Alan Pope, a former engineering and community interaction manager at Canonical, has noted a new wave of attacks on users of the Snap Store app catalog. Instead of registering new accounts, attackers have started purchasing expired domains associated with the email addresses of registered developers of snap packages. After acquiring the domain, attackers redirect email traffic to their server and, having gained control over the email, initiate the process of resetting the forgotten password to access the account.
Once they gain control of an existing account, attackers can release malicious updates to previously published trusted applications, bypassing the extensive checks applied to new participants and avoiding the addition of warning labels for new projects. Alan Pope identified at least two domains (enstorewise.tech and vagueentertainment.com) that were purchased by attackers to hijack accounts, but it is believed that there are many more such cases.
In the past, attackers limited themselves to registering their own accounts, under which they published malicious packages masquerading as official builds of popular software or used names resembling existing packages (typosquatting). In response, Canonical introduced manual checks for new package names first submitted to the Snap Store. After that, the main activity of malware distributors shifted to hosting original packages, promoting them on social media, and later publishing malicious updates attempting to bypass the automated checks and filters available in the Snap Store.
Now the attack vector has shifted towards purchasing expired domains, as the Snap Store repository has not implemented a check for validity domain nevekkel, used in email addresses. Last year, a similar issue was encountered by the PyPI (Python Package Index) repository, which began automatically converting emails with expired domains to an unverified state. More than 1800 such email addresses were blocked in PyPI.
Forrás: opennet.ru
