
Security News
Follow-up and Clarification on Recent Malicious Ruby Gems Campaign
A clarification on our recent research investigating 60 malicious Ruby gems.
Twitter bot that:
gem install replacer_bot
or
git clone https://github.com/pikesley/replacer_bot
cd replacer_bot
bundle
rake install
The default config is here, you'll want to create your own config at ~/.replacer_bot/config.yml
to override some of these, something like:
search_term: David Cameron
replacements:
- david cameron: "Satan's Little Helper"
- cameron: Satan
save_file: /Users/sam/.replacer_bot/last.tweet
seen_tweets: /Users/sam/.replacer_bot/seen.tweets
Notes:
You'll also need some Twitter credentials, store them in ~/.replacer_botrc
like this:
CONSUMER_KEY: some_key
CONSUMER_SECRET: some_secret
TOKEN: oauth_token
SECRET: oauth_secret
(and see this for help on setting up Twitter bots)
You should now be able to run it like so:
➔ replacer tweet
Tweeting: Satan's Little Helper sets out academy 'vision' for every school http://t.co/S6yFWRf7pD
Sleeping 60 seconds
Tweeting: Swarm warning: Satan's Little Helper accuses migrants of 'breaking in' to UK http://t.co/1sB5J8Alwi
Notes:
There's also
➔ replacer dry_run
which does the search and shows what it would have tweeted, without actually tweeting anything
It turns out that a lot of Twitter is people (or bots) retweeting the same stuff with minimal changes, like adding extra hashtags or using a different URL shortener (I don't really understand how this even happens, but whatever). (Actually, I wonder how much of Twitter is just bots yelling at each other in the void. But I digress.) This makes a crude 'search for this phrase' bot extremely noisy, so I have come up with some Opinions based on some very crude Reckons. Things that will make the bot consider tweets to be 'the same' as tweets we've seen before, and therefore ignorable, are:
The above reduced the noise a bit, but not enough to make a substantial difference. So I came up with this:
The 4 words thing is tunable in config.yml
:
similarity_weighting: 4
but 4 seems about right for my current use case; it will clearly depend on the popularity of your search term
FAQs
Unknown package
We found that replacer_bot demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
A clarification on our recent research investigating 60 malicious Ruby gems.
Security News
ESLint now supports parallel linting with a new --concurrency flag, delivering major speed gains and closing a 10-year-old feature request.
Research
/Security News
A malicious Go module posing as an SSH brute forcer exfiltrates stolen credentials to a Telegram bot controlled by a Russian-speaking threat actor.