rust news
6 stories
Malware injected into popular Rust packages to steal developer credentials
The Rust Security Response Team has disclosed a supply chain attack that injected malware into several popular Rust packages, turning routine software builds into a mechanism for delivering infostealer malware to developers' machines. The incident was initially reported to the Rust team by Nextron Systems' research team.
Rust Supply Chain Attack Puts Build-Time Malware in Crates with 245 Million Downloads
A supply chain attack targeting the Rust ecosystem was recently reported, involving the brief availability of malicious versions of three popular Rust crates on crates.io, the official package repository. The incident stemmed from a compromised maintainer account, which was used to publish the tainted releases. These malicious versions incorporated a build script designed to download and…
Hackers poison arrayref Rust crate to push infostealer malware
A widely used Rust library, arrayref, was compromised through its maintainer account to distribute infostealer malware during compilation, affecting developers' systems. The attack, which occurred on August 20, also impacted two other crates, append-only-vec and internment, within a 23-minute window.
DeadLock Ransomware Uses Rust and Decentralized Infrastructure
Recent reports indicate the emergence of DeadLock ransomware, a new threat notable for its implementation in the Rust programming language and its adoption of a decentralized infrastructure. This design choice reportedly enhances the ransomware's operational resilience, particularly concerning its command-and-control mechanisms and data leak operations. The group behind DeadLock is said to…
macOS Backdoor Uses Fake Messages to Evade AI Analysis
A newly identified macOS backdoor, tracked as macOS.Gaslight, employs a sophisticated technique to evade security analysis by embedding fabricated system messages designed to mislead AI-powered security tools. Researchers have assessed with high confidence that this implant is linked to North Korean state-aligned threat activity.
Bringing Rust to the Pixel Baseband
Google is implementing a new security measure for its Pixel smartphones by introducing a DNS parser written in the Rust programming language into the firmware of the cellular modem. This development is part of an ongoing effort to bolster the security posture of the devices, particularly in areas prone to complex vulnerabilities.