sb-au logo
Story image

Malware campaign targets open source developers on GitHub

31 Mar 2017

Be on your guard if you’re a developer who uses GitHub – someone could be trying to infect your computer with malware.

Reports have emerged that malicious hackers are attempting to infect open source programmers’ computers with a Trojan horse, by launching a targeted malware campaign via email against GitHub developers.

The attack, which was first noticed in January, typically arrives in the form of a flattering email offering programming work:

Hey. I found your software is online. Can you write the code for my project? Terms of reference attached below. The price shall discuss, if you can make. Answer please.

Other, more recent sightings, have seen the attackers be a little less curt in their approach:

Hello,

My name is Adam Buchbinder, I saw your GitHub repo and i’m pretty amazed. The point is that i have an open position in my company and looks like you are a good fit.

Please take a look into attachment to find details about company and job. Dont hesitate to contact me directly via email highlighted in the document below.

Thanks and regards, Adam.

Hungry programmers, keen to keep themselves in a steady supply of pizza and Jolt cola, and flattered by the praise, may find it only too tempting to click on the poisoned attachment in the belief that they are being offered some genuine work.

The attached file, which is in an archive format, has been seen to contain a boobytrapped Word document designed to install further malicious code onto its victim’s PC.

The malware, called Dimnie by Palo Alto researchers, is detected by ESET security products as VBA/TrojanDownloader.Agent.CLB.

If it successfully manages to infect a target’s computer, the Trojan can spy upon the PC’s activity – logging keystrokes, taking screenshots, and stealing information. Someone unknown is now spying on the activities of a programmer working on open source software, potentially stealing their passwords and perhaps meddling with the open source code that is being published online.

What makes this latest version of the Dimnie Trojan more sophisticated is its sophisticated methods of camouflaging its behaviour, in an attempt to avoid its suspicious data exfiltration being picked up by security products which might be running on the coder’s network.

In a final flourish of panache, the Trojan is even capable of self-destructing, destroying evidence that it was ever present on the developer’s PC.

Speculation is sure to mount as to the motivations of whoever is targeting developers who use GitHub, but it seems likely that the masterminds of this attack are doing so to gather information and perhaps steal credentials that could help them access other businesses for whom the developers may be working. Furthermore, we shouldn’t dismiss the possibility that the attackers are interested in secretly introducing weaknesses into coding projects under the guise of a trusted, legitimate programmer.

These targeted attacks are a healthy reminder to all computer users – however technical – that they should always think twice about clicking on unsolicited attachments.

Article by Graham Cluley, independent security analyst, welivesecurity.

Link image
Getting customer identity & access management right first time
Logins, account verification, single sign-on... they are essential for securing the customer experience. Learn about the five pillars of CIAM so you make no mistakes.More
Story image
Palo Alto Networks turns attention to supporting remote workforces
"We’re working with more organisations to pivot their security architecture and move towards a cloud-delivered security model that can safely connect any user, to any application, from anywhere.”More
Story image
Ping Identity announces appointment of new VP of R&D
In his new role as head of research and development, Burke will be expected to drive product strategy and development across Ping Identity’s entire suite of solutions.More
Story image
Veeam reports growth as demand for modern data protection increases
“Even with the unforeseen challenges and circumstances that began in early 2020, Veeam continued its rapid growth with its second consecutive year of bookings over $1 billion."More
Story image
Kaseya acquires RocketCyber to bring SOC solutions to more businesses
"With this acquisition, we've doubled down on our security investments to provide our customers with access to experts who can continuously monitoring their IT environments without the cost and complexity of disparate tools.”More
Story image
CyberCX and AustCyber launch platform to boost Aus cybersecurity industry
"Australia has some of the best cyber talent in the world, but we need to expand the supply of talent coming through the pipeline if we are to have a vibrant and globally competitive economy."More