Dependency Confusion: How I Hacked Into Apple, Microsoft and Dozens of Other Companies

👇Check the thread after reading for a few bonus

Scope:

Other than the mentioned .NET bug, only one other team said the finding was out of scope, using this as a reason to reduce the bounty from P1 to P2.

We've also purposely avoided reporting to at least one program that had "internal or development services" listed as OOS
Pytosquatting:

In Python, the 'install' name of a package can be different from the 'import' name. This allows for an unique type of typosquatting attack by uploading under unclaimed import names on PyPI, where it can be downloaded by developers, or even automated tools.
I tried this out against some Google open source projects and it actually got me inside two *.corp.google.com machines.

However, just like typosquatting, this mostly relies on one-off mistakes. Google did not accept it as a valid vuln, and I fully agree with their assessment.
Fun fact: those packages are long gone from PyPI but for some reason they are still up on some sort of Chinese mirror, and I still get various callbacks from China to this day.
Finally, a brief look at how each package hosting service responded after seeing the test packages:

* npm - initially deleted a few, stopped after my intentions were clarified
* PyPI - deleted all packages, made it clear that testing this is not allowed
* RubyGems - no reaction

You May Also Like

I hate when I learn something new (to me) & stunning about the Jeff Epstein network (h/t MoodyKnowsNada.)

Where to begin?

So our new Secretary of State Anthony Blinken's stepfather, Samuel Pisar, was "longtime lawyer and confidant of...Robert Maxwell," Ghislaine Maxwell's Dad.


"Pisar was one of the last people to speak to Maxwell, by phone, probably an hour before the chairman of Mirror Group Newspapers fell off his luxury yacht the Lady Ghislaine on 5 November, 1991."
https://t.co/DAEgchNyTP


OK, so that's just a coincidence. Moving on, Anthony Blinken "attended the prestigious Dalton School in New York City"...wait, what? https://t.co/DnE6AvHmJg

Dalton School...Dalton School...rings a

Oh that's right.

The dad of the U.S. Attorney General under both George W. Bush & Donald Trump, William Barr, was headmaster of the Dalton School.

Donald Barr was also quite a


I'm not going to even mention that Blinken's stepdad Sam Pisar's name was in Epstein's "black book."

Lots of names in that book. I mean, for example, Cuomo, Trump, Clinton, Prince Andrew, Bill Cosby, Woody Allen - all in that book, and their reputations are spotless.
🌺कैसे बने गरुड़ भगवान विष्णु के वाहन और क्यों दो भागों में फटी होती है नागों की जिह्वा🌺

महर्षि कश्यप की तेरह पत्नियां थीं।लेकिन विनता व कद्रु नामक अपनी दो पत्नियों से उन्हे विशेष लगाव था।एक दिन महर्षि आनन्दभाव में बैठे थे कि तभी वे दोनों उनके समीप आकर उनके पैर दबाने लगी।


प्रसन्न होकर महर्षि कश्यप बोले,"मुझे तुम दोनों से विशेष लगाव है, इसलिए यदि तुम्हारी कोई विशेष इच्छा हो तो मुझे बताओ। मैं उसे अवश्य पूरा करूंगा ।"

कद्रू बोली,"स्वामी! मेरी इच्छा है कि मैं हज़ार पुत्रों की मां बनूंगी।"
विनता बोली,"स्वामी! मुझे केवल एक पुत्र की मां बनना है जो इतना बलवान हो की कद्रू के हज़ार पुत्रों पर भारी पड़े।"
महर्षि बोले,"शीघ्र ही मैं यज्ञ करूंगा और यज्ञ के उपरांत तुम दोनो की इच्छाएं अवश्य पूर्ण होंगी"।


महर्षि ने यज्ञ किया,विनता व कद्रू को आशीर्वाद देकर तपस्या करने चले गए। कुछ काल पश्चात कद्रू ने हज़ार अंडों से काले सर्पों को जन्म दिया व विनता ने एक अंडे से तेजस्वी बालक को जन्म दिया जिसका नाम गरूड़ रखा।जैसे जैसे समय बीता गरुड़ बलवान होता गया और कद्रू के पुत्रों पर भारी पड़ने लगा


परिणामस्वरूप दिन प्रतिदिन कद्रू व विनता के सम्बंधों में कटुता बढ़ती गयी।एकदिन जब दोनो भ्रमण कर रहीं थी तब कद्रू ने दूर खड़े सफेद घोड़े को देख कर कहा,"बता सकती हो विनता!दूर खड़ा वो घोड़ा किस रंग का है?"
विनता बोली,"सफेद रंग का"।
तो कद्रू बोली,"शर्त लगाती हो? इसकी पूँछ तो काली है"।