First-Ever Banking Sector Hacks | Open-Source Software Under Siege!
Channel: Hacking Space Frontier
Date: 2023-07-25

Two banks experienced open-source software supply chain attacks recently, marking the first of their kind. The attacks involved uploading malicious scripts to the npm open-source software platform. In one incident, infected packages were posted, containing scripts that decoded encrypted files and downloaded malware onto targeted computers, while the attacker posed as a bank employee on a fake LinkedIn page. In the other attack, hackers planted dormant malicious code on a bank's login page, intercepting login data and transmitting it to a remote location when activated. Checkmarx researchers discovered and removed the malicious packages, but they anticipate a continued trend of attacks against the banking sector's software supply chain. This highlights growing concerns about the safety of open-source software. In response to a similar vulnerability in Log4j, the House Homeland Security Committee approved the Securing Open Source Software Act to ensure the safety of open-source software used by government and critical infrastructure entities.