Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Sortinghat is a unqiue Ruby gem that allows AWS AutoScaling instances to name themselves.
We all understand that naming your cattle is bad, they shouldn't be pets.. but hostnames are handy and readable, and [insert reason].
When the Sorting Hat is given specific arguments, it can find the gaps in current prefixes or +1 from the last current prefix and name the instance accordingly; along with updating Route53.
It follows a specific pattern for hostnames/fqdn:
[client]-[environment]-[type][suffix]-[region].[domain].com.
For example:
nike-prod-nginx09-us-west-2.prod-nike.com
Install however you please to your AMI(s) with:
$ gem install sortinghat
The gem itself was developed under Ruby 2.0.0 to work with CentOS 7.
It requires the following gems:
During actually usage, the gem requires that the instance have the following IAM actions allowed via policy:
Note: The Sorting Hat requires root privileges to write to files under /etc/.
Have cloud-init, cfn-init, or [x/y/z], issue the following command:
$ sortinghat -c [client] -e [environment] -t [type] -r [region] -z [domain]
Note: [domain] should be in the format of [domain].com, just like the AWS Console reports for the HostedZone. No need to add the trailing dot, it will be added should you forget.
The Sorting Hat will log to syslog for information.
The Sorting Hat may be re-run, provided you remove the empty file located at '/etc/.sorted'.
Need to develop on an EC2 instance with metadata available or spoof it somehow.
Clone:
$ git clone https://github.com/praymann/sortinghat
Execute:
$ bundle install
Run:
$ bundle exec bin/sortinghat -h
Kudos to nerk01 for help and guidance with anything Ruby! He is also a contributor to this project.
Kudos to jrbeilke for help and guidance with Ruby and the "rubber duck debugging" support.
Bug reports and pull requests are welcome on GitHub at https://github.com/praymann/sortinghat.
The gem is available as open source under the terms of the MIT License.
FAQs
Unknown package
We found that sortinghat demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.