3 ms·

Here's what the payload looked like: https://gist.github.com/3e4829f79dbd1be11295 https://gist.github.com/3e4829f79dbd1be11295

• timdorr 14y ago
  Did you catch where was this payload injected? Did they have write access to the rubygems.org source? It would seem if they did, they didn't need to write this script at all and could simply read the configuration files directly.
  • WestCoastJustin 14y ago
    After reading through the github.com issue posted in the comments, I get the impression this was targeted attack at rubygems.org (and not the user install base). There has been a tweet, also posted in the comments, suggesting that this was successful.
  • Titanous 14y ago
    It was in the gem metadata, which is YAML: https://gist.github.com/d891e876c53e55bf0920 https://gist.github.com/d891e876c53e55bf0920
• WestCoastJustin 14y ago
  Looks like this would create a pastie.org entry looking something like the this: e193256c9337b50b197f040e762dafcc745a66297c9db47ac30395d8022f94a8 encrypted "config/database.yml", "config/librato.yml", "config/newrelic.yml", "config/rubygems.yml" Searching pastie.org, I don't see any such entries.
  • kawsper 14y ago
    These params 'paste[authorization]' => 'burger', 'paste[access_key]' => '', is just hardcoded pastie.org arguments that gives them somekind of safety against the stupidest attempts. Maybe the post was removed, or the hash is different than the original so not all can find it.
    • Titanous 14y ago
      I didn't change the hash, though I would have if I'd found the post on Pastie.