Researchers Uncover Ring of GitHub Accounts Promoting 300+ Backdoored Apps

'A security researcher has uncovered a ring of malicious GitHub accounts promoting over 300 backdoored Windows, Mac, and Linux applications and software libraries. The malicious apps contained code to gain boot persistence on infected systems and later download other malicious code -- which appeared to be a "sneaker bot," a piece of malware that would add infected systems to a botnet that would later participate in online auctions for limited edition sneakers. All the GitHub accounts that were hosting these files -- backdoored versions of legitimate apps -- have now been taken down. One account, in particular, registered in the name of Andrew Dunkins, hosted 305 backdoored ELF binaries. Another 73 apps were hosted across 88 other accounts. ' -- source: https://developers.slashdot.org/story/19/03/05/1351217 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

On Wed, 6 Mar 2019 09:20:56 +1300, Peter Reutemann quoted:
'One account, in particular, registered in the name of Andrew Dunkins, hosted 305 backdoored ELF binaries.'
Interesting fact that GitHub isn’t just for source code, it can be used to offer up binary files too. I wonder if GitHub will feel the need to crack down on this ...
participants (2)
-
Lawrence D'Oliveiro
-
Peter Reutemann