Skip to content
Industry — Finance — All about cybersecurity. — fintech — All about technology.

Malicious software assaults are being ceased by PyPl by preventing access to a large number of outdated domain names.

Attempts at domain resurrection should face increased challenges in their execution

,   and  Administrator
2 min read
Stopping malicious attacks from hundreds of outdated domain names on PyPl
Stopping malicious attacks from hundreds of outdated domain names on PyPl

Malicious software assaults are being ceased by PyPl by preventing access to a large number of outdated domain names.

In the digital world, the Python Package Index (PyPI) has become a target for a new type of attack known as domain resurrection attacks. These malicious activities exploit the trust users have in PyPI, putting numerous accounts at risk.

Threat actors take advantage of expired custom domains previously owned by legitimate package maintainers. They can use these resurrected domains to receive password reset emails for the maintainer's PyPI account and push tainted updates containing malware.

To combat this threat, PyPI has taken several measures. The platform now checks for expired domains as part of its package manager to combat domain resurrection attacks. Moreover, since June 2022, PyPI has unverified almost 2,000 email addresses due to these changes.

To protect your PyPI account, users are advised to take the following steps:

  1. Enable Two-Factor Authentication (2FA): Enabling 2FA adds an extra authentication layer beyond email access, reducing the risk that attackers who gain control of expired domains can reset passwords or hijack accounts.
  2. Add a second verified email address from a well-established, independent domain (e.g., Gmail): PyPI recommends users add a backup email address verified from another prominent provider to prevent lockout if a primary custom domain expires or is seized by an attacker.

In addition to these measures, it's crucial to secure the backup email with 2FA and maintain layered security across all related services using the same email addresses. This approach ensures that attackers cannot exploit multiple account recovery vectors during domain resurrection campaigns.

PyPI's admin, Mike Fiedler, stated that these changes improve PyPI's overall account security posture. The recommended email providers for added security are Gmail or Outlook.

Remember, prevention is better than cure. By following these guidelines, you can significantly reduce the risk of account hijacking via domain resurrection attacks on PyPI. PyPI particularly advises this action in cases where the account only has one verified email address from a custom domain name.

Stay secure, and happy coding!

Read also:

Related

Latest