Developing free and open source software can be a thankless experience. Most folks do it because it’s something they’re passionate about, with the only personal benefit being the knowledge that there are individuals out there who found your work useful enough to download and install. So imagine how you’d feel if it turns out somebody was playing around with the figures, and the steady growth in the number of installs you thought your software had turned out to be fake.

That’s what happened just a few days ago to OctoPrint developer [Gina Häußge]. Although there’s no question that her software for remotely controlling and monitoring 3D printers is immensely popular within the community, the fact remains that the numbers she’s been using to help quantify that popularity have been tampered with by an outside party. She’s pissed, and has every right to be.

[Gina] discovered this manipulation on June 26th after taking a look at the publicly available usage stats on data.octoprint.org. She noticed that an unusually high number of instances appeared to be running an old OctoPrint release, and upon closer inspection, realized what she was actually seeing was a stream of bogus data that was designed to trick the stat counter. Rolling back the data, she was able to find out this spam campaign has been going on since late 2022. Tens of thousands of the users she thought she’d gained over the last two years were in fact nothing more than garbage spit out by some bot. But why?

Here’s where it gets interesting. Looking at the data being reported by these fake OctoPrint instances, [Gina] could tell the vast majority of them claimed to be running a specific plugin: OctoEverywhere. The perpetrators were clever enough to sprinkle in a random collection of other popular plugins along with it, but this specific plugin was the one most of them had in common. Sure enough this pushed OctoEverywhere to the top of the charts, making it seem like it was the most popular plugin in the community repository.

So what do the developers of OctoEverywhere have to say for themselves? In a statement that [Gina] posted on the OctoPrint blog, they claim they were able to determine a member of the community had performed the stat manipulation of their own accord, but as of this writing are unwilling to release this individual’s identity. A similar statement now appears on the OctoEverywhere website.

On June 27th, Gina Häußge, the developer behind OctoPrint, informed us of an incident involving the OctoPrint usage stats. Gina had observed that the stats were being manipulated to boost OctoEverywhere’s rankings.

We took the report very seriously and quickly started an investigation. Using private community channels, we determined a community member was responsible for manipulating the OctoPrint stats. We had a private conversation with the individual, who didn’t realize the impact they were having but apologized and promised never to do it again.

From a journalistic perspective, it would be inappropriate for us to leap to any conclusions based on the currently available information. But we will say this…we’ve heard more convincing stories on a kindergarten playground. Even if we take the statement at face value, the fact that they were able to figure out who was doing this within 48 hours of being notified would seem to indicate this person wasn’t exactly a stranger to the team.

In any event, the bogus data has now been purged from the system, and the plugin popularity charts are once again showing accurate numbers. [Gina] also says some safeguards have been put into place to help prevent this sort of tampering from happening again. As for OctoEverywhere, it slid back to its rightful place as the 6th most popular plugin, a fact that frankly makes the whole thing even more infuriating — you’d think legitimately being in the top 10 would have been enough.

On Mastodon, [Gina] expressed her disappointment in being fooled into thinking OctoPrint was growing faster than it really was, which we certainly get. But even so, OctoPrint is a wildly popular piece of software that has become the cornerstone of a vibrant community. There’s no question that her work has had a incredible impact on the world of desktop 3D printing, and while this turn of events is frustrating, it will ultimately be little more than a footnote in what is sure to be a lasting legacy.

La società di sicurezza Outpost24 ha rilevato l’attività di un nuovo gruppo chiamato Unfurling Hemlock, che infetta i sistemi target con più malware e distribuisce centinaia di migliaia di file dannosi.

I ricercatori descrivono questo metodo di infezione come una “bomba a grappolo di malware”, che consente agli aggressori di utilizzare solo un pezzo di malware, che poi infetta ulteriormente il computer della vittima.

Secondo la società, l’attività di Unfurling Hemlock è iniziata nel febbraio 2023 e i ricercatori hanno scoperto più di 50.000 file contenenti tali “bombe a grappolo”.

Va notato che più della metà di tutti gli attacchi Unfurling Hemlock erano mirati a sistemi negli Stati Uniti, ma un’attività relativamente elevata è stata osservata anche in Germania, Russia, Turchia, India e Canada.

Gli attacchi iniziano con l’esecuzione del file WEXTRACT.EXE, che raggiunge i dispositivi di destinazione tramite e-mail dannose o tramite downloader di malware a cui Unfurling Hemlock ha accesso (si presuppone che gli hacker collaborino con i loro operatori).

Il file eseguibile dannoso contiene file CAB nidificati, in ogni livello dei quali vengono archiviati un campione di malware e un altro file compresso. Ad ogni fase, una sorta di malware viene installato sul computer della vittima e, nella fase finale, tutti i file estratti vengono eseguiti in ordine inverso (ovvero, l’ultimo estratto viene eseguito per primo).

Gli specialisti di Outpost24 scrivono di aver osservato da quattro a sette fasi di disimballaggio, ovvero la quantità di malware utilizzata negli attacchi Unfurling Hemlock varia.

Il caricamento simultaneo di molti payload in un sistema compromesso fornisce un elevato livello di ridondanza per gli aggressori, offrendo loro maggiori opportunità di prendere piede nel sistema e monetizzare. Nonostante il rischio maggiore di essere rilevati in questi casi, molti hacker seguono una strategia aggressiva simile, sperando che almeno una parte del loro malware sopravviva al processo di pulizia del sistema.

Tra i payload di Unfurling Hemlock, i ricercatori hanno notato: gli stealer Redline, RisePro e Mystic Stealer, il caricatore personalizzato Amadey, il loader e la backdoor SmokeLoader, l’utility Protection Disabler progettata per disabilitare Windows Defender e altre soluzioni di sicurezza, lo strumento per l’offuscamento e l’occultamento dei payload Enigma Packer, l’utilità di controllo delle prestazioni, utilizzata per controllare e registrare l’esecuzione di malware, nonché utilità che utilizzano strumenti Windows standard (wmiadap.exe e wmiprvse.exe) per raccogliere informazioni di sistema.

Anche se i ricercatori non entrano nei dettagli su come Unfurling Hemlock monetizza i suoi attacchi, si può presumere che il gruppo venda ad altri criminali i registri degli stealer e l’accesso alle macchine hackerate.

Apparentemente, i partecipanti a Unfurling Hemlock si trovano in uno dei paesi dell’Europa orientale. Ciò è indicato dalla presenza della lingua russa in alcuni campioni di malware, nonché dall’uso dell’Autonomous System 203727, che è associato all’hosting popolare tra i gruppi di hacker in questa regione.

L'articolo Nuova Minaccia Malware: Unfurling Hemlock Distribuisce Migliaia di File Dannosi in Pochi Secondi! proviene da il blog della sicurezza informatica.

Anche gli accademici si sono finalmente accorti che i I LLM sono motori per produrre stronzate; il casino dietro l'FSE 2.0 che va alla deriva verso la cospirazione. Piccoli momenti di orgoglio, rigorosamente a panino fra fegato grosso e livelli preoccupanti di cristomadonio.

spreaker.com/episode/dk-8x33-o…