A hacker group is poisoning open source code at an record scale
·2 min read
Compiled by KHAO Editorial
— aggregated from 1 source + 10 references discovered via search.
See llms.txt for citation guidance.
◌ Single Source
A so-called software supply chain attack, in which hackers corrupt a legitimate piece of software to hide their own malicious code, was once a relatively rare event but one that haunted the cybersecurity world with its insidious threat of turning any innocent application into a dangerous foothold in a victim’s network.
Key facts
It’s been like wildfire; it’s gone fast,” says Nathaniel Quist, manager of the Cortex Cloud intelligence team at Palo Alto Networks
As a result, the hackers behind the breach, an increasingly notorious group called TeamPCP, claim to have accessed around 4,000 of GitHub’s code repositories
It’s not qualitatively different from the 14 breaches that happened last week
The team do not care about extorting GitHub, 1 buyer and they shred the data on their end
Summary
On Tuesday night, open source code platform GitHub announced that it had been breached by hackers in one such software supply chain attack: A GitHub developer had installed a “poisoned” extension for VSCode, a plug-in for a commonly used code editor that, like GitHub itself, is owned by Microsoft. The GitHub breach is the latest incident in what has become the longest-running spree of software supply chain attacks ever, with no end in sight. Those tainted pieces of code have allowed TeamPCP’s hackers to breach hundreds of companies that installed the software, says Ben Read, who leads strategic threat intelligence at the cloud security firm Wiz.
TeamPCP’s core tactic has become a kind of cyclical exploitation of software developers: The hackers gain access to a network where an open source tool commonly used by coders is being developed—for example, the VSCode extension that led to the GitHub breach or the data visualization software AntV that TeamPCP hijacked earlier this week.