Be alert: targeted attacks on prominent Rustaceans
Be alert: targeted attacks on prominent Rustaceans Important warning from Adam Harvey and the crates security team: We believe that there is an ongoing campaign targeting rust-lang members and owners of popular crates that is attempting to compromise devices and accounts in order to use them to publish malware. A video call is set up for something positive — maybe for a job, maybe for a project,…
The security team of the Rust programming language, known as crates security, has issued an urgent warning about a possible campaign targeting prominent Rust developers, or "Rustaceans." These attackers aim to compromise devices and accounts of these individuals to spread malware. Security experts believe that such attacks are likely using seemingly innocuous video calls as a gateway to install malicious software or run commands on the target's computer.
In a recent supply chain attack, this method was used to compromise the array ref crate and other open source software. The attack typically involves a conversation that appears to be for a job, a collaboration, or a contract. Once trust is established, the attacker uses this connection to distribute malware, often through a purportedly missing audio codec or by placing commands in the clipboard.
The source of these potential attack vectors can be any individual involved in the open source software supply chain, including those with publishing rights for packages in the dependency network. Due to the pervasive nature of open source software, it is crucial to exercise caution when adopting new package releases. To mitigate the risk of such attacks, implementing dependency cooldowns is recommended.
This practice involves waiting several days before upgrading to new package releases, allowing for potential detection and prevention of supply chain attacks.
Written by urgent.news from Simon Willison's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
