Stories
Slash Boxes
Comments

SoylentNews is people

Backdoored Python Library Caught Stealing SSH Credentials

posted by Fnord666 on Friday May 11 2018, @09:39PM   Printer-friendly
from the another-day-another-hack dept.

MrPlow writes:

Submitted via IRC for TheMightyBuzzard

Barely a week has passed from the last attempt to hide a backdoor in a code library, and we have a new case today. This time around, the backdoor was found in a Python module, and not an npm (JavaScript) package.

The module's name is SSH Decorator (ssh-decorate), developed by Israeli developer Uri Goren, a library for handling SSH connections from Python code.

Source: https://www.bleepingcomputer.com/news/security/backdoored-python-library-caught-stealing-ssh-credentials/

Original Submission

 
This discussion has been archived. No new comments can be posted.
Backdoored Python Library Caught Stealing SSH Credentials | Log In/Create an Account | Top | 11 comments | Search Discussion
Display Options Threshold/Breakthrough Mark All as Read Mark All as Unread
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.

  • (Score: 3, Insightful) by bart9h on Friday May 11 2018, @10:15PM (3 children)

    by bart9h (767) on Friday May 11 2018, @10:15PM (#678589)

    Makes one wonder that there may be as well some backdoors that went unnoticed.

    Starting Score:    1  point
    Moderation   +1  
       Insightful=1, Total=1
    Extra 'Insightful' Modifier   0  
    Karma-Bonus Modifier   +1  
    Total Score:   3  

  • (Score: 2, Informative) by Anonymous Coward on Friday May 11 2018, @10:23PM (2 children)

    by Anonymous Coward on Friday May 11 2018, @10:23PM (#678594)

    Mr Plow is on it [soylentnews.org] nobodies backdoor will be safe.

    On a more serious note; it seems there's too many language specific package managers out there and not enough eye balls on the code.

    • (Score: 1, Insightful) by Anonymous Coward on Friday May 11 2018, @11:56PM (1 child)

      by Anonymous Coward on Friday May 11 2018, @11:56PM (#678626)

      not enough eye balls on the code.

      There is no advantage to open-source code being available for anyone to review, if no one actually does.

      • (Score: 5, Insightful) by coolgopher on Saturday May 12 2018, @02:21AM

        by coolgopher (1157) on Saturday May 12 2018, @02:21AM (#678666)

        I disagree. There is still the advantage that the open-source code *can* be reviewed. Without going through six months of setting up agreements, NDAs, and other lawyering.