Information about the victims of phishing, which the administrators of the Python package repository PyPI (Python Package Index) recently warned about, has been revealed. As a result of messages sent to confirm their email, which linked to a fake site pypj.org (the letter 'j' instead of 'i'), the accounts of 4 maintainers were compromised.
The attackers generated two tokens for API access and published two releases of the num2words project (0.5.15 and 0.5.16) containing malicious code. The num2words module, which has over 3 million downloads per month, provides functions for converting numbers into text representation. The malicious num2words releases were removed by PyPI administrators an hour after publication.
To bypass account protection using two-factor authentication, the attackers used transparent traffic proxying from the phishing site pypj.org to the real site pypi.org, creating an illusion for the user of working with the real PyPI catalog. The login page was also proxied, and the attackers controlled not only the initially entered login password but also the response to the verification request of the second factor of authentication.
To counter future proxy-based attacks, PyPI administrators implemented protection that verifies the domain via JavaScript on the client side and, in the event of hash mismatches, issues a warning. domæner The warning (the attacker can filter such a script at the proxy level or replace the verification hash with ease).
Kilde: opennet.ru
