{"id":27126,"date":"2023-01-02T22:01:31","date_gmt":"2023-01-02T22:01:31","guid":{"rendered":"https:\/\/mailinvest.blog\/index.php\/2023\/01\/02\/pytorch-machine-learning-framework-targeted-by-cyberattack\/"},"modified":"2023-01-02T22:01:31","modified_gmt":"2023-01-02T22:01:31","slug":"pytorch-machine-learning-framework-targeted-by-cyberattack","status":"publish","type":"post","link":"https:\/\/mailinvest.blog\/index.php\/2023\/01\/02\/pytorch-machine-learning-framework-targeted-by-cyberattack\/","title":{"rendered":"PyTorch machine learning framework targeted by cyberattack"},"content":{"rendered":"

<\/a>\n
<\/p>\n

\n

A hacker has tricked some users of the PyTorch machine learning framework into downloading malware, BleepingComputer <\/span>reported<\/span><\/a> on Sunday.<\/span><\/p>\n

PyTorch is a popular open-source tool for developing artificial intelligence models. Developers use the tool to create new neural networks, train them and perform related tasks. PyTorch was originally released by Meta Platforms Inc. in 2016 and is now managed by the Linux Foundation.<\/span><\/p>\n

Last Friday, the developers of PyTorch identified a security breach. The breach didn\u2019t affect the PyTorch code base, but rather a service called PyPI that hosts third-party extensions to the AI development tool. A hacker uploaded a malicious extension to PyPI\u00a0 that is believed to have been downloaded more than 2,300 times by users.<\/span><\/p>\n

The malicious program had the same file name as a legitimate PyTorch extension, which led some users to accidentally download it. To prevent additional downloads, the developers of PyTorch have renamed the legitimate extension that the malicious program imitated.<\/span><\/p>\n

\u201cThis malicious package was being installed instead of the version from our official repository,\u201d the developers detailed in a <\/span>blog post<\/span><\/a>. \u201cThis malicious package has the same name torchtriton but added in code that uploads sensitive data from the machine.\u201d<\/span><\/p>\n

According to BleepingComputer, the malware is designed to steal passwords and SSH keys from computers on which it\u2019s installed. An SSH key is a series of characters similar to a password that developers use to log into their companies\u2019 cloud\u00a0 environments. The malicious file can reportedly access other types of data as well, such as technical information about developers\u2019 computers.<\/span><\/p>\n

Some antivirus programs open newly downloaded files in an isolated virtual machine before allowing them to run on a user\u2019s device. By opening files, an antivirus can more easily determine whether they may be malicious. The malicious extension spotted by PyTorch\u2019s developers reportedly includes a mechanism that detects when it\u2019s opened in a virtual machine and takes steps to avoid detection.<\/span><\/p>\n

The scope of the security breach was limited because it affected PyTorch-nightly, a version of the AI tool that contains new features still in development and has a limited user base. Additionally, the malicious file wasn\u2019t included by default in PyTorch downloads but had to be installed separately.<\/span><\/p>\n

The developers of PyTorch have released a guide for removing the malicious PyTorch extension. The guide includes a series of command line instructions that software teams can run to detect the extension and delete it.\u00a0<\/span><\/p>\n

Image: PyTorch<\/h5>\n
\n
\n

Show your support for our mission by joining our Cube Club and Cube Event Community of experts. Join the community that includes Amazon Web Services and Amazon.com CEO Andy Jassy, Dell Technologies founder and CEO Michael Dell, Intel CEO Pat Gelsinger and many more luminaries and experts.<\/span><\/h3>\n<\/div><\/div>\n