Alan Pope, former engineering and community interactions manager at Canonical, has noted a new wave of attacks on users of the Snap Store application catalog. Instead of registering new accounts, attackers have begun purchasing expired domains associated with the email addresses of registered snap package developers. After acquiring the domain, the attackers redirect email traffic to their server and, having gained control of the email, initiate the password recovery process to access the account.
With control of an existing account, attackers can publish malicious updates to previously trusted applications, bypassing the enhanced checks applied to new participants, and avoiding the addition of warning labels on new projects. Alan Pope identified at least two domains (enstorewise.tech and vagueentertainment.com) purchased by attackers to seize accounts, but it is believed that there are many more such cases.
In the past, attackers limited themselves to registering their own accounts under which malicious packages posing as official builds of popular software were published, or using names similar to existing packages (typosquatting). In response, Canonical implemented manual checks for new package names being first uploaded to the Snap Store. After that, the main activities of malware distributors shifted to publishing original packages, promoting them on social media, and later releasing malicious updates attempting to bypass the existing automated checks and filters in the Snap Store.
Now, the attack vector has shifted towards the purchase of expired domains, as there was no relevance check implemented for the domains used in email addresses within the Snap Store repository. domain namesLast year, a similar issue occurred with the PyPI (Python Package Index) repository, which began automatically marking emails with expired domains as unverified. More than 1,800 such email addresses were blocked on PyPI.
Source: opennet.ru
