Open Source Malware Vector

[wanderer]

Cory Doctorow blogged about an open source project called event-stream being turned into a malware vector.

 

https://boingboing.net/2018/11/26/candy-from-strangers.html

 

[nbohr1more]

As I understand it, the target app was related to Crypto mining so the incentive to infiltrate was much higher

than with other dormant projects.

 

It's good that the alarm bell is being raised anyway.

[freyk]

one of the benefits of opensource is that everyone can read the code.

And there are some os projects who got and got ridden this problem.

 

But then again,

not everyone is a good coder who can detects this code.

And who is compiling the code,..

Edited November 29, 2018 by freyk

[Oktokolo]

Coders using node.js in general seem to really like to pile up a lot of dependencies - while giving a shit about devops security. Looks like shady folks stumbled upon news from 2013.
Another bad practice: Naively downloading and executing Docker images.

It is a bit like the big email worm epidemics - but for naive devs wich search and download the malware instead of naive users wich click on malware mailed to them.

 

Really wonder when we will see the first realworld Meltdown and Spectre exploits though. Does not look like anybody really cares about fixing that holes on millions of old CPUs. And some of that hardware design bugs should be exploitable by tricking a user to run JavaScript embedded on a web page or injected into it by targetted advertising...

Edited November 29, 2018 by Abusimplea

[stumpy]

there's malware in adverts, you see a lot if you mod minecraft, they use adfly as revenue when downloading a mod, and about 90 percent of adfly adverts are infected, so i use a adblocker, which blocks the malware infected ads, they complain that am stopping them from gaining revenue, but what revenue are they getting from an online ad site that loads there ads with malware.