Researcher Breaches Systems of Over 35 Companies, Including Apple, Microsoft, and PayPal

A security researcher was able to breach the internal systems of over 35 major companies, including Apple, Microsoft, and PayPal, using a software supply chain attack (via Bleeping Computer).

paypal hack

Security researcher Alex Birsan was able to exploit a unique design flaw in some open-source ecosystems called "dependency confusion" to attack the systems of companies such as Apple, Microsoft, PayPal, Shopify, Netflix, Yelp, Tesla, and Uber.

The attack involved uploading malware to open source repositories including PyPI, npm, and RubyGems, which were then automatically distributed downstream into the various companies' internal applications. Victims automatically received the malicious packages, with no social engineering or trojans required.

Birsan was able to create counterfeit projects using the same names on open-source repositories, each containing a disclaimer message, and found that applications would automatically pull public dependency packages, without needing any action from the developer. In some cases, such as with PyPI packages, any package with a higher version would be prioritized regardless of wherever it was located. This enabled Birsan to successfully attack the software supply chain of multiple companies.

Upon verifying that his component had successfully infiltrated the corporate network, Birsan reported his findings to the company in question, and some rewarded him with a bug bounty. Microsoft awarded him its highest bug bounty amount of $40,000 and released a white paper on this security issue, while Apple told BleepingComputer that Birsan will receive a reward via the Apple Security Bounty program for responsibly disclosing the issue. Birsan has now earned over $130,000 through bug bounty programs and pre-approved penetration testing arrangements.

A full explanation of the methodology behind the attack is available at Alex Birsan's Medium page.

Top Rated Comments

hybrid_x Avatar
8 months ago
I love that ethical hackers can actually earn a decent income through bug bounty programs.
Score: 27 Votes (Like | Disagree)
icanhazmac Avatar
8 months ago
Well played sir, well played!

I'm glad companies have bounty programs to encourage the "good guys" to report vulnerabilities. I have no idea how much time he put into the exploit but 130k is a nice payday.
Score: 16 Votes (Like | Disagree)
Stephen.R Avatar
8 months ago

People put too much trust in open-source community and software and this is the price they pay.
the irony of your statement is superb.

if the packages he spoofed had been open source he wouldn’t have been able to pull it off - it worked specifically because the companies were referencing internal/private packages (thus not open source) and he was able to make fake packages with the same name, in open source package repositories.

This type of shenanigans is just another reason why you should always vendor your dependencies kids.
Score: 12 Votes (Like | Disagree)
Kabeyun Avatar
8 months ago
This reminds me of the Russians hacking SolarWinds. Don’t get to the companies, get to the software the companies use and trust. Of course the irony is that these companies are some of the same ones that have been spending years trying to teach us not to automatically trust downloaded software.
Score: 11 Votes (Like | Disagree)
Blackstick Avatar
8 months ago
Well, time to hire this guy...
Score: 9 Votes (Like | Disagree)
BootsWalking Avatar
8 months ago

People put too much trust in open-source community and software and this is the price they pay.

Open-source software, unless independently audited, have no guarantees of being secure (or even functional). Remember the disclaimer “this software is provided ‘AS IS’...”

They might even contain malicious code, since very few people will actually read the code before executing it.
The issue isn't open source - it's in the distribution model of software dependencies. This vulnerability has been known for quite some time.
Score: 7 Votes (Like | Disagree)

Top Stories

apple park drone june 2018 2

Unreleased MacBook Schematics Stolen in $50 Million Ransomware Attack on Apple Supplier

Wednesday April 21, 2021 2:47 am PDT by
As Apple held its "Spring Loaded" event where it unveiled brand new iPad Pros, a redesigned iMac, and the long-awaited release of AirTags, one of its main MacBook suppliers was undergoing a ransomware attack worth $50 million. As reported by Bloomberg, the ransomware group called REvil, publicly declared early on Tuesday that it had accessed the internal computers of Apple supplier Quanta...
apple wwdc app developer academy global stats

Apple Further Expands Developer Academy Program With First Detroit Applications Opening This Week

Wednesday May 12, 2021 5:39 am PDT by
Apple today released an update on the progress of the Apple Developer Academy program, ahead of applications for the new Detroit site opening this week. The Apple Developer Academy sets out to provide enrolled students with app development training and entrepreneurial skills. Apple offers two different training programs: 30-day foundation courses that cover specific topics, such as an...
maxresdefault

Security Researcher Earns $100,000 for Safari Exploit in Pwn2Own Hacking Contest

Thursday April 8, 2021 2:36 pm PDT by
Each year, the Zero Day Initiative hosts a "Pwn2Own" hacking contest where security researchers can earn money for finding serious vulnerabilities in major platforms like Windows and macOS. This 2021 Pwn2Own virtual event kicked off earlier this week and featured 23 separate hacking attempts across 10 different products including web browsers, virtualization, servers, and more. A three-day...
jamf malware secret screenshots

macOS Big Sur 11.4 Addresses Vulnerability That Could Let Attackers Take Secret Screenshots

Monday May 24, 2021 5:26 pm PDT by
macOS Big Sur 11.4, which was released this morning, addresses a zero-day vulnerability that could allow attackers to piggyback off of apps like Zoom, taking secret screenshots and surrepetiously recording the screen. Jamf, a mobile device management company, today highlighted a security issue that allowed Privacy preferences to be bypassed, providing an attacker with Full Disk Access,...
airdrop logo

Researchers Discover AirDrop Security Flaw That Could Expose Personal Data to Strangers

Friday April 23, 2021 4:36 am PDT by
AirDrop is a feature that allows Apple devices to securely and conveniently transfer files, photos, and more between each other wirelessly. Users can share items with their own devices, friends, family, or even strangers. The convenience and ease of use, however, may be undermined by a newly discovered security flaw. Researchers at TU Darmstadt have discovered that the process which AirDrop...
14

iOS 14.5 to Make Zero-Click Attacks 'Significantly Harder'

Monday February 22, 2021 9:05 am PST by
Apple's impending iOS and iPadOS 14.5 update will make zero-click attacks considerably more difficult by extending PAC security provisions, according to Motherboard. Apple has made a change to the way in which it secures its code in the latest betas of iOS 14.5 and iPadOS 14.5 to make zero-click attacks much harder. The change, spotted by security researchers, has now been confirmed by...
Apple car wheel icon feature triad

Apple Seen in Vehicle Supply Chains, but It May Be Exploring Taxi Service or Car Platform Instead

Monday May 24, 2021 6:49 am PDT by
Apple is intensely researching all aspects of car engineering and manufacturing, but there are growing questions around what form Apple's vehicle project may take, according to a report from the Wall Street Journal. Speaking to the Wall Street Journal, Peter Fintl, the director of technology and innovation for Capgemini Engineering Germany, explained that Apple's movement in vehicle supply...
apple bitcoin hack

Florida Teenager to Spend 3 Years in Prison for Twitter Hack That Affected Apple

Tuesday March 16, 2021 11:54 am PDT by
A Florida teenager who was accused of being the "mastermind" behind a July 2020 Twitter hack that affected Apple has agreed to a plea deal that will see him spending three years in prison, according to the Tampa Bay Times. Graham Ivan Clark, alongside others, compromised the Twitter accounts of 130 prominent companies and individuals to solicit Bitcoin, scamming people out of more than...
project x feature blue

Former Apple Employee Responds to Lawsuit Accusing Him of Leaking Trade Secrets to Media

Tuesday May 4, 2021 9:14 am PDT by
Last month, Apple filed a lawsuit against Simon Lancaster, a former employee who allegedly used his senior position within the company to steal "sensitive trade secret information" that he then provided to a reporter. Lancaster responded to the complaint this week in California court. In his formal answer, obtained by MacRumors, Lancaster denied that he abused his position and trust within...
microsoft teams

Microsoft Teams Gains System Audio Sharing Option, macOS Notification Center Integration Coming Soon

Thursday April 22, 2021 1:21 am PDT by
Microsoft Teams for macOS has been updated so that other people on a video call are able to hear a Mac's system audio when another user is screen sharing. Teams for Windows has always offered users the option of system audio sharing. Today's update brings parity to the Mac app by including the optional feature, which is likely to be welcomed by teachers and businesses. Microsoft also says ...