{"id":23161,"date":"2025-09-30T08:00:00","date_gmt":"2025-09-30T11:00:00","guid":{"rendered":"https:\/\/www.ethicalhacker.com.br\/site\/?p=23161"},"modified":"2025-08-24T20:46:57","modified_gmt":"2025-08-24T23:46:57","slug":"pypi-combate-o-risco-de-ataques-por-dominios-expirados","status":"publish","type":"post","link":"https:\/\/www.ethicalhacker.com.br\/site\/2025\/09\/exploits\/pypi-combate-o-risco-de-ataques-por-dominios-expirados\/","title":{"rendered":"PyPI combate o risco de ataques por dom\u00ednios expirados"},"content":{"rendered":"\n<p style=\"text-align: justify;\" data-start=\"44\" data-end=\"159\"><strong data-start=\"44\" data-end=\"159\">PyPI combate o risco de ataques por dom\u00ednios expirados e fortalece a seguran\u00e7a da cadeia de suprimentos<\/strong><\/p>\n<p style=\"text-align: justify;\" data-start=\"44\" data-end=\"159\"><span class=\"relative -mx-px my-[-0.2rem] rounded px-px py-[0.2rem] transition-colors duration-100 ease-in-out\">No contexto atual da seguran\u00e7a digital, especialmente no ecossistema de desenvolvimento de software aberto, surge uma fragilidade muitas vezes negligenciada: dom\u00ednios expirados. O Python Package Index (PyPI), reposit\u00f3rio central para bibliotecas Python, implementou recentemente uma medida proativa para mitigar ataques conhecidos como \u201cdomain resurrection\u201d \u2014 situa\u00e7\u00f5es em que invasores adquirem dom\u00ednios expirados usados por mantenedores de pacotes e, por meio do controle daquele dom\u00ednio, obt\u00eam acesso \u00e0s contas para executar redefini\u00e7\u00f5es de senha e inserir vers\u00f5es maliciosas de pacotes.<\/span><\/p>\n<p style=\"text-align: justify;\" data-start=\"44\" data-end=\"159\">\u00a0<\/p>\n<p style=\"text-align: justify;\" data-start=\"256\" data-end=\"449\"><strong data-start=\"256\" data-end=\"293\">Contexto e relev\u00e2ncia do problema<\/strong><\/p>\n<p style=\"text-align: justify;\" data-start=\"256\" data-end=\"449\"><span class=\"relative -mx-px my-[-0.2rem] rounded px-px py-[0.2rem] transition-colors duration-100 ease-in-out\">Os usu\u00e1rios do PyPI s\u00e3o identificados por e-mails verificados, normalmente vinculados a dom\u00ednios personalizados. Quando esses dom\u00ednios expiram e s\u00e3o adquiridos por terceiros mal-intencionados, os invasores podem receber e-mails leg\u00edtimos, como solicita\u00e7\u00f5es de redefini\u00e7\u00e3o de senha, tornando-se agentes aut\u00eanticos sem levantar suspeitas<\/span>. <span class=\"relative -mx-px my-[-0.2rem] rounded px-px py-[0.2rem] transition-colors duration-100 ease-in-out\">Um caso documentado ocorreu em 2022, no qual o dom\u00ednio associado a um pacote chamado \u201cctx\u201d foi adquirido por um atacante, que ent\u00e3o publicou uma vers\u00e3o comprometida para coletar credenciais AWS e outras informa\u00e7\u00f5es sens\u00edveis<\/span>.<\/p>\n<p style=\"text-align: justify;\" data-start=\"256\" data-end=\"449\">\u00a0<\/p>\n<p style=\"text-align: justify;\" data-start=\"451\" data-end=\"642\"><strong data-start=\"451\" data-end=\"484\">Medida implementada pelo PyPI<\/strong><\/p>\n<p style=\"text-align: justify;\" data-start=\"451\" data-end=\"642\"><span class=\"relative -mx-px my-[-0.2rem] rounded px-px py-[0.2rem] transition-colors duration-100 ease-in-out\">A Python Software Foundation (PSF), por meio do eng. de seguran\u00e7a Mike Fiedler, anunciou em 18 de agosto de 2025 uma nova prote\u00e7\u00e3o: o sistema agora monitora regularmente dom\u00ednios verificados associados a contas, detectando aqueles que entraram em fases cr\u00edticas de expira\u00e7\u00e3o \u2014 como o per\u00edodo de &#8220;redemption&#8221; \u2014 e automaticamente <strong data-start=\"328\" data-end=\"343\">desverifica<\/strong> o e-mail vinculado<\/span>. <span class=\"relative -mx-px my-[-0.2rem] rounded px-px py-[0.2rem] transition-colors duration-100 ease-in-out\">Esse monitoramento \u00e9 feito diariamente utilizando a Status API da Fastly (Domainr), com checagens a cada 30 dias sobre o status do dom\u00ednio<\/span>.<\/p>\n<p style=\"text-align: justify;\" data-start=\"644\" data-end=\"724\"><span class=\"relative -mx-px my-[-0.2rem] rounded px-px py-[0.2rem] transition-colors duration-100 ease-in-out\">Desde junho de 2025, foram desverificados mais de 1.800 endere\u00e7os de e-mail \u2014 uma iniciativa significativa para reduzir riscos potenciais associados \u00e0 cadeia de suprimentos<\/span>.<\/p>\n<p style=\"text-align: justify;\" data-start=\"644\" data-end=\"724\">\u00a0<\/p>\n<p style=\"text-align: justify;\" data-start=\"726\" data-end=\"848\"><strong data-start=\"726\" data-end=\"765\">Implica\u00e7\u00f5es estrat\u00e9gicas e t\u00e9cnicas<\/strong><\/p>\n<p style=\"text-align: justify;\" data-start=\"726\" data-end=\"848\"><span class=\"relative -mx-px my-[-0.2rem] rounded px-px py-[0.2rem] transition-colors duration-100 ease-in-out\">Essa medida n\u00e3o elimina todas as vulnerabilidades, mas representa uma defesa robusta contra uma amea\u00e7a sutil que pode parecer leg\u00edtima. A consequ\u00eancia pr\u00e1tica \u00e9 a mitiga\u00e7\u00e3o de riscos de tomadas de conta de contas via redefini\u00e7\u00e3o de senha por ataques de dom\u00ednio expirado \u2014 especialmente relevantes para mantenedores que t\u00eam apenas um e-mail verificado vinculado a dom\u00ednio pr\u00f3prio<\/span>.<\/p>\n<p style=\"text-align: justify;\" data-start=\"726\" data-end=\"848\">\u00a0<\/p>\n<p style=\"text-align: justify;\" data-start=\"850\" data-end=\"903\"><strong data-start=\"850\" data-end=\"901\">Recomenda\u00e7\u00f5es para usu\u00e1rios e mantenedores PyPI<\/strong><\/p>\n<ul style=\"text-align: justify;\" data-start=\"904\" data-end=\"1159\">\n<li data-start=\"904\" data-end=\"988\">\n<p data-start=\"906\" data-end=\"988\"><span class=\"relative -mx-px my-[-0.2rem] rounded px-px py-[0.2rem] transition-colors duration-100 ease-in-out\"><strong data-start=\"0\" data-end=\"42\" data-is-only-node=\"\">Utilizar m\u00faltiplos e\u2011mails verificados<\/strong>: adicionar um e-mail secund\u00e1rio de dom\u00ednio confi\u00e1vel (como Gmail ou Outlook) para garantir um canal de recupera\u00e7\u00e3o seguro<\/span>.<\/p>\n<\/li>\n<li data-start=\"989\" data-end=\"1073\">\n<p data-start=\"991\" data-end=\"1073\"><span class=\"relative -mx-px my-[-0.2rem] rounded px-px py-[0.2rem] transition-colors duration-100 ease-in-out\"><strong data-start=\"0\" data-end=\"47\" data-is-only-node=\"\">Ativar a autentica\u00e7\u00e3o de dois fatores (2FA)<\/strong>: obrigat\u00f3ria para contas com atividade recente (ap\u00f3s 1\u00ba de janeiro de 2024), \u00e9 recomend\u00e1vel estender essa seguran\u00e7a a outros servi\u00e7os conectados \u00e0 conta<\/span>.<\/p>\n<\/li>\n<li data-start=\"1074\" data-end=\"1117\">\n<p data-start=\"1076\" data-end=\"1117\"><span class=\"relative -mx-px my-[-0.2rem] rounded px-px py-[0.2rem] transition-colors duration-100 ease-in-out\"><strong data-start=\"0\" data-end=\"35\" data-is-only-node=\"\">Auditar dom\u00ednios personalizados<\/strong>: manter registros dos dom\u00ednios vinculados \u00e0 conta, garantindo que estejam ativos, sob controle e renovados pontualmente.<\/span><\/p>\n<\/li>\n<li data-start=\"1118\" data-end=\"1159\">\n<p data-start=\"1120\" data-end=\"1159\"><span class=\"relative -mx-px my-[-0.2rem] rounded px-px py-[0.2rem] transition-colors duration-100 ease-in-out\"><strong data-start=\"0\" data-end=\"26\" data-is-only-node=\"\">Monitoramento cont\u00ednuo<\/strong>: organiza\u00e7\u00f5es que fornecem ou dependem de pacotes open\u2011source devem acompanhar estat\u00edsticas de uso e sa\u00fade dos reposit\u00f3rios, ficando atentos a altera\u00e7\u00f5es suspeitas nas vers\u00f5es de pacotes.<\/span><\/p>\n<\/li>\n<\/ul>\n<p style=\"text-align: justify;\">\u00a0<\/p>\n<p style=\"text-align: justify;\" data-start=\"1161\" data-end=\"1216\"><strong data-start=\"1161\" data-end=\"1174\">Conclus\u00e3o<\/strong><\/p>\n<p style=\"text-align: justify;\" data-start=\"1161\" data-end=\"1216\"><span class=\"relative -mx-px my-[-0.2rem] rounded px-px py-[0.2rem] transition-colors duration-100 ease-in-out\">A ado\u00e7\u00e3o pelo PyPI de monitoramento proativo e desverifica\u00e7\u00e3o autom\u00e1tica de e-mails associados a dom\u00ednios expirados \u00e9 um passo crucial para fortalecer a resili\u00eancia da cadeia de suprimentos de software. Essa a\u00e7\u00e3o reduz significativamente o risco de compromissos de conta via dom\u00ednios reativados por invasores \u2014 um vetor de ataque concreto, com ataque registrado em 2022. Apesar de n\u00e3o ser uma solu\u00e7\u00e3o infal\u00edvel, trata-se de uma barreira inteligente e eficiente contra amea\u00e7as sofisticadas. A ado\u00e7\u00e3o de boas pr\u00e1ticas como m\u00faltiplos canais de recupera\u00e7\u00e3o e autentica\u00e7\u00e3o forte, aliadas \u00e0 conscientiza\u00e7\u00e3o sobre a sa\u00fade dos dom\u00ednios vinculados, formam a base de uma estrat\u00e9gia de seguran\u00e7a s\u00f3lida e eficaz para mantenedores e usu\u00e1rios do ecossistema PyPI.<\/span><\/p>\n<p data-start=\"1161\" data-end=\"1216\">\u00a0<\/p>\n<p data-start=\"1218\" data-end=\"1250\"><strong data-start=\"1218\" data-end=\"1248\">Refer\u00eancias bibliogr\u00e1ficas<\/strong><\/p>\n<ul data-start=\"1251\" data-end=\"1418\">\n<li data-start=\"1251\" data-end=\"1335\">\n<p data-start=\"1254\" data-end=\"1335\"><span class=\"relative -mx-px my-[-0.2rem] rounded px-px py-[0.2rem] transition-colors duration-100 ease-in-out\">Preventing Domain Resurrection Attacks \u2014 PyPI Blog (18 de agosto de 2025): abordagem t\u00e9cnica, estat\u00edsticas e contramedidas do PyPI. Dispon\u00edvel em: <em data-start=\"147\" data-end=\"162\" data-is-last-node=\"\">blog.pypi.org<\/em><\/span> <span class=\"\" data-state=\"closed\"><span class=\"ms-1 inline-flex max-w-full items-center relative top-[-0.094rem] animate-[show_150ms_ease-in]\" data-testid=\"webpage-citation-pill\"><a class=\"flex h-4.5 overflow-hidden rounded-xl px-2 text-[9px] font-medium text-token-text-secondary! bg-[#F4F4F4]! dark:bg-[#303030]! transition-colors duration-150 ease-in-out\" href=\"https:\/\/caveiratech.com\/post\/pypi-combate-ataques-de-dominios-expirados-2582553?utm_source=chatgpt.com\" target=\"_blank\" rel=\"noopener\"><span class=\"relative start-0 bottom-0 flex h-full w-full items-center\"><span class=\"flex h-4 w-full items-center justify-between overflow-hidden\"><span class=\"max-w-full grow truncate overflow-hidden text-center\">caveiratech.com<\/span><\/span><\/span><\/a><\/span><\/span><span class=\"\" data-state=\"closed\"><span class=\"ms-1 inline-flex max-w-full items-center relative top-[-0.094rem] animate-[show_150ms_ease-in]\" data-testid=\"webpage-citation-pill\"><a class=\"flex h-4.5 overflow-hidden rounded-xl px-2 text-[9px] font-medium text-token-text-secondary! bg-[#F4F4F4]! dark:bg-[#303030]! transition-colors duration-150 ease-in-out\" href=\"https:\/\/blog.pypi.org\/posts\/2025-08-18-preventing-domain-resurrections\/?utm_source=chatgpt.com\" target=\"_blank\" rel=\"noopener\"><span class=\"relative start-0 bottom-0 flex h-full w-full items-center\"><span class=\"flex h-4 w-full items-center justify-between absolute\"><span class=\"max-w-full grow truncate overflow-hidden text-center\">TechRadar<\/span><span class=\"-me-1 flex h-full items-center rounded-full px-1 text-[#8F8F8F]\">+7<\/span><\/span><span class=\"flex h-4 w-full items-center justify-between\"><span class=\"max-w-full grow truncate overflow-hidden text-center\">blog.pypi.org<\/span><span class=\"-me-1 flex h-full items-center rounded-full px-1 text-[#8F8F8F]\">+7<\/span><\/span><span class=\"flex h-4 w-full items-center justify-between absolute\"><span class=\"max-w-full grow truncate overflow-hidden text-center\">lwn.net<\/span><span class=\"-me-1 flex h-full items-center rounded-full px-1 text-[#8F8F8F]\">+7<\/span><\/span><\/span><\/a><\/span><\/span><\/p>\n<\/li>\n<li data-start=\"1336\" data-end=\"1418\">\n<p data-start=\"1339\" data-end=\"1418\"><span class=\"relative -mx-px my-[-0.2rem] rounded px-px py-[0.2rem] transition-colors duration-100 ease-in-out\">PyPI Blocks 1,800 Expired-Domain Emails to Prevent Account Takeovers and Supply Chain Attacks \u2014 The Hacker News (19 de agosto de 2025): contextualiza\u00e7\u00e3o dos riscos e impacto da medida. Dispon\u00edvel em: <em data-start=\"200\" data-end=\"219\" data-is-last-node=\"\">thehackernews.com<\/em><\/span> <span class=\"\" data-state=\"closed\"><span class=\"ms-1 inline-flex max-w-full items-center relative top-[-0.094rem] animate-[show_150ms_ease-in]\" data-testid=\"webpage-citation-pill\"><a class=\"flex h-4.5 overflow-hidden rounded-xl px-2 text-[9px] font-medium text-token-text-secondary! bg-[#F4F4F4]! dark:bg-[#303030]! transition-colors duration-150 ease-in-out\" href=\"https:\/\/thehackernews.com\/2025\/08\/pypi-blocks-1800-expired-domain-emails.html?utm_source=chatgpt.com\" target=\"_blank\" rel=\"noopener\"><span class=\"relative start-0 bottom-0 flex h-full w-full items-center\"><span class=\"flex h-4 w-full items-center justify-between absolute\"><span class=\"max-w-full grow truncate overflow-hidden text-center\">Cyber Security News<\/span><span class=\"-me-1 flex h-full items-center rounded-full px-1 text-[#8F8F8F]\">+5<\/span><\/span><span class=\"flex h-4 w-full items-center justify-between\"><span class=\"max-w-full grow truncate overflow-hidden text-center\">The Hacker News<\/span><span class=\"-me-1 flex h-full items-center rounded-full px-1 text-[#8F8F8F]\">+5<\/span><\/span><span class=\"flex h-4 w-full items-center justify-between absolute\"><span class=\"max-w-full grow truncate overflow-hidden text-center\">SC Media<\/span><span class=\"-me-1 flex h-full items-center rounded-full px-1 text-[#8F8F8F]\">+5<\/span><\/span><\/span><\/a><\/span><\/span><\/p>\n<\/li>\n<\/ul>\n\n\n","protected":false},"excerpt":{"rendered":"<p>PyPI combate o risco de ataques por dom\u00ednios expirados e fortalece a seguran\u00e7a da cadeia de suprimentos No contexto atual da seguran\u00e7a digital, especialmente no ecossistema de desenvolvimento de software aberto, surge uma fragilidade muitas vezes negligenciada: dom\u00ednios expirados. O Python Package Index (PyPI), reposit\u00f3rio central para bibliotecas Python, implementou recentemente uma medida proativa para [&hellip;]<\/p>\n","protected":false},"author":2,"featured_media":23164,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[89,100,21,105],"tags":[],"class_list":["post-23161","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-basico","category-diversos","category-exploits","category-noticias"],"_links":{"self":[{"href":"https:\/\/www.ethicalhacker.com.br\/site\/wp-json\/wp\/v2\/posts\/23161","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.ethicalhacker.com.br\/site\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.ethicalhacker.com.br\/site\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.ethicalhacker.com.br\/site\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.ethicalhacker.com.br\/site\/wp-json\/wp\/v2\/comments?post=23161"}],"version-history":[{"count":1,"href":"https:\/\/www.ethicalhacker.com.br\/site\/wp-json\/wp\/v2\/posts\/23161\/revisions"}],"predecessor-version":[{"id":23162,"href":"https:\/\/www.ethicalhacker.com.br\/site\/wp-json\/wp\/v2\/posts\/23161\/revisions\/23162"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.ethicalhacker.com.br\/site\/wp-json\/wp\/v2\/media\/23164"}],"wp:attachment":[{"href":"https:\/\/www.ethicalhacker.com.br\/site\/wp-json\/wp\/v2\/media?parent=23161"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.ethicalhacker.com.br\/site\/wp-json\/wp\/v2\/categories?post=23161"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.ethicalhacker.com.br\/site\/wp-json\/wp\/v2\/tags?post=23161"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}