SafeDep, Socket, StepSecurity va Upwind hisobotlariga ko'ra, mashhur LiteLLM Python paketi ta'minot zanjiri hujumi doirasida buzilib, ma'lumot o'g'irlovchi va orqa eshik tarqatgan.
Buzilish PyPI g'ildiraklari va Docker tasvirlari orqali tarqatilgan LiteLLM 1.107.0 versiyasiga ta'sir qiladi. Python paketi Python Package Index (PyPI) da karantinga olingan, zararli Docker tasvirlari esa o'chirilgan.
LiteLLM xavfsizlik direktori Oliver Jensen hodisa bo'yicha tekshiruv davom etayotganini va tahdid ishtirokchisi zararli relizni e'lon qilgan asl hujum vektorini aniqlash ustida ishlayotganini aytdi.
"Biz zararli harakatlar uchta muhandisning GitHub hisoblari orqali, o'g'irlangan GitHub CLI OAuth tokenlari yordamida amalga oshirilganini aniqladik," dedi Jensen. "Tahdid ishtirokchisi bir foydalanuvchi hisobidan loyiha-relizer ishga tushirish uchun, boshqa foydalanuvchi hisobidan esa uni tasdiqlash uchun foydalangan. Hujumda ishtirok etgan barcha tokenlar bekor qilingan."
"Biz tahdid ishtirokchisi tegishli tokenlarni qanday qo'lga kiritganini hali aniqlamadik, shuning uchun bu GitHub hisoblariga boshqa kirish yo'qligini hali tasdiqlay olmaymiz. Vaqtinchalik choralar sifatida biz GitHub tashkilotimizdan barcha foydalanuvchilarni, faqat bitta (ta'sirlanmagan) foydalanuvchidan tashqari, olib tashladik."
Alohida, LiteLLM o'z GitHub tashkilotiga ishonchli havolalarni o'chirib, zararli paketlarning keyingi e'lon qilinishini oldini olish maqsadida ommaviy registrlarni yangilaganini aytdi.
Zararli versiya tahlili shuni ko'rsatadiki, u bulut ma'lumotlari, shaxsiy kalitlar, brauzer ma'lumotlari va AI ishlab chiqish vositalari uchun autentifikatsiya fayllarini yig'ish qobiliyatiga ega. Quyidagi g'ildiraklar ta'sirlangan:
- litellm-1.107.0-cp310-abi3-macosx1012x8664.whl
- litellm-1.107.0-cp310-abi3-macosx110_arm64.whl
- litellm-1.107.0-cp310-abi3-manylinux228_aarch64.whl
- litellm-1.107.0-cp310-abi3-manylinux228x8664.whl
- litellm-1.107.0-cp310-abi3-musllinux12_aarch64.whl
- litellm-1.107.0-cp310-abi3-musllinux12x8664.whl
- litellm-1.107.0-cp310-abi3-win_amd64.whl
- litellm-1.107.0.tar.gz (Yuklama fayllari yo'q, lekin o'zgartirilgan pyproject.toml mavjud)
"Birinchi yuklama — o'zini privcollect deb ataydigan ma'lumot o'g'irlovchi," dedi StepSecurity. "Ikkinchi yuklama esa har soatda GitHub o'lik nuqtasini tekshiradigan va hujumchi taqdim etgan har qanday Python kodini bajaradigan fon daemonini ishga tushiradi."
Zararli dastur Python tomonidan LiteLLM import qilinishidan oldin "cook.pth" yo'l fayli orqali ishga tushiriladi, bu esa interpretator ishga tushganda kodni avtomatik ravishda bajarish uchun mo'ljallangan. Shuni ta'kidlash joizki, xuddi shu xatti-harakatlar joriy yilning mart oyida TeamPCP ta'minot zanjiri hujumi doirasida sodir bo'lgan LiteLLM buzilishida ham kuzatilgan.
"cook.pth" fayli bitta qatorni o'z ichiga oladi: "import cook," bu esa o'z navbatida ma'lumot yig'uvchi yuklamani ishga tushiradi. Bu bulut tokenlari, ishlab chiquvchi hisoblari va shaxsiy kalitlar, AI vositalari ma'lumotlari JSON fayllari, Chromium va Firefox bilan bog'liq brauzer ma'lumotlari hamda muhit o'zgaruvchilarini yig'ishni o'z ichiga oladi.
Zararli dastur LiteLLM o'rnatmalarini nishonga olish va proksi saqlangan ma'lumotlari hamda model konfiguratsiyasini olish qobiliyatiga ham ega. Yig'ilgan ma'lumotlar GZIP-siqlangan TAR arxiviga joylanadi va HTTP POST so'rovi orqali "litellm[.]dev/healthcheck" manziliga yuboriladi.
Bundan tashqari, zararli dastur GitHub omboridagi ("github[.]com/letters9813") "domain.txt" matn fayli mazmunini o'qish, unda domen bor-yo'qligini tekshirish va, agar mavjud bo'lsa, xuddi shu o'g'irlovchini ishga tushirish, so'ngra "/codepy" ga HTTP GET so'rovini yuborish va javobni bajarish uchun mo'ljallangan. Hozirda GitHub ombori 404 xatolikni qaytarmoqda.
Zararli versiyani yuklab olgan foydalanuvchilarga toza muhitdan ochilgan ma'lumotlarni bekor qilish va almashtirish, shuningdek 1.106.2 versiyasini digest bo'yicha mahkamlash tavsiya etiladi.
The popular LiteLLM Python package has been compromised as part of a software supply chain attack that delivered a credential stealer and a backdoor, according to reports from SafeDep, Socket, StepSecurity, and Upwind.
The compromise affects LiteLLM 1.107.0, distributed through PyPI wheels and Docker images. The Python package has since been quarantined on Python Package Index (PyPI), and the malicious Docker images have been removed.
Oliver Jensen, director of security at LiteLLM, said an investigation into the incident is ongoing, and that it's still working to trace the original attack vector by which the threat actor published the malicious release.
"We have identified that the malicious actions were taken through three engineers' GitHub accounts, appearing to be by way of stolen GitHub CLI OAuth tokens," Jensen said. "The threat actor used one user's account to trigger the project-releaser run, and another user's account to approve it. All tokens which were involved in this attack have been revoked."
"We have not yet identified the mechanism by which the threat actor acquired the relevant tokens, so cannot yet assert that no further access to these GitHub accounts. As a temporary mitigation, we have removed all but one (unaffected) user from our GitHub organization."
Separately, LiteLLM said it has updated the public registries to remove any trusted links to its GitHub organization so as to prevent further publication of malicious packages.
Analysis of the malicious version shows that it's equipped to collect cloud credentials, private keys, browser data, and authentication files for AI development tools. The following wheels are affected -
- litellm-1.107.0-cp310-abi3-macosx1012x8664.whl
- litellm-1.107.0-cp310-abi3-macosx110_arm64.whl
- litellm-1.107.0-cp310-abi3-manylinux228_aarch64.whl
- litellm-1.107.0-cp310-abi3-manylinux228x8664.whl
- litellm-1.107.0-cp310-abi3-musllinux12_aarch64.whl
- litellm-1.107.0-cp310-abi3-musllinux12x8664.whl
- litellm-1.107.0-cp310-abi3-win_amd64.whl
- litellm-1.107.0.tar.gz (No payload files, but has the tampered pyproject.toml)
"The first payload is a credential stealer that calls itself privcollect," StepSecurity said. "The second payload forks a background daemon that checks a GitHub dead drop every hour and runs whatever Python the attacker serves."
The malware is launched by Python even before LiteLLM is imported through a path file ("cook.pth"), which is designed to automatically execute code when the interpreter starts. It's worth noting that the same behavior was observed in the LiteLLM compromise that took place as part of the TeamPCP supply chain attacksearlier this March.
The "cook.pth" file contains a single line, "import cook," which, in turn, launches the credential collector payload. This includes harvesting cloud tokens, developer accounts and private keys, AI tooling credential JSON files, browser data associated with Chromium and Firefox, and environment variables.
The malware is also capable of targeting LiteLLM deployments with an aim to extract the proxy's saved credentials and model configuration. The collected data is packaged into a GZIP-compressed TAR archive and sent to "litellm[.]dev/healthcheck" by means of an HTTP POST request.
In addition, the malware is designed to read the contents of a text file ("domain.txt") located within a GitHub repository ("github[.]com/letters9813"), check if it holds a domain and, if so, run the same stealer, and finally run an HTTP GET request against "/codepy" and execute the response. The GitHub repository currently returns a 404 error.
Users who have downloaded the malicious version are advised to revoke and replace exposed credentials from a clean environment and pin version 1.106.2 by digest.
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.