A Python Package Index (PyPI) repository administrators published information about the detection of unauthorized access to 174 user accounts on the service. It is believed by PyPI representatives that the authentication parameters of the affected users were obtained from collections of previously compromised credentials that were formed as a result of hacks or leaks of user databases from other services. Access to the accounts in PyPI was achieved due to the victims using the same passwords across different sites and not enabling two-factor authentication in the PyPI directory.
The activity of the attackers was identified after receiving a series of complaints from users who reported receiving notifications from PyPI about activating two-factor authentication while they were not logged into their account at that time and had not changed anything on their own. An analysis of the logs revealed unauthorized access to the accounts of 174 users. No traces of package forgery or other malicious activity were found — all actions by the attackers were limited to unauthorized access and changes to the accounts.
The affected accounts were blocked until the investigation was complete, and all other PyPI users who did not have two-factor authentication enabled were sent notifications and a process for re-verifying their email was initiated. A total of 370 thousand users (56%) in the directory did not have two-factor authentication enabled.
Forrás: opennet.ru
