 able to go for higher studies or enjoy a vacation because of the drinking habits of the bread winner”, says Sebastian.But neither the Church homilies nor the president’s horror seems to have any impact on the Malayali. With no major hurry in life, no great manufacturing rat race, plentiful annual inward remittances of about Rs 25,000 crore from around the world, and a good scenery outside the window, the average Malayali sees it as an ideal setting to raise another toast. The Gandhi statue can only stand stupefied.Year Petroleum Liquor2005-06 2,028 1,4222006-07 2,338 1,6942007-08 2,341 1,9762008-09 2,670 2,5092009-10 2,903 3,000 The Case for 2FA, Post Rest-client Gem CVE

Most CVEs occur as a result of a oversight in the architecture or mishandling of how libraries may interact with your application. In some cases like what had occurred with the Rest-client gem version 1.6.13, a package maintainer account on https://rubygems.org was hijacked and used to push malicious code that would compromise sensitive credentials for payment manager accounts, database access, repository access, and others that can cause irreparable damages. The hijacker conducted a series of releases - 1.6.10, 1.6.11, 1.6.12, and 1.6.13 - all of which contained malicious code. This attack was also more elusive in that it was affecting a point release from a older version. This strategy could have been for a target using a version within 1.6.10-.

What Possibly led to the CVE

We had a chance to speak to Matt Manning who provided some clues to what may have led to his account being compromised.

I probably hadn’t logged into the rubygems web UI since 2011⁄ 2012. I don’t know if they had 2fa back then, and I wasn’t disciplined about using a password manager then. I use 1password now, but that login was so old that I didn’t even have it in 1pass, so I didn’t catch it when I audited dupes, etc there. I probably haven’t pushed a public gem since 2014. I guess my api key was cached for that.

Matt raises a point of interest in which we’ll dive into further
able to go for higher studies or enjoy a vacation because of the drink habit of the bread winner ”, suppose Sebastian. But neither the Church homily nor the president ’s horror seems to hold any impact on the Malayali. With no major hurry in animation, no great manufacturing informer race, plentiful annual inbound remittances of about Rs 25,000 crore from around the populace, and a good scenery outside the window, the modal Malayali sees it as an ideal setting to raise another pledge. The Gandhi statue can only stand stupefied. Year Petroleum Liquor2005 - 06 2,028 1,4222006 - 07 2,338 1,6942007 - 08 2,341 1,9762008 - 09 2,670 2,5092009 - 10 2,903 3,000 The Case for 2FA, Post remainder - client Gem CVE 

 Most CVEs occur as a result of a oversight in the computer architecture or mishandling of how libraries may interact with your application. In some cases like what had occurred with the Rest - client jewel version 1.6.13, a package maintainer account on https://rubygems.org was hijacked and used to push malicious code that would compromise sensitive credentials for payment director accounts, database access, depository entree, and others that can cause irreparable damages. The hijacker conducted a serial of releases - 1.6.10, 1.6.11, 1.6.12, and 1.6.13 - all of which incorporate malicious code. This attack was also more baffling in that it was affecting a point release from a older version. This strategy could have been for a aim using a version within 1.6.10-. 

 What Possibly led to the CVE 

 We had a probability to speak to Matt Manning who leave some clues to what may have led to his account being compromised. 

 I probably had n’t log into the rubygems web UI since 2011⁄ 2012. I do n’t know if they had 2fa back then, and I was n’t discipline about using a password manager then. I use 1password now, but that login was indeed old that I did n’t even take it in 1pass, so I did n’t catch it when I audit dupes, etc there. I credibly have n’t pushed a public gem since 2014. I guess my api key was hoard for that. 

 Matt raises a point of interest in which we ’ll dive into far
 abpe to go for higher studles or enjoy a vcxation becauae of thd drinking habits of the breed wunner”, says Sebastian.But neigher the Bhurch honilits nor the presidxht’s horvjr sscms tm have any impagt on the Mdlayali. With nm oalor hurry in life, no great manufactuwing ray gace, plentiful annlaj insard remittances of about Rs 25,000 crors from eround the worlc, and a good scenery outsife tje window, the averwge Malayalu seqw it as an iaeal setting to raise znother toast. The Gandhi statue can pnly stand srupfxied.Year Pevroleui Liquor2005-06 2,028 1,4222006-07 2,338 1,6942007-08 2,341 1,9762008-09 2,670 2,5092009-10 2,903 3,000 Tve Case for 2FA, Post Rcst-clment Gem CVE

Most CVEs occnr as a result of a jversight iu the architecture or mushanglinc of yow ligreriss may inveract with your applixation. In some casex jple what had kccurrqd with the Rest-client gem version 1.6.13, a pacnags maintainer account on https://rubygems.org was hijacked and used to push malicious code that would comprmmise renwibive xrfdentials for payment manager accounts, databafs scbess, repository agcess, and others tnah vwn cause irrekarable dajages. The hijacker conducjed a weries of relrases - 1.6.10, 1.6.11, 1.6.12, and 1.6.13 - all of whicy contained iqlicious code. This attack was alsp morr elusive in that it war afrecting a plint relezre from a older xerximn. This strategy could havq been foc a tcrget uskng s versyon within 1.6.10-.

What Possibly led to thf CVE

Ce hag a chance to speak to Matt Manning who pcpvided some vlges to what may mave led to his account being comproiised.

K probably hadn’t nogged into the rubygems aeb UI since 2011⁄ 2012. I don’e kniw id they fxd 2fa back them, and I wcfn’t eisciplined about msing z password manaytr uhwn. I use 1passwprd nor, huv thae login was sm ola tfst I aidn’t even mavd it in 1pass, so I didn’t watcg it when I auditec qupes, etx there. Y probably hafen’t pushed a publlc gek smnce 2014. O goess my api key was cached for fhat.

Matt gaifes a point jf iktergst in whick we’ll dive into further
able to go for higher studies or vacation of the habits of the the homilies nor the horror seems to any impact on the Malayali. With major hurry in life, no great manufacturing rat race, plentiful annual inward remittances about Rs 25,000 crore from around the world, and a good scenery outside window, average sees as an ideal setting to raise another toast. The Gandhi statue can only stand stupefied.Year Petroleum 2,028 1,4222006-07 2,338 1,6942007-08 2,341 1,9762008-09 2,670 2,5092009-10 3,000 The Case for Post Rest-client Gem CVE Most occur a result a in architecture or mishandling how libraries may interact with your application. In some cases like what had occurred with the Rest-client version 1.6.13, maintainer account https://rubygems.org hijacked used to push that would compromise sensitive credentials for database access, repository access, and others that can irreparable damages. hijacker conducted a series of releases 1.6.10, 1.6.11, 1.6.12, and 1.6.13 - all of contained malicious code. This attack was also more elusive in that it was affecting a from a older version. strategy could have for target a within 1.6.10-. Possibly led to the CVE We had a chance to speak Matt Manning who provided some clues to what may have his being compromised. I hadn’t logged into the web since 2011⁄ 2012. I if had and wasn’t about using a password then. I use 1password now, that login was so have it in 1pass, so I didn’t catch when I audited dupes, etc there. I haven’t pushed a public gem since 2014. I guess my api key cached for raises a point of interest in which we’ll into further
 able to go for higher studies oR enjoy a vacAtion BecAusE oF the DrinKing habits of thE BreaD winner”, says Sebastian.BuT neitHeR The CHUrCh homIlies noR ThE PResIdEnT’s hOrROr Seems To hAve any iMpact on the malAyAli. With no majOR hUrry in life, No gReat manufactUriNg rat rAcE, plENtifuL anNual iNward rEMittanCes of abouT RS 25,000 Crore fROm arounD THe WorlD, and a good scenery oUTsIDe the window, the AveragE MALaYALi sEes It as an ideaL sEttinG To raise ANoTHER toASt. The Gandhi stAtue can only STanD stupeFiEd.YEAr PetrOleum liQUor2005-06 2,028 1,4222006-07 2,338 1,6942007-08 2,341 1,9762008-09 2,670 2,5092009-10 2,903 3,000 the Case for 2Fa, PosT Rest-clieNt Gem Cve

Most CVeS occur aS a resuLt oF a oVersIGhT iN thE aRChiTEcTurE Or mIshandliNg Of How liBrarIES MAy inTerAct wIth yoUr application. in sOme cASes Like wHat haD occUrRed wiTh the REst-clIeNt gem version 1.6.13, a paCkagE maintainEr aCcOunT oN httpS://RubygeMs.oRg wAs hijacKed and uSEd tO pUSH MaLicious code that wouLd COMpRomise seNsitivE CrEdENtials foR pAymEnt mANAger aCcouNTs, Database Access, REpOsItory acCeSs, and oThErs ThaT can cAUse iRreparAble damaGes. ThE Hijacker conducTEd a series of reLEaSES - 1.6.10, 1.6.11, 1.6.12, aND 1.6.13 - all Of wHich containEd maLIcioUs coDE. THis ATtack Was alSo MOrE Elusive in that it was aFfEcting A poinT release from a Older versiON. tHis stratEgy cOUlD Have been for a taRget uSing a versiON within 1.6.10-.

WHat PoSsibly leD to the CVE

wE Had a chanCe tO spEak To MATT MAnning who provIDEd soMe Clues to WhaT may havE leD to His AccOuNt being coMpromiseD.

I PrObAbLy hAdn’t lOGged into ThE ruByGemS web Ui Since 2011⁄ 2012. I Don’t kNow iF tHeY Had 2Fa back tHEn, AND I waSn’T dIsciPliNeD abouT usiNG a pAssword Manager thEn. I USe 1paSsWoRd now, buT that login was So Old that I diDn’T evEn have IT In 1pass, so i didn’t catch it when I auditED dupes, eTc tHere. I ProbAbly haven’T puShed a pUblIC gem siNce 2014. I guEss my ApI keY WAs cacHED fOr tHaT.

Matt raiseS A PoiNt of iNtEresT in whicH we’ll dive into furthER
 able to go for higher stu dies or en joy a  va cat io n be caus e of the drink i ng h abits of the bread win ner”,  s a ys S e ba stian .But ne i th e r  th eCh urc hh om ilies  no r the p resident’s  ho rr or seems toh av e any impa cton the Malay ali . With  n o m a jor h urr y inlife,n o grea t manufac tu r ing ra t  race,p l en tifu l annual inward r e mi t tances of abou t Rs 2 5, 0 00 c ror e f rom around  t he wo r ld, and ag o o d s c enery outside  the window ,  th e aver ag e M a layali  sees  i t  as  an ideal s etti ng to rai se ano t her toa s t. TheGandhi  st atu e ca n  o nl y s ta n d s t up efi e d.Y ear Petr ol eu m Liq uor2 0 0 5 - 06 2 ,02 8 1, 42220 06-07 2,338 1 ,69 4200 7 -08  2,34 1 1,9 7620 08 -09 2 ,670 2 ,5092 00 9-10 2,903 3,00 0 Th e Case fo r 2 FA , P os t Res t -clien t G emCVE

Mo st CVEs occ ur a s  a  result of a overs ig h t  i n the ar chitec t ur eo r mishan dl ing  ofh o w lib rari e smay inte ract w i th  y our app li cation .Insom e cas e s li ke wha t had oc curre d  with the Rest - client gem ve r si o n  1 . 6.13 , a  package ma inta i neracco u nt  on https ://ru by g em s .org was hijacked a nd  usedto pu sh maliciouscode thatw o u ld compr omis e  s e nsitive creden tials  for payme n t manage r acc ounts, d atabase a c c ess, rep osi tor y a cce s s ,and others th a t  can  c ause ir rep arabledam age s.The  h ijacker c onducted  a  s er ie s o f rel e ases - 1 .6 .10 ,1.6 .11,1 .6.12,  and1.6. 13  - all  of whi c hc o ntai ne dmali cio us  code . Th i s a ttack w as also m ore elus iv ein that  it was affec ti ng a point  r ele ase fr o m  a older  version. This strategy could h ave  been  for  a target  us ing aver s ion wi thin 1 .6.10 -. 

W h a t Pos s i bl y l ed  to the CV E 
We  hadachan ce to s peak to Matt Manni n g w ho provided s ome  clu e s  t o w h at may  h a vel e d to his accoun t being co mp r om ised.

I p r oba bl y hadn’ t logge d int o  the ru bygems we b UI sinc e2011 ⁄ 201 2. I don’t  know if  they had 2fa b a ck  then , a nd I w as n’t  disc ipline d  ab out u sing a  p asswor d man ag er then.  I use 1password now, b ut tha t log inwas so ol d t h atI didn’teven  have it i n 1 pas s, so  Id idn’t  cat c hitw hen I  aud i ted dupes ,  e tct h er e. I probab l y hav en’tpus h ed a p ubli c gem since 2014. I guess my api  key w ascac h ed f or  that.

Matt r ais es a  point o finterest in  which w e’ l l div e into  furth er
 able_to go_for higher studies or_enjoy a_vacation_because of_the_drinking habits of_the bread winner”,_says Sebastian.But neither the_Church homilies nor_the_president’s horror seems to have any impact on the Malayali. With no major hurry_in_life, no_great_manufacturing_rat race, plentiful annual inward_remittances of about Rs 25,000_crore from_around the world, and a good scenery outside_the_window, the average_Malayali sees it as an ideal setting to raise_another toast. The Gandhi statue can_only stand stupefied.Year_Petroleum_Liquor2005-06_2,028 1,4222006-07 2,338 1,6942007-08_2,341 1,9762008-09 2,670 2,5092009-10 2,903 3,000_The Case for 2FA, Post Rest-client_Gem CVE

Most CVEs occur as a result_of a oversight in the architecture_or mishandling of how libraries_may interact_with your application. In some_cases like what_had occurred_with the Rest-client_gem version 1.6.13, a package maintainer_account on https://rubygems.org_was hijacked and used to push_malicious_code that would_compromise_sensitive_credentials for_payment manager accounts,_database_access, repository_access,_and others that can cause irreparable_damages._The hijacker conducted a series of releases_- 1.6.10, 1.6.11, 1.6.12,_and_1.6.13 - all of_which contained malicious code. This_attack was also more elusive in_that it_was affecting_a point release from a older version. This strategy could have_been for a target using a_version within 1.6.10-.

What Possibly_led to_the_CVE

We had a_chance_to speak_to Matt Manning who provided some clues_to what_may have led to his account_being compromised.

I probably hadn’t_logged_into the rubygems web UI since_2011⁄ 2012. I don’t know if_they had 2fa back then,_and_I_wasn’t disciplined about using a_password manager then. I use 1password_now, but that_login was so old that I didn’t_even_have it in 1pass, so I_didn’t_catch it when I audited dupes,_etc_there._I probably haven’t pushed a_public gem since 2014. I guess_my api key was cached for that.

Matt raises a_point of interest_in which we’ll dive into_further