Backdoor code found in 11 Ruby libraries

guest · Aug 20, 2019

Backdoor code found in 11 Ruby libraries
RubyGems staff have removed 18 malicious Ruby library versions that have been downloaded 3,584 times since July 8
August 20, 2019
https://www.zdnet.com/article/backdoor-code-found-in-11-ruby-libraries/

Maintainers of the RubyGems package repository have yanked 18 malicious versions of 11 Ruby libraries that contained a backdoor mechanism and were caught inserting code that launched hidden cryptocurrency mining operations inside other people's Ruby projects.

The malicious code was first discovered yesterday inside four versions of rest-client, an extremely popular Ruby library.
According to an analysis by Jan Dintel, a Dutch Ruby developer, the malicious code found in rest-client would collect and send the URL and environment variables of a compromised system to a remote server in Ukraine.
Click to expand...

guest · Apr 17, 2020

Over 700 Malicious Typosquatted Libraries Found On RubyGems Repository
April 16, 2020
https://thehackernews.com/2020/04/rubygem-typosquatting-malware.html?&web_view=true

In the latest research shared with The Hacker News, cybersecurity experts at ReversingLabs revealed over 700 malicious gems — packages written in Ruby programming language — that supply chain attackers were caught recently distributing through the RubyGems repository.

The malicious campaign leveraged the typosquatting technique where attackers uploaded intentionally misspelled legitimate packages in hopes that unwitting developers will mistype the name and unintentionally install the malicious library instead.
After the findings were privately disclosed to RubyGems maintainers, the malicious gems and associated attackers' accounts were removed, almost two days later on February 27.

"Being closely integrated with the programming languages, the repositories make it easy to consume and manage third-party components," the cybersecurity firm said.
Click to expand...

guest · Dec 16, 2020

Malicious RubyGems packages used in cryptocurrency supply chain attack
December 16, 2020
https://www.bleepingcomputer.com/ne...s-used-in-cryptocurrency-supply-chain-attack/

New malicious RubyGems packages have been discovered that are being used in a supply chain attack to steal cryptocurrency from unsuspecting users.

As anyone can upload a Gem to the RubyGems repository, it allows threat actors to upload malicious packages to the repository in the hopes that another developer will integrate it into their program.
Malicious gems steal user's cryptocurrency
Today, open-source security firm Sonatype reported on two malicious Ruby packages that install a clipboard hijacker. These packages are masquerading as a bitcoin library and a library for displaying strings with different color effects.
Click to expand...

The ruby-bitcoin-0.0.20.gem package was added to RubyGems on December 7th and had 81 downloads. The pretty_color-0.8.1.gem package was added on December 13th and had 61 downloads. Both packages were removed by RubyGems the day after they were added to the repository.

At this time, none of the cryptocurrency addresses have received any funds.
Click to expand...

Log in or Sign up

Backdoor code found in 11 Ruby libraries

guest Guest

guest Guest

guest Guest

Log in or Sign up

Backdoor code found in 11 Ruby libraries

guest Guest

guest Guest

guest Guest

Useful Searches