Cybersecurity experts have discovered a new attack that targets Linux systems using fake programming tools. These harmful tools were shared on GitHub, a popular website where developers post and download code. Inside these fake packages was dangerous malware designed to completely erase everything on a computer’s hard drive.
How the Attack Works
The attackers used a type of programming module written in Go (Golang), a language often used by developers for creating server software. They uploaded three of these modules to GitHub, pretending they were useful tools for developers. However, once someone downloaded one of these modules, it secretly contacted another server and downloaded a harmful script without the user’s knowledge.
This script, once running, carried out a destructive command that wipes out all the data on the system’s main storage device. It replaces the existing information with zeroes, which makes the system completely unusable and all files impossible to recover. The attack is aimed directly at Linux computers and servers, and it checks to make sure it is running on a Linux system before carrying out the harmful actions.
What Was Affected
The three fake Go modules uploaded to GitHub had names that made them look like real software. They were:
• github[.]com/truthfulpharm/prototransform
Content was cut in order to protect the source.Please visit the source for the rest of the article.