News for hackers. Stuff that matters.

A comment on ImageGlass added malware with this commit. Parent comment

Re:ImageGlass added malware with this commit by peanut_worm on Saturday January 22, 2022 @11:11AM (#30037878)
Why on earth would you be defending this? No one would ever add something like this in good faith.
[ Parent | on HN ]
Re:ImageGlass added malware with this commit by tethys on Saturday January 22, 2022 @11:21AM (#30037970)
Do we know if this was enabled by default? The Spider.com SDK License [0] appears to not allow it.

> Partner shall ensure that only Users who have expressly agreed to become nodes will actually be marked by Partner as such (…).

[0] https://www.spider.com/sdk-license

[ Parent | on HN ]
Re:ImageGlass added malware with this commit by olalonde on Saturday January 22, 2022 @11:22AM (#30037989)
Didn't read the whole code but this makes me think it was: https://github.com/d2phap/ImageGlass/commit/31c1b918165c42de...
[ Parent | on HN ]
Re:ImageGlass added malware with this commit by dymk on Saturday January 22, 2022 @11:23AM (#30038000)
The service was enabled by default. In a later commit he adds an option to opt-out of Spider being enabled.
[ Parent | on HN ]
Re:ImageGlass added malware with this commit by anaisbetts on Saturday January 22, 2022 @11:23AM (#30037997)
If he was adding it in bad faith, why would he put it on GitHub for all to see, rather than building the binaries in a private fork? Seems like this is incompetence / naivete rather than malice.
[ Parent | on HN ]
Re:ImageGlass added malware with this commit by dymk on Saturday January 22, 2022 @11:32AM (#30038078)
He put the code in a commit titled "restructure external dlls" with no reference to what it did, and in other commits includes the string "Spider" (no description of _what_ that does in the title). These weren't added as pull requests where one might expect to review proposed changes, but as direct commits to ~master.

It's not uncommon for people to put obfuscated malware into open source code See: hackers putting cryptominers and wallet stealers [0] into compromised NPM packages, or UoM campus being banned from contributing to Linux for backdooring the Linux kernel [1].

[0] https://www.trendmicro.com/vinfo/dk/security/news/cybercrime...

[1] https://www.theverge.com/2021/4/30/22410164/linux-kernel-uni...

[ Parent | on HN ]