4 ms·
This looks like someone trying to replicate Alex Birsan's attack on Apple, Microsoft, and others but through package confusion instead of version squatting. Rea
by erichurkman 6y ago
This looks like someone trying to replicate Alex Birsan's attack on Apple, Microsoft, and others but through package confusion instead of version squatting. Reasonable speculation:
1. Host thousands of typo packages that phone home every time they are installed. Store IPs.
2. Find which companies own those IPs, filter out residential
3. Report vulnerabilities
[0] https://news.ycombinator.com/item?id=26087064 https://news.ycombinator.com/item?id=26087064
- soheil 6y agoHow hard is it to use a VPN?
- moviuro 6y agohttps://incolumitas.com/2016/06/08/typosquatting-package-managers/ https://incolumitas.com/2016/06/08/typosquatting-package-man... https://news.ycombinator.com/item?id=11862217 https://news.ycombinator.com/item?id=11862217
- uranusjr 6y agoAlex Birsan’s attack was much more involved and raised issues less recognised by a vast number of communities members. This one is basically typosquatting, a well known issue that Birsan’s manoeuvre did not focus on.