AWS keys stolen by malicious PyPI package with thousands of downloads

Date:
Mon, 11 Nov 2024 16:04:00 +0000

Description:
A typosquatted package was sitting in PyPI for several years, putting users
at risk.

FULL STORY ======================================================================Research ers discover three-year old malicious package in PyPI The package is a typosquatted version of Fabric, with 37,000 downloads Its goal is to steal
AWS login credentials from the developers

A malicious Python package has been hiding in the Python Package Index (PyPI) for years, stealthily stealing peoples Amazon Web Service (AWS) credentials.

Cybersecurity researchers Socket outlined how a package called fabrice was uploaded to the repository back in 2021 - before PyPl deployed its advanced scanning tool.

Since the tools did not scan retroactively, the package remained on the platform and was offered to the users. Hidden Risk

PyPI is one of the most popular Python package repositories in the world,
with millions of daily downloads and a half-million hosted packages.

Fabrice is a typosquatted version of the fabric library, a package for SSH-based remote server management, designed to simplify system
administration and deployment tasks. It is primarily used for scripting and automating tasks across multiple servers, and enables users to run shell commands remotely over SSH.

According to BleepingComputer , it has more than 200 million downloads,
making it extremely popular, however its typosquatted version did not fare
too badly itself, being downloaded more than 37,000 times by the time it was identified as malicious.

Fabrice targets both Windows and Linux users, and while it comes with a
number of features and persistence mechanisms, its key job is to steal Amazon Web Services accounts. Once identified, the malware exfiltrates them to a VPN server, apparently operated by the the connectivity and cloud services provider, M247, in Paris, France. That makes tracking the actual destination more difficult, it was said.

To defend against these attacks, businesses can do two things - make sure
they know exactly what theyre downloading from the internet, and deploy AWS Identity and Access Management (IAM) to manage permissions to the resources.

Typosquatting on PyPI is a common occurrence these days, and is the root
cause of some of the bigger software supply chain attacks today. You might also like North Korean hackers are targeting Apple users with new macOS malware Here's a list of the best firewalls today These are the best endpoint protection tools right now



======================================================================
Link to news story: https://www.techradar.com/pro/security/aws-keys-stolen-by-malicious-pypi-packa ge-with-thousands-of-downloads


--- Mystic BBS v1.12 A47 (Linux/64)
* Origin: tqwNet Technology News (1337:1/100)