News: Malicious Rust libraries for bioinformatic software: sha-rst et al.
Currently, a malicious actor is trying to abuse bioinformatic Rust software for supply chain attacks to steal credentials. The attack is described in this blog post and the initially affected crates have been removed.
However, malware is resurfacing under new crate names, e.g. renamed to sha-rst instead of sha-rust, so if you are searching for dependencies for your own Rust tools, please be extra cautious and also keep an eye on the dependencies of your dependency. For example, in this case the malicious crate and those referencing it were uploaded by one user, so are easy to spot.
• 1,481 views
•
link
written
by
Matthias Zepper
0 answers
No answers yet.
Log in to answer this question.
somewhat tame compared to some things that happened in the javascript world recently
https://www.wiz.io/blog/widespread-npm-supply-chain-attack-breaking-down-impact-scope-across-debug-chalk <-- package with literally billions of weekly downloads hijacked then there was also https://www.wiz.io/blog/shai-hulud-2-0-ongoing-supply-chain-attack
pretty treacherous for open source with lots of dependencies...it is lucky that those weren't really all the damaging all things considered but i don't expect things like this will go away necessarily and will get more advanced
Absolutely, this is the way more scary and impactful attack.
I decided to post here about the Rust one, because I found it remarkable that a bioinformatic software was chosen as the attack vector by impersonating a legitimate tool and then hiding the malware in the dependencies of that copycat tool. Because the fake tool retained all code from the legitimate open-source one, it was actually a working version of it and thus could have stayed unnoticed, while sending secret credentials and files to an attacker-controlled server via UDP.
So either there is an embittered former coworker behind this, or the attackers wanted to target a particular research institution or company known to be using that tool.
Is the github account behind it already gone ? I could not access it.
Yes, it seems like it. The resurrected malicious crates were deleted within about an hour after I reported them and I guess the user was also reported to GitHub by Rust's security team.
I didn't click through previously to see that finch is bioinfo software, that is pretty crazy