The developers of the Python Package Index (PyPI) repository have implemented protection against project hijacking through the purchase of expired domains listed in account settings. The attack involves aggressors searching for accounts associated with emails from expired domains, subsequently registering the released domain for themselves, redirecting email traffic to their server, and, upon gaining control over the email, initiating the password recovery process. In 2022, this method led to control over the Python package ctx.
To protect against such attacks, PyPI has implemented daily monitoring of the validity domain names, used in email addresses. Email addresses with expired domains are now automatically switched to an unverified state. For unverified addresses, PyPI does not allow password recovery operations. Only the account owner, who knows the password, can initiate the re-verification process.
Since early June, more than 1,800 email addresses associated with domains that were not renewed on time have been identified in the PyPI user base. As of January 1, 2024, the PyPI directory has switched to mandatory two-factor authentication, without which users cannot perform project management actions. However, for old users created before the mandatory two-factor authentication was introduced, the option for password recovery through email confirmation that does not require two-factor verification remains.
Source: opennet.ru
