Typosquatting Attack on ‘Requests’ Python package | Hacker News Reader

Typosquatting Attack on ‘Requests’ Python package

medium.com

62 pointsjossefharush16 comments

People have been complaining for a decade or more about how difficult it is to get something published to Maven Central (personal ID verification, documentation, and keypair crypto) but it has always existed for very good reasons.

As stodgy and unsexy as the tooling is, the bits relating to dependency resolution and publishing in Maven are the industry gold standard.

The attacker created a copy of the highly popular "requests" package with all kind of typosquatting permutations, preserved the original functionality to stay under the radar and added a cryptominer surprise!!

It was obviously wrong, but linking the original author Kenneth Rietz to the fake package is some poetic justice

https://www.reddit.com/r/Python/comments/bklroc/why_im_not_c...

First rule of un-curated package managers: pin your dependancies. (and check for typos!)

And every time this happens I will ask for the same thing, I want a platform that has library level isolation and fire-walling.

Also could all PAASs please implement outbound firewalls, I cannot understand why it's not a standard feature.

was "dependancies" an intentional typo?

Ha, no. Opps. I wish I was clever enough for it to be though...

Meanwhile, Rust beginners are told to use a highly popular crate called 'reqwest'...

Sorry for my ignorance, but is this a problem?

it could be. With the legit package named with a misspelling on purpose, users may confuse the correct spelling 'request' for the real package. in that case the typosquatting attack would actually not be a typo at all! You can't identify this attack by just looking for correct spelling, which is OPs point

It's just humorous that in some packaging ecosystems a typo opens you up for a vulnerability, where as in other packaging systems, the more official packages are intentionally given weird names.

Squatting is a problem as old as [NSFW] white house dot com versus [official] whitehouse.gov from the 2000s

Haha I had never heard of white house dot com, the screenshot[1] I got from the site is a blast.

[1] https://urlscan.io/result/e816e673-edf2-4177-9d3f-ac9a71c826...

I didn't understand the screenshot from the mining dashboard: Is there a way to estimate how much money the attacker made so far?

This is a promotional post from Checkmarx. Was anyone actually affected (who misspells "requessts" anyway), or are we making a mountain from a molehill? Also, why does PyPi allow unverified emails to serve as identity proofs?

>are we making a mountain from a molehill?

"Attacks don't stop, they only get better" is a quote i cant attribute right now but very fitting fitting to the current supply chain situation.

It is good that awareness is rising, which is why i appreciate the blog post.

In the article they mention that the wallet used for the crypto miner had an increase in traffic after the fake packages were published, so maybe?

> who misspells "requessts" anyway

People with MacBooks that have butterfly keyboards that love to repeat letters for no reason.

Reply on news.ycombinator.com