BitCoin transactions. A rare breed indeed. Very rare indeed. I suppose every package had their own BTC address. I wonder how much they got away with. But I thought rubygems does a similarity check for names and reject or flag them for manual verification if the name is too similar to an existing one?
- Techies4Trump 7y agoThere are far more effective ways of stealing (or scamming) bitcoin. The point is the attacker could put any kind of malicious payload in here.
- lonelappde 7y agoFree software projects need to converge on standard platforms and tools. On the modern complex world, it's bad enough that they can't keep with proprietary software features and polish. But they can't keep up with the black hat industry either.
- quesera 7y agoI would support a Great Renaming, wherein underscores and dashes are considered equivalent and insignificant: action-mailer_cache_delivery action-mailer-cache-delivery actionmailercachedelivery act-ion-ma-iler_c-ache-deli_very Should resolve to the same entry in RubyGems. I would also support this usage in `require` lines. The "experts-exchange" (or "pen-is-mightier") problem is tiny compared to the frustration and security risk of the present policy.