Name: Researcher Breaches Systems of Over 35 Companies, Including Apple, Microsoft, and PayPal
Brand: macrumors.com
SKU: macrumors-com-51
Availability: OnlineOnly

critic

Researcher Breaches Systems of Over 35 Companies, Including Apple, Microsoft, and PayPal

preview

Wednesday February 10, 2021 6:31 am PST by A security researcher was able to breach the internal systems of over 35 major companies, including Apple, Microsoft, and PayPal, using a software supply chain attack (via ).Security researcher was able to exploit a unique design flaw in some open-source ecosystems called "dependency confusion" to attack the systems of companies such as Apple, Microsoft, PayPal, Shopify, Netflix, Yelp, Tesla, and Uber.The attack involved uploading malware to open source repositories including PyPI, npm, and RubyGems, which were then automatically distributed downstream into the various companies' internal applications. Victims automatically received the malicious packages, with no social engineering or trojans required.Birsan was able to create counterfeit projects using the same names on open-source repositories, each containing a disclaimer message, and found that applications would automatically pull public dependency packages, without needing any action from the developer. In some cases, such as with PyPI packages, any package with a higher version would be prioritized regardless of wherever it was located. This enabled Birsan to successfully attack the software supply chain of multiple companies.Upon verifying that his component had successfully infiltrated the corporate network, Birsan reported his findings to the company in question, and some rewarded him with a bug bounty. Microsoft awarded him its highest bug bounty amount of $40,000 and released a white paper on this security issue, while Apple told BleepingComputer that Birsan will receive a reward via the Apple Security Bounty program for responsibly disclosing the issue. Birsan has now earned over $130,000 through bug bounty programs and pre-approved penetration testing arrangements.A full explanation of the methodology behind the attack is .Tags: , [ ]I love that ethical hackers can actually earn a decent income through bug bounty programs.Score: 27 Votes ( | )Well played sir, well played!I'm glad companies have bounty programs to encourage the "good guys" to report vulnerabilities. I have no idea how much time he put into the exploit but 130k is a nice payday.Score: 16 Votes ( | )People put too much trust in open-source community and software and this is the price they pay.the irony of your statement is superb.if the packages he spoofed had been open source he wouldn’t have been able to pull it off - it worked specifically because the companies were referencing internal/private packages (thus not open source) and he was able to make fake packages with the same name, in open source package repositories.This type of shenanigans is just another reason why you should always vendor your dependencies kids.Score: 12 Votes ( | )This reminds me of the Russians hacking SolarWinds. Don’t get to the companies, get to the software the companies use and trust. Of course the irony is that these companies are some of the same ones that have been spending years trying to teach us not to automatically trust downloaded software.Score: 11 Votes ( | )Well, time to hire this guy...Score: 9 Votes ( | )People put too much trust in open-source community and software and this is the price they pay.Open-source software, unless independently audited, have no guarantees of being secure (or even functional). Remember the disclaimer “this software is provided ‘AS IS’...”They might even contain malicious code, since very few people will actually read the code before executing it.The issue isn't open source - it's in the distribution model of software dependencies. This vulnerability has been known for quite some time.Score: 7 Votes ( | )Thursday February 10, 2022 5:40 am PST by Foxconn, the biggest assembler of iPhones, today announced that the component shortages that have constrained the supply of devices over the past two years are now showing signs of easing, Bloomberg reports. The first quarter of 2022 is said to be experiencing a "major improvement" in parts shortages, and "overall supply constraints" are expected to ease in the second half of the year, a... • Tuesday January 18, 2022 5:50 am PST by iPhones accounted for around one-fifth of all smartphone shipments in the fourth quarter of 2021, allowing Apple to reclaim first place as the biggest smartphone vendor, according to a report from Canalys. Canalys estimates that the iPhone accounted for 22 percent of worldwide smartphone shipments in the fourth quarter of 2021. The scale of Apple's shipments is thanks to strong demand for... • Thursday January 13, 2022 5:10 am PST by Apple will be among several U.S. tech giants to attend a meeting at the White House today to discuss cybersecurity and possible security threats posed by open-source software, Reuters reports. The meeting will be held by U.S. National Security Advisor Jake Sullivan and will focus on "concerns around the security of open-source software and how it can be improved." The meeting was prompted by ... • Monday February 28, 2022 5:21 pm PST by Microsoft has been testing a pre-release Apple silicon version of OneDrive since last year, and now the native version of the app is available for all OneDrive users. "We're excited to announce that OneDrive sync for macOS will now run natively on Apple silicon. This means that OneDrive will take full advantage of the performance improvements of Apple silicon," Microsoft said in an... • Wednesday February 2, 2022 2:24 am PST by A man has been sentenced to 26 months time served in prison for his involvement in a conspiracy to defraud Apple out of more than $1 million by tricking the company into replacing hundreds of fake iPhones with authentic handsets through its warranty program. Haiteng Wu, 32, a Chinese engineering post-graduate residing in McLean, Virginia, immigrated to the United States in 2013 and secured... • Monday November 8, 2021 4:28 pm PST by The United States Justice Department today announced that it has arrested Ukrainian Yaroslav Vasinskyi for his involvement with REvil, a group that executed ransomware attacks against businesses and government entities in the United States. REvil in April targeted Apple supplier Quanta Computer and stole schematics of the design of the 14 and 16-inch MacBook Pro models that were later... • Tuesday November 23, 2021 8:15 pm PST by Earlier today, Apple announced that it had filed suit against NSO Group, the firm responsible for the Pegasus spyware that has been used in state-sponsored surveillance campaigns in a number of countries. NSO Group seeks to take advantage of vulnerabilities in iOS and other platforms to infiltrate the devices of targeted users such as journalists, activists, dissidents, academics, and government... • Monday March 21, 2022 3:57 am PDT by A former Apple employee involved in the company's supply chain and responsible for making order purchases and invoicing them back to Apple has been charged by U.S prosecutors for defrauding the tech giant of over $10 million, Reuters reports. According to court filings in San Jose, California seen by Reuters, Dhirendra Prasad, a former employee in Apple's supply chain, is facing five... • Friday September 9, 2022 9:20 am PDT by Garmin has reacted to Apple's new rugged Apple Watch Ultra, saying in a tweet following the iPhone 14 and Apple Watch event that it measures battery life in "months" and "not hours," promoting its latest Enduro 2 watch for athletes. While the Apple Watch Ultra has the longest battery life of any Apple Watch to date, with Apple promising up to 36 hours of normal use and up to 60 hours with... • Sunday September 11, 2022 7:53 am PDT by Apple is set to release iOS 16 this Monday, September 12, as a free update for the iPhone 8 and newer. iOS 16 includes plenty of new features, ranging from a customizable Lock Screen to the ability to temporarily edit or unsend iMessages. To install iOS 16 when the update is released, open the Settings app on your iPhone and tap General → Software Update. After you update your iPhone to... • Friday September 9, 2022 1:37 pm PDT by With pre-orders for the iPhone 14 lineup now open, many iPhone customers will be weighing up whether or not now is the time to upgrade their device. The iPhone 14 models offer some substantial upgrades with Emergency SOS via satellite, Crash Detection, camera improvements, and more, but some customers will now be casting their mind forward to next year, when it may be a more appropriate time ... • Monday September 12, 2022 4:27 am PDT by The iPhone 14 and iPhone 14 Plus have seen "bad" pre-order results, indicating that Apple's positioning of the two new standard models may have failed, according to Apple analyst Ming-Chi Kuo. In his -14-first-weekend-online-pre-order-survey-110411040b5d"&gt;latest post on Medium, Kuo explained that the iPhone 14 Pro and iPhone 14 Pro Max have seen "neutral" and "good" pre-order results... • Sunday September 11, 2022 2:00 am PDT by There are usually multiple features that Apple is not able to finish before the first official release of a major new version of iOS, and this year looks to be no different, with a total of nine iOS 16 features now confirmed to not be present in the first public version of the new OS. Last year, SharePlay, Digital IDs in the Wallet app, and Universal Control were among a large number of... • Sunday September 11, 2022 3:58 pm PDT by Apple does not advertise battery capacities for its new iPhone 14 lineup, but MacRumors has obtained this information from a Chinese regulatory database. Three out of four iPhone 14 models feature larger battery capacities compared to the iPhone 13 lineup, with the exception being the iPhone 14 Pro Max, which is equipped with a slightly smaller battery compared to the iPhone 13 Pro Max.... • Sunday September 11, 2022 1:20 pm PDT by Following its September event focused on new iPhone and Apple Watch models, Apple often holds another event in October focused on new iPad and Mac models, and this year will likely be no exception. October is still three weeks away, but we already have a good idea of the products that would likely be announced at an event next month. For the October event, rumors suggest that Apple plans to... • Saturday September 10, 2022 2:31 pm PDT by As was the case with iPhone 13 Pro models released last year, 4K ProRes video recording on the iPhone 14 Pro and iPhone 14 Pro Max still requires a model with at least 256GB of storage, according to Apple's tech specs for the devices. ProRes video recording is limited to 1080p at 30 frames per second on iPhone 14 Pro models with a 128GB storage capacity. To record ProRes video in 4K at 30... • When will iOS 16 and iPadOS 16 be released? Here's everything we know. Apple on July 20 released iOS 15.6 and iPadOS 15.6, bringing improvements to the live sports experience in the TV app and several bug fixes. How big of an upgrade are Apple's cheapest mainstream flagship phones? Apple's latest Pro phones replace the notch with an innovative "Dynamic Island," but what else is new compared to last year's models?• • • • • September 16Apple's new high-end iPhone models with Dynamic Island camera cutout, A16 chip, 48MP main camera, and more. Pre-orders available now. September 16Apple's latest mainstream iPhone models in two sizes with A15 chip, car crash detection, satellite connectivity, and more. Pre-order now ahead of iPhone 14 launch on September 16, iPhone 14 Plus on October 7. September 16New body temperature sensors, car crash detection, and more. Pre-order now. Mid–Late 2022?Updated AirPods Pro could see some design changes like elimination of the stem.• • • • • {other_blurb}

Wednesday February 10, 2021 6:31 am PST by A security researcher was able to breach the internal systems of over 35 major companies, including Apple, Microsoft, and PayPal, using a software supply chain attack (via ).Security researcher was able to exploit a unique design flaw in some open-source ecosystems called "dependency confusion" to attack the systems of companies such as Apple, Microsoft, PayPal, Shopify, Netflix, Yelp, Tesla, and Uber.The attack involved uploading malware to open source repositories including PyPI, npm, and RubyGems, which were then automatically distributed...

Researcher Breaches Systems of Over 35 Companies, Including Apple, Microsoft, and PayPal

No article scores yet.

CRITIC REVIEWS

PUBLIC REVIEWS