Connect with us

Tech News

GitHub suffers from over 100K infected repos – Developer News

Published

on

wp header logo 172

ARTICLE
LOG IN
b8c5d238e1fddd55d8a0064f1a534ba5?s=100&d=mm&r=g Ryan Daws is a senior editor at TechForge Media, with a seasoned background spanning over a decade in tech journalism. His expertise lies in identifying the latest technological trends, dissecting complex topics, and weaving compelling narratives around the most cutting-edge developments. His articles and interviews with leading industry figures have gained him recognition as a key influencer by organisations such as Onalytica. Publications under his stewardship have since gained recognition from leading analyst houses like Forrester for their performance. Find him on X (@gadget_ry) or Mastodon (@[email protected])
Developers face a major security threat as over 100,000 repositories on GitHub are infected with malicious code.
This resurgence of a malicious repo confusion campaign – detected by Apiiro’s security researchers – has impacted countless developers who unwittingly use repositories they believe to be trusted but are, in fact, compromised.
Similar to dependency confusion attacks – which exploit package managers – repo confusion attacks rely on human error, tricking developers into downloading malicious versions instead of legitimate ones. 
Malicious actors clone existing repositories, infect them with malware loaders, upload them with identical names to GitHub, and then automatically fork them thousands of times—spreading them across the web through forums and other channels.
Once developers use these infected repos, the hidden payload unpacks layers of obfuscation—executing malicious Python code and binary executables. This modified code – often a version of BlackCap-Grabber – collects sensitive data such as login credentials and browser information, sending it to the attackers’ command-and-control server.
While GitHub swiftly removes most of the forked repos, automated detection misses many, allowing thousands to persist.
The removal process – which targets fork bombs – occurs within hours of upload, making it challenging to document the extent of the attack. The sheer volume of repositories involved in this campaign, combined with their automation, poses a significant challenge to detection and mitigation efforts.
This malicious campaign began in May 2023 with the spread of malicious packages on PyPI and highlights a broader trend of malware targeting software supply chains. As attention on package managers increases, attackers are shifting their focus to source control managers like GitHub.
(Photo by Roman Synkevych on Unsplash)
See also: Python packages caught using DLL sideloading to bypass security
Want to learn more about cybersecurity and the cloud from industry leaders? Check out Cyber Security & Cloud Expo taking place in Amsterdam, California, and London. The comprehensive event is co-located with other leading events including BlockX, Digital Transformation Week, IoT Tech Expo and AI & Big Data Expo.
Additionally, the upcoming Cloud Transformation Conference is a free virtual event for business and technology leaders to explore the evolving landscape of cloud transformation. Book your free virtual ticket to explore the practicalities and opportunities surrounding cloud adoption.
Explore other upcoming enterprise technology events and webinars powered by TechForge here.
Tags: apiiro, cyber security, cybersecurity, dependency confusion, github, hacking, infosec, malware, repo, repositories, security
Your email address will not be published. Required fields are marked *





Developer Tech offers the latest app developer news and strategy. We cover topics, including coding, monetisation, billing, marketing and design, within the app development industry. We aim to help developers by providing top-class practical content across many issues.
Founded in 2011, we provide a channel for expert, brands and thought leaders to share content and engage with other industry professionals around the world.
Please follow this link for our privacy policy.
Copyright © 2024 Developer Tech News. All Rights Reserved.
Not subscribed / a member yet?
"*" indicates required fields
Step 1 of 3
Already a member / subscriber?
digital transformation week popup ad

source

Tech News

Capitalizing on technology budgets: A CIO’s story – CIO

Published

on

By

wp header logo 39 scaled

In today’s competitive business setting, enterprises are constantly under pressure to maintain profitability amid challenging economic conditions. While traditional approaches to bridging the profitability gap, like layoffs and budget cuts, can harm company culture, an innovative and practical alternative is capitalizing on technology budgets.
By leveraging data-driven methods, businesses can optimize and reclaim operating capital from their extensive technology budgets, reducing expenses without resorting to drastic measures.
Advice from finance leaders often casts a negative shadow on non-finance leaders in budget decisions and planning. However, it’s important to remember that headcount and budget cuts are not the only strategies to streamline costs. Capitalizing on technology budgets presents a viable solution. This strategy enables Chief Information Officers (CIOs) to reduce costs without resorting to layoffs or budget cuts while retaining staff and continuing projects that might be axed.
Tech and tech-adjacent expenditures, including categories like Customer Relationship Management (CRM), cloud and data services, billing, software, network storage, business process outsourcing, telecommunications services, and data center technology, represent significant expenses. This pool is ripe for reduction, resulting in substantial savings.
Recently, I had an in-depth conversation with Tracy Mozena, the CIO of Atlantic Aviation, who shared her journey in navigating technology budgets. Atlantic Aviation, a leader in aviation ground support services, is a compelling case study illustrating the significant financial benefits that organizations can reap from capitalizing on technology budgets.
Tracy ran IT for a management company that owned five businesses and made technology decisions for the group of companies to benefit from economies of scale. The impact of the COVID pandemic triggered the divestment of all those companies, and Atlantic Aviation was the second to last entity sold and acquired by KKR. Tracy came along with Atlantic Aviation after that transaction. 
Technology decisions made for the combined five companies weren’t necessarily the best strategy moving forward for Atlantic Aviation after its divestiture. They brought in Deloitte to evaluate the situation, which, after their analysis, recommended quite a bit of outsourcing. Tracy’s team of around 30 people couldn’t support that model. 
Atlantic Aviation’s CFO brought in AIQ, whom he had worked with in the past, to evaluate their technology expenditure. Atlantic Aviation’s procurement team, which consists of only two people, is focused mainly on purchasing fuel — the business’ most considerable cost — not on IT. This move deepened Tracy’s initial concern about changing too much too fast. However, she was consistently impressed with AIQ’s data-driven process and the significant cost savings they drove. It convinced her that there was potential for substantial savings. It was encouraging that a small number of technology categories considerably impacted expense savings.
AIQ’s engagement with Atlantic Aviation encompassed a high-level assessment of technology expenditure, identification of technology categories with the highest potential savings, executing numerous procurement auctions, and delivering negotiated contracts ready for execution. Tracy appreciated that cost wasn’t the only focus, but also SLAs and support. She needed to consider the ability of her small team to support and roll out any changes. AIQ even helped them find the right partner at the right price and level of support. Tracy thought the results were remarkable:
Atlantic Aviation’s story underscores several vital points:
When I asked Tracy what advice she would give other CIOs, she said, “Be open to using a company like AIQ. Don’t be resistant to opening up your contracts and costs to inspection. Things change so fast in tech that a decision you made even two years ago might be worth evaluating as competition and pricing dynamics change quickly. Also, you must be willing to do the work after all the negotiations because changing technology in an enterprise is hard work and time-consuming. Don’t bite off more than you can chew.”
By following Atlantic Aviation’s lead and implementing a data-driven approach to technology budget capitalization, enterprises can achieve significant cost savings without sacrificing quality or service. This approach can free up capital for strategic investments that drive growth and profitability.
David Mario Smith is founder and principal analyst at InFlow Analysis. Dave is a Gartner veteran of over 16 years and an IT industry professional with 20 years of experience in the collaboration and workplace technology markets, having helped thousands of enterprises with their collaboration and workplace strategies. Dave’s career spans from being a senior analyst at Gartner to research director and lead analyst at Aragon Research.
Sponsored Links

source

Continue Reading

Tech News

UnitedHealth Group CEO blames hack on aged technology systems – Roll Call

Published

on

By

wp header logo 38

UnitedHealth Group CEO Andrew Witty on Wednesday blamed outdated technology for a hack that likely exposed the health care information of millions of people and crippled claims processing for thousands of providers for several weeks.
During an appearance at a Senate Finance Committee hearing — his first before lawmakers since the Change Healthcare hack in February — Witty noted that UnitedHealth Group acquired Change Healthcare in 2022 and was still in the process of upgrading and modernizing its dated technology when the attack happened.
Senators didn’t buy that explanation. Finance Chair Ron Wyden, D-Ore., accused UnitedHealth Group of failing its customers by not employing widely recommended cybersecurity practices, like multifactor authentication, which requires users to log into systems with more information than just a password. 
“I think your company, on your watch, let the country down,” Wyden said. “This hack could have been stopped with cybersecurity 101.”
UnitedHealth Group discovered the attack in late February and took systems offline to prevent malware from spreading. That resulted in thousands of providers being unable to receive payments for claims that are processed by Change Healthcare. Witty also said Wednesday he personally made the decision to pay a $22 million ransom to the hackers. 
Witty said Change Healthcare “unfortunately and frustratingly” did not yet have multifactor authentication on its servers despite it being a company-wide requirement at UnitedHealth Group.
“We’re trying to dig through exactly why that server had not been protected by multifactor authentication,” he said. “I’m as frustrated as anybody about that fact.”
And because of the “age of the technology,” backup systems — called “redundancies” — that were intended to mitigate the impact of an attack were also compromised, Witty said. 
“Multifactor authentication is vital for prevention, but redundancies… help the company get back on its feet,” Wyden said. “This company flunked both.”
Witty said that as of Wednesday, all external-facing systems have multifactor authentication. It has also hired third parties to review its technology to ensure it is secure against attacks.
“This was some basic stuff that was missed,” said Sen. Thom Tillis, R-N.C., waving a copy of a book titled “Hacking for Dummies.”
Wednesday marked the first time Witty publicly answered questions about the attack. Later, Witty appeared before the House Energy and Commerce Subcommittee on Oversight and Investigations.
The long-term consequences and fallout are still largely unknown, with Witty saying the hack could potentially impact a “substantial proportion” of Americans, though what type of information was obtained is still unclear. 
Files obtained by the hackers contained protected health information and personally identifiable information, but there is no evidence yet doctor’s charts or full medical histories were stolen, Witty said.
Witty said he expects UnitedHealth to notify impacted patients within the “next several weeks.”
“We want to try and avoid piecemeal communication and it’s our top priority to get this done just as fast as possible,” he said.
Still, senators pressed Witty to act more quickly.
“Ten weeks is way too long for millions of Americans to not know that their records may be available to criminals on the dark web,” said Sen. Maggie Hassan, D-N.H. Witty said UnitedHealth Group is offering two years of free credit monitoring to potentially impacted patients.
While Witty said claims processing is mostly back to normal, that assertion was challenged by senators who said they are still getting complaints from providers in their states.
“There is a backlog that many of our providers and hospitals have from nine weeks of not being able to get in and make these claims,” said Sen. Marsha Blackburn, R-Tenn.
Witty said that while UnitedHealth is processing payments instantly, other insurers may not pay until 30 days after a claim has been received.
“That would explain why you’re continuing to see that delay,” Witty said, noting providers can still apply for interest-free loans from UnitedHealth that don’t need to be paid back until their cash flows are back to normal.
The attack — considered the largest to hit the U.S. health care industry — has spurred calls for Congress and the Biden administration to implement tougher cybersecurity requirements. 
Wyden has said Congress needs to pass minimum cybersecurity requirements for the health care sector. Wyden also said federal agencies need to fast-track new cybersecurity rules for Americans’ private medical records.
“We’re making a huge mistake by not having federal rules of the road on data privacy and data breaches and how these enterprises have to mitigate these things,” Tillis said. “We really got to work on it because now we’ve got a patchwork of over a dozen states that are doing it differently.”
On Wednesday afternoon, the Energy and Commerce Oversight and Investigations Subcommittee covered similar ground but focused particularly on UnitedHealth Group’s large footprint in the health care sector due to decades of acquisitions. 
Members questioned whether UnitedHealth Group was taking advantage of the attack’s negative financial impacts on providers to acquire more practices. 
Witty replied that the company has only acquired one practice in Oregon — an acquisition that was initiated before the attack. 
Still, Rep. Earl L. “Buddy” Carter, R-Ga., railed against the company’s use of vertical integration, in which it has acquired physician practices, pharmacy benefit managers and other players in the health care system.
“Let me assure you that I’m going to continue to work to bust this up,” Carter said. “This vertical integration that exists in health care in general has got to end.” 
Several members also took the opportunity to chide United Healthcare’s use of prior authorization, which Witty said resumed for its Medicare Advantage plans April 15. 
The company should “carefully review how that prior authorization” has affected patient outcomes, said Rep. John Joyce, R-Pa.

source

Continue Reading

Tech News

Sam Altman says helpful agents are poised to become AI’s killer function – MIT Technology Review

Published

on

By

wp header logo 37

Open AI’s CEO says we won’t need new hardware or lots more training data to get there.
A number of moments from my brief sit-down with Sam Altman brought the OpenAI CEO’s worldview into clearer focus. The first was when he pointed to my iPhone SE (the one with the home button that’s mostly hated) and said, “That’s the best iPhone.” More revealing, though, was the vision he sketched for how AI tools will become even more enmeshed in our daily lives than the smartphone.
“What you really want,” he told MIT Technology Review, “is just this thing that is off helping you.” Altman, who was visiting Cambridge for a series of events hosted by Harvard and the venture capital firm Xfund, described the killer app for AI as a “super-competent colleague that knows absolutely everything about my whole life, every email, every conversation I’ve ever had, but doesn’t feel like an extension.” It could tackle some tasks instantly, he said, and for more complex ones it could go off and make an attempt, but come back with questions for you if it needs to. 
It’s a leap from OpenAI’s current offerings. Its leading applications, like DALL-E, Sora, and ChatGPT (which Altman referred to as “incredibly dumb” compared with what’s coming next), have wowed us with their ability to generate convincing text and surreal videos and images. But they mostly remain tools we use for isolated tasks, and they have limited capacity to learn about us from our conversations with them. 
In the new paradigm, as Altman sees it, the AI will be capable of helping us outside the chat interface and taking real-world tasks off our plates. 
I asked Altman if we’ll need a new piece of hardware to get to this future. Though smartphones are extraordinarily capable, and their designers are already incorporating more AI-driven features, some entrepreneurs are betting that the AI of the future will require a device that’s more purpose built. Some of these devices are already beginning to appear in his orbit. There is the (widely panned) wearable AI Pin from Humane, for example (Altman is an investor in the company but has not exactly been a booster of the device). He is also rumored to be working with former Apple designer Jony Ive on some new type of hardware. 
But Altman says there’s a chance we won’t necessarily need a device at all. “I don’t think it will require a new piece of hardware,” he told me, adding that the type of app envisioned could exist in the cloud. But he quickly added that even if this AI paradigm shift won’t require consumers buy a new hardware, “I think you’ll be happy to have [a new device].” 
Though Altman says he thinks AI hardware devices are exciting, he also implied he might not be best suited to take on the challenge himself: “I’m very interested in consumer hardware for new technology. I’m an amateur who loves it, but this is so far from my expertise.”
Upon hearing his vision for powerful AI-driven agents, I wondered how it would square with the industry’s current scarcity of training data. To build GPT-4 and other models, OpenAI has scoured internet archives, newspapers, and blogs for training data, since scaling laws have long shown that making models bigger also makes them better. But finding more data to train on is a growing problem. Much of the internet has already been slurped up, and access to private or copyrighted data is now mired in legal battles. 
Altman is optimistic this won’t be a problem for much longer, though he didn’t articulate the specifics. 
“I believe, but I’m not certain, that we’re going to figure out a way out of this thing of you always just need more and more training data,” he says. “Humans are existence proof that there is some other way to [train intelligence]. And I hope we find it.”
OpenAI’s central vision has long revolved around the pursuit of artificial general intelligence (AGI), or an AI that can reason as well as or better than humans. Its stated mission is to ensure such a technology “benefits all of humanity.” It is far from the only company pursuing AGI, however. So in the race for AGI, what are the most important tools? I asked Altman if he thought the entity that marshals the largest amount of chips and computing power will ultimately be the winner. 
Altman suspects there will be “several different versions [of AGI] that are better and worse at different things,” he says. “You’ll have to be over some compute threshold, I would guess. But even then I wouldn’t say I’m certain.”
You thought he’d answer that? When another reporter in the room asked Altman if he knew when the next version of GPT is slated to be released, he gave a calm response. “Yes,” he replied, smiling, and said nothing more. 
And that's a problem. Figuring it out is one of the biggest scientific puzzles of our time and a crucial step towards controlling more powerful future models.
OpenAI's Sora has raised the bar for AI moviemaking. Here are four things to bear in mind as we wrap our heads around what's coming.
The hard work starts now.
Researchers are using generative AI and other techniques to teach robots new skills—including tasks they could perform in homes.
Discover special offers, top stories, upcoming events, and more.
Thank you for submitting your email!
It looks like something went wrong.
We’re having trouble saving your preferences. Try refreshing this page and updating them one more time. If you continue to get this message, reach out to us at [email protected] with a list of newsletters you’d like to receive.

© 2024 MIT Technology Review

source

Continue Reading

Trending