PyTorch Infrastructure Attack Compromises Repository and Releases

Altus Intel
Altus Intel
  • Date Time

Detachment Attacks Infrastructure Used in Pytorch Development Framework

In a concerning incident, the infrastructure utilized in the development of the Pytorch machine training framework was targeted by a detachment of attackers. Their actions granted them access keys that could be leveraged to introduce arbitrary data into the project repository on GitHub and AWS. Furthermore, they were able to subtly replace code in the main branch of the repository by utilizing dependencies. The substitution of Pytorch releases opens the possibility of attacking prominent companies like Google, Meta, Boeing, and Lockheed Martin, who rely on Pytorch for their projects. Acknowledging the severity of the situation, Meta has already paid researchers $ 16250 as part of their Bug Bounty program.

/Reports, release notes, official announcements.

© 2024 - Altus Intel