Enlarge / A stack of bitcoins sits among twisted copper wiring inside a communications room at an office in this arranged photograph in London on Tuesday, September 5, 2017. (credit: Bloomberg / Getty Images News ) Next month, a California drug dealer who recently pleaded guilty to selling on Silk Road, AlphaBay, and other sites is scheduled to be sentenced. According to federal authorities, David Ryan Burchard was one of the largest online merchants of marijuana and cocaine—he sold over $1.4 million worth of narcotics. Burchard was prosecuted in federal court in the Eastern District of California, which has quietly become a hub of cases against dealers from those notorious and now-shuttered Dark Web marketplaces. According to Lauren Horwood, a spokeswoman for the US Attorney’s Office in Sacramento, one of the primary hubs of this federal judicial district, there are currently 11 Silk Road and AlphaBay-related prosecutions underway. Four of the defendants have pleaded guilty, and, of those, two have already been sentenced, while the others’ cases are still ongoing. Read 21 remaining paragraphs | Comments
View the original here:
Feds in California are aggressively going after Silk Road, AlphaBay vendors
An anonymous reader quotes BleepingComputer: The Slovak National Security Office (NBU) has identified ten malicious Python libraries uploaded on PyPI — Python Package Index — the official third-party software repository for the Python programming language. NBU experts say attackers used a technique known as typosquatting to upload Python libraries with names similar to legitimate packages — e.g.: “urlib” instead of “urllib.” The PyPI repository does not perform any types of security checks or audits when developers upload new libraries to its index, so attackers had no difficulty in uploading the modules online. Developers who mistyped the package name loaded the malicious libraries in their software’s setup scripts. “These packages contain the exact same code as their upstream package thus their functionality is the same, but the installation script, setup.py, is modified to include a malicious (but relatively benign) code, ” NBU explained. Experts say the malicious code only collected information on infected hosts, such as name and version of the fake package, the username of the user who installed the package, and the user’s computer hostname. Collected data, which looked like “Y:urllib-1.21.1 admin testmachine”, was uploaded to a Chinese IP address. NBU officials contacted PyPI administrators last week who removed the packages before officials published a security advisory on Saturday.” The advisory lays some of the blame on Python’s ‘pip’ tool, which executes arbitrary code during installations without requiring a cryptographic signature. Ars Technica also reports that another team of researchers “was able to seed PyPI with more than 20 libraries that are part of the Python standard library, ” and that group now reports they’ve already received more than 7, 400 pingbacks. Read more of this story at Slashdot.