What other package managers are vulnerable to typo squatting attacks?

Posted on Do 30 Juni 2016 in Security • Tagged with security, Typosquatting, nuget, cargoLeave a comment

In my last blog post about typosquatting package managers I discussed my findings about attacking the programming language package managers from rubygems.org, PyPi and npmjs.com.

This blog contribution generated quite some interest and people subsequently asked themselves whether other package managers might also be vulnerable to this hybrid attack (typosquatting involves a technical and psychological attack vector). During the time I wrote my thesis, I encountered some other package managers. A very good overview of some of the most recent package managers gives the github showcase page about ...

Continue reading

Typosquatting programming language package managers

Posted on Mi 08 Juni 2016 in Security • Tagged with PyPi, Npmjs.com, rubygems.org, security, TyposquattingLeave a comment

Edit: It seems that the blog post and the thesis caused quite some interest. Please contact me under the following mail address, since my mail server on this VPS is constantly down :/ tschachn [|[at]|] hu-berlin [[|dot|]] de

In this blog post I will show how to use the neat JavaScript library chart.js with the well-known Python web-framework Django. As a sample data set I will make use of my workout progress data between May 2016 and August 2016.

  • 17000 computers were forced to execute arbitrary code by typosquatting programming ...
Continue reading