8 ms·
One of the most insidious parts of this malware's payload, which isn't getting enough attention, is how it chooses the replacement wallet address. It doesn't ju
by DDerTyp 1y ago
One of the most insidious parts of this malware's payload, which isn't getting enough attention, is how it chooses the replacement wallet address. It doesn't just pick one at random from its list.
It actually calculates the Levenshtein distance between the legitimate address and every address in its own list. It then selects the attacker's address that is visually most similar to the original one.
This is a brilliant piece of social engineering baked right into the code. It's designed to specifically defeat the common security habit of only checking the first and last few characters of an address before confirming a transaction.
We did a full deobfuscation of the payload and analyzed this specific function. Wrote up the details here for anyone interested: https://jdstaerk.substack.com/p/we-just-found-malicious-code-in-the https://jdstaerk.substack.com/p/we-just-found-malicious-code...
Stay safe!
- oasisbob 1y ago> This is a brilliant piece of social engineering baked right into the code. It's designed to specifically defeat the common security habit ... I don't agree that the exuberance over the brilliance of this attack is warranted if you give this a moment's thought. The web has been fighting lookalike attacks for decades. This is just a more dynamic version of the same. To be honest, this whole post has the ring of AI writing, not careful analysis.
- NoahZuniga 1y ago> To be honest, this whole post has the ring of AI writing, not careful analysis. No it doesn't?
- withinboredom 1y ago> To be honest, this whole post has the ring of AI writing, not careful analysis. It has been what, hours? since the discovery? Are you expecting them to spend time analysing it instead of announcing it? Also, nearly everyone has AI editing content these days. It doesn’t mean it wasn’t written by a human.
- b112 1y agoJust for a counter, "nearly everyone" seems wildly ambitious. I want no part of AI in any form of my communication, and I know many which espouse the same. I will certainly agree on "many", but not "nearly everyone".
- blueflow 1y agoI've been thinking about using Levenshtein to make hexadecimal strings look more similar. Levenshtein might be useful for correcting typos, but not so when comparing hashes (specifically the start or end sections of it). Kinda odd.
- bflesch 1y agoCan you attribute this technique to a specific group?
- suzzer99 1y agoA few years ago, I remember reading about some NFT contract attack that did something similar. So I'm sure it's out there now.
- pants2 1y agoAlmost certainly Lazarus
- sflanagain 1y agoThe phishing email comes across a bit too amateur. Specifically the inclusion of: "we kindly ask that you complete this update your earliest convenience". The email was included here: https://cdn.prod.website-files.com/642adcaf364024654c71df23/68bf028d86e3642f1268253f_050c42b9.png https://cdn.prod.website-files.com/642adcaf364024654c71df23/... From this article: https://www.aikido.dev/blog/npm-debug-and-chalk-packages-compromised https://www.aikido.dev/blog/npm-debug-and-chalk-packages-com...
- huflungdung 1y ago[dead]
- rurban 1y agoVery amateur. Who would fall that, really? I can only suspect npm people who are used to unprofessional repo hosting practices. Such a Two Factor Authentication update request would have needed a blog post first, to announce such a fishy request.
- _el1s7 1y agoIt's not a "group specific" technique. This is smart, but not really unusual.
- josefbud 1y agoI'm a little confused on one of the excerpts from your article. > Our package-lock.json specified the stable version 1.3.2 or newer, so it installed the latest version 1.3.3 As far as I've always understood, the lockfile always specifies one single, locked version for each dependency, and even provides the URL to the tarball of that version. You can define "x version or newer" in the package.json file, but if it updates to a new patch version it's updating the lockfile with it. The npm docs suggest this is the case as well: https://arc.net/l/quote/cdigautx https://arc.net/l/quote/cdigautx And with that, packages usually shouldn't be getting updated in your CI pipeline. Am I mistaken on how npm(/yarn/pnpm) lockfiles work?
- sigotirandolas 1y agoNot the parent, but the default `npm install` / `yarn install` builds will ignore the lock file unless everything can be satisfied, if you want the lock file to be respected you must use `npm ci` / `yarn install --frozen-lockfile`. In my experience, it's common for CI pipelines to be misconfigured in this way, and for Node developers to misunderstand what the lock file is for.
- DDerTyp 1y agoTIL: I need to fix my CI pipeline. Gonna create a jira ticket I guess… Thank you!
- josefbud 1y agoSorry, I had assumed this was what you were doing when I wrote my question but I should have specified. And sorry for now making your npm install step twice as long! ;)
- rimunroe 1y agonpm ci should be much faster in CI as it can install the exact dependency versions directly from the lockfile rather than having to go through the whole dependency resolution algorithm. In CI environments you don't have to wait to delete a potentially large pre-existing node_modules directory since you should be starting fresh each time anyway.
- __MatrixMan__ 1y agoWe should be displaying hashes in a color scheme determined by the hash (foreground/background colors for each character determined by a hash of the hash, salted by that character's index, adjusted to ensure sufficient contrast). That way it's much harder to make one hash look like another.
- Spivak 1y agoNot sure why you're being downvoted, OpenSSH implemented randomart which gives you a little ascii "picture" of your key to make it easier for humans to validate. I have no idea if your scheme for producing keyart would work but it sounds like it would make a color "barcode".
- __MatrixMan__ 1y agoIf you ignored the characters and just focused on the background colors, yeah I suppose it would look like a barcode. But the way I envision it, each line on the barcode is a character, so it still copy/pastes into notepad as the original text, but it'll copy/paste into word as colored text with colored background.
- Macha 1y agoI have to say the openssh random art has never really helped for me - I see each individual example so infrequently and there's so little detail to remember that it may as well just be a hash for all the memorability it doesn't add
- 9dev 1y agoAs someone with red/green vision deficiency: if you do this, please don’t forget people like me are unable to distinguish many shades of colours, which would be very disadvantageous here!
- AaronAPU 1y agoIt’s not like it would hurt you for there to be supplementary info others can see but you can’t.
- 3abiton 1y agoThat moment where you respect the hacker. Still we are encroaching on dark times.