Ask HN: Remote repos being used for C2 botnet, or VMS scan?

Posted by paddlepop on Sunday August 18, 2019 @05:51PM
from the ask-hn dept.

Observation: A number of external repos are having malicious looking repositories being created with the pattern ";[6 alphanum]<ScRiPt>[4 alphanum]([4 num])</;[6 alphanum]". For example ";0MhPC1<ScRiPt>r7kK(9626)</;CD4u6"

All appear to be running JFrog Artifactory

The remote repos we have identified are: http://repo.gradle.org/gradle/repo/ https://repo.datastax.com/dse/ https://maven.openflexo.org/artifactory/openflexo-deps/ https://qasymphony.jfrog.io/qasymphony/repo/

Possible Scenarios:

1 - Someone is running some kind of daily vulnerability scan against these repos. This is inadvertently testing the create repo name field for XSS which is then submitted, creating the repo.

2 - Repos are being created for use as a botnet communication channel - pretty clever in my opinion to use remote repos as a means to bypass internal network restriction.

Any owners able to tell if the creator is distributed?

( 1 comment | 2 points | on HN )

Re:Ask HN: Remote repos being used for C2 botnet, or VMS scan? by Jlleitschuh on Monday August 19, 2019 @01:46PM (#20739942)

As a company working for one of the companies impacted by this weirdness we are just as concerned about the potential implications here as you are. We have followed up with JFrog about this and are waiting for a response from them about this.

I'm glad others are seeing these weird things too and it's giving them pause as well.

[ Parent | on HN ]