Information has been revealed about the phishing victims, as warned by the administrators of the Python package repository PyPI (Python Package Index) recently. As a result of messages sent indicating the need to confirm their email, which linked to a fake site pypj.org (the letter 'j' instead of 'i'), accounts of four maintainers were compromised.
As a result, attackers generated two tokens for API access and published two releases of the num2words project (0.5.15 and 0.5.16), which contained malicious code. The num2words module, which has over 3 million downloads per month, provides functions for converting numbers to their textual representation. The malicious num2words releases were removed by PyPI administrators an hour after publication.
To bypass account protection using two-factor authentication, the attackers used transparent traffic proxying from the phishing site pypj.org to the real site pypi.org, creating an illusion for the user of working with the actual PyPI directory. The login page was also proxied, and attackers controlled not only the initially entered login password but also the response to the second-factor authentication verification request.
To counter future attacks via access proxying, PyPI administrators implemented a protection scheme that verifies the domain using JavaScript on the client side and raises an alert in case of hash mismatches. domains However, attackers can easily filter such scripts or replace the verification hash at the proxy level.
Source: opennet.ru
