6 ms·

the malware's main function seems to be to check the clipboard for crypto wallet addresses and then replace them with attacker addresses: Bitcoin (bc1): bc1q

by retsl 11mo ago

the malware's main function seems to be to check the clipboard for crypto wallet addresses and then replace them with attacker addresses: Bitcoin (bc1): bc1qrzh7d0yy8c3arqxc23twkjujxxaxcm08uqh60v Litecoin (ltc1/L/M): LQ4B4aJqUH92BgtDseWxiCRn45Q8eHzTkH Ethereum (0x): 0x10A8B2e2790879FFCdE514DdE615b4732312252D Dogecoin (D): DQzrwvUJTXBxAbYiynzACLntrY4i9mMs7D Tron (T): TW93HYbyptRYsXj1rkHWyVUpps2anK12hg Ripple (r): r9vQFVwRxSkpFavwA9HefPFkWaWBQxy4pU Cardano (addr1): addr1q9atfml5cew4hx0z09xu7mj7fazv445z4xyr5gtqh6c9p4r6knhlf3jatwv7y72deah9un6yettg92vg8gskp04s2r2qren6tw can't guarantee it doesn't do anything else.

_zagj 11mo ago
As soon as I saw the headline, I assumed something of this sort. Maybe it's naive, but I miss the days when you could just trust (however unfounded) open source software. I never had to hesitate before downloading a distro or a package. Now I only install something if I absolutely need it.
- oofbey 11mo ago
  [flagged]
  - _zagj 11mo ago
    You could argue that if not crypto, it would have been something else eventually, and that the heightened vigilance it has necessitated has made it more difficult for other motivated attackers (like state actors) to backdoor or compromise OSS. But as someone who doesn't use crypto, I completely get the "f*ck crypto" sentiment.
    - brokensegue 11mo ago
      stealing other data is less lucrative. i'm not confident someone could empty my bank account even with my username/password
      - anonym29 11mo ago
        other data is less lucrative than the $0 sitting in those static attacker wallets?
        brokensegue 11mo ago
        i think you're comparing apples and oranges. that they have so far failed to steal any coins does not mean anything with regards to this discussion
        anonym29 11mo ago
        I don't know how familiar you are with the sheer scope of malware, black markets, data theft, various extortion techniques, but gaining the ability to drop an arbitrary .exe on Xubuntu.org and actually direct enough traffic to it that people notice it is worth a LOT more than $0.
  - anonym29 11mo ago
    The value of your labor is being systemically destroyed through deliberate currency manipulation by the US Federal Reserve, in conjunction with the US Government and US Treasury. You are more than twice as productive as your equivalent 1971 counterpart, but relative to inflation, he was being paid about the same as you. You make your employer twice as much money as he did but you're not rewarded twice as much. Five, ten, twenty years from now, when the trend that has been visible in the data since the 1970s is complete, and your labor has no value at all, are you going to be okay? The people who spent large majorities of their income accumulating scarce stores of value (gold, bitcoin, housing, profitable businesses, land, etc) are going to be fine.
    - lern_too_spel 11mo ago
      And beanie babies, right? Speculative bubbles like Bitcoin grow until there are no more greater fools to pay off the people at the top of the pyramid. Then as people realize they can't fool someone else to buy their beanie baby for more than what they paid for it, the price quickly drops to 0. Bitcoin has the added benefit that North Korea can take it from you without getting access to your closet.
      - anonym29 11mo ago
        I'll keep taking bitcoin, gold, land, housing. You can have my worthless paper federal reserve notes - they're all forged. Unlimited supply cap, the issuing entity literally just keeps printing trillions of them. It's monopoly money. I have no interest in that toilet paper with pictures of dead presidents the federal reserve keeps printing for 100,000% markup. Just because everyone around me is jumping off a cliff with a parachute made of federal reserve notes doesn't mean I'm obligated to do the same.
        lern_too_spel 11mo ago
        You're mixing up completely different assets. Gold and land are scarce resources that have value that goes up when more people need it. The buildings on top of the land depreciate. Bitcoin is just a beanie baby that is easier to steal without recourse that you can't even sell for the materials used to produce it. The thing with a speculative bubble is that as soon as the value stops going up, there is no reason anyone would want to buy it instead of shares in a company or land producing valuable goods and services, so people will sell it off. There is no floor on Bitcoin, so it will go to 0 when that happens. You don't want to be the last fool holding.
  - lta 11mo ago
    It's also very practical to allow open air corruption of highest level government elected officials.
- fragmede 11mo ago
  The whole supply chain, in fact. The project's site isn't necessarily the real one. the GitHub repo it links to isn't necessarily the real one, the binaries it offers to download aren't necessarily the real one, GitHub isn't even necessarily the real one! There's currently a phishing copy of GitHub up at hxxps://git.hubp.de/ that somebody is going to fall for before it's taken down. If you want to be help get it blocked, load that site up and flag it as unsafe in Chrome! (It's hilarious that the site has a Cloudflare challenge to get in, btw.) It's a big bad dark scary Internet out there. Be careful.
- bsder 11mo ago
  Let's all thank Bitcoin for making supply chain compromises worth anonymous money transfers.
riedel 11mo ago
Isn't possible to check in the block chain to check if the attacker is actually receiving money? Just curious how much money ine makes with such attacks.
- gield 11mo ago
  I just checked all wallets, they're all empty with no recent transactions.
- basilikum 11mo ago
  Here is the BTC and ETH address for convenience for anyone who wants to check: https://mempool.space/address/bc1qrzh7d0yy8c3arqxc23twkjujxxaxcm08uqh60v https://mempool.space/address/bc1qrzh7d0yy8c3arqxc23twkjujxx... https://etherscan.io/address/0x10A8B2e2790879FFCdE514DdE615b4732312252D https://etherscan.io/address/0x10A8B2e2790879FFCdE514DdE615b... They are empty as of now.
like_any_other 11mo ago
Do browsers still let websites read the clipboard?
- integralid 11mo ago
  That's not done in the browser, malware is hidden in the Ubuntu download (but that's a rather amateurish work, image was not compromised, malware was distributed as .exe file next to it).
- retsl 11mo ago
  Not without approval, see https://developer.mozilla.org/en-US/docs/Web/API/Clipboard_API#security_considerations https://developer.mozilla.org/en-US/docs/Web/API/Clipboard_A... or https://web.dev/articles/async-clipboard#security_and_permissions https://web.dev/articles/async-clipboard#security_and_permis.... But that is not relevant here. Instead of the .torrent files, the compromised website served a .zip file, which contained a .exe. When opened, it shows a GUI to select a Xubuntu version and a button to generate the link. When that button was clicked, the malware showed a download link to the user and, in the background, deployed a second stage to %APPDATA%\osn10963\elzvcf.exe and executed it. The second stage monitors the clipboard for cryptocurrency addresses which it will replace with attacker-controlled ones. The second stage is also added to HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ to ensure it is run whenever the user logs in. Both stages have some limited anti-debugging and anti-VM functionality.

by retsl 11mo ago

_zagj 11mo ago

As soon as I saw the headline, I assumed something of this sort. Maybe it's naive, but I miss the days when you could just trust (however unfounded) open source software. I never had to hesitate before downloading a distro or a package. Now I only install something if I absolutely need it.

oofbey 11mo ago
[flagged]
- _zagj 11mo ago
  You could argue that if not crypto, it would have been something else eventually, and that the heightened vigilance it has necessitated has made it more difficult for other motivated attackers (like state actors) to backdoor or compromise OSS. But as someone who doesn't use crypto, I completely get the "f*ck crypto" sentiment.
  - brokensegue 11mo ago
    stealing other data is less lucrative. i'm not confident someone could empty my bank account even with my username/password
    - anonym29 11mo ago
      other data is less lucrative than the $0 sitting in those static attacker wallets?
      - brokensegue 11mo ago
        i think you're comparing apples and oranges. that they have so far failed to steal any coins does not mean anything with regards to this discussion
        anonym29 11mo ago
        I don't know how familiar you are with the sheer scope of malware, black markets, data theft, various extortion techniques, but gaining the ability to drop an arbitrary .exe on Xubuntu.org and actually direct enough traffic to it that people notice it is worth a LOT more than $0.
- anonym29 11mo ago
  The value of your labor is being systemically destroyed through deliberate currency manipulation by the US Federal Reserve, in conjunction with the US Government and US Treasury. You are more than twice as productive as your equivalent 1971 counterpart, but relative to inflation, he was being paid about the same as you. You make your employer twice as much money as he did but you're not rewarded twice as much. Five, ten, twenty years from now, when the trend that has been visible in the data since the 1970s is complete, and your labor has no value at all, are you going to be okay? The people who spent large majorities of their income accumulating scarce stores of value (gold, bitcoin, housing, profitable businesses, land, etc) are going to be fine.
  - lern_too_spel 11mo ago
    And beanie babies, right? Speculative bubbles like Bitcoin grow until there are no more greater fools to pay off the people at the top of the pyramid. Then as people realize they can't fool someone else to buy their beanie baby for more than what they paid for it, the price quickly drops to 0. Bitcoin has the added benefit that North Korea can take it from you without getting access to your closet.
    - anonym29 11mo ago
      I'll keep taking bitcoin, gold, land, housing. You can have my worthless paper federal reserve notes - they're all forged. Unlimited supply cap, the issuing entity literally just keeps printing trillions of them. It's monopoly money. I have no interest in that toilet paper with pictures of dead presidents the federal reserve keeps printing for 100,000% markup. Just because everyone around me is jumping off a cliff with a parachute made of federal reserve notes doesn't mean I'm obligated to do the same.
      - lern_too_spel 11mo ago
        You're mixing up completely different assets. Gold and land are scarce resources that have value that goes up when more people need it. The buildings on top of the land depreciate. Bitcoin is just a beanie baby that is easier to steal without recourse that you can't even sell for the materials used to produce it. The thing with a speculative bubble is that as soon as the value stops going up, there is no reason anyone would want to buy it instead of shares in a company or land producing valuable goods and services, so people will sell it off. There is no floor on Bitcoin, so it will go to 0 when that happens. You don't want to be the last fool holding.
- lta 11mo ago
  It's also very practical to allow open air corruption of highest level government elected officials.
fragmede 11mo ago
The whole supply chain, in fact. The project's site isn't necessarily the real one. the GitHub repo it links to isn't necessarily the real one, the binaries it offers to download aren't necessarily the real one, GitHub isn't even necessarily the real one! There's currently a phishing copy of GitHub up at hxxps://git.hubp.de/ that somebody is going to fall for before it's taken down. If you want to be help get it blocked, load that site up and flag it as unsafe in Chrome! (It's hilarious that the site has a Cloudflare challenge to get in, btw.) It's a big bad dark scary Internet out there. Be careful.
bsder 11mo ago
Let's all thank Bitcoin for making supply chain compromises worth anonymous money transfers.

riedel 11mo ago

Isn't possible to check in the block chain to check if the attacker is actually receiving money? Just curious how much money ine makes with such attacks.

gield 11mo ago
I just checked all wallets, they're all empty with no recent transactions.
basilikum 11mo ago
Here is the BTC and ETH address for convenience for anyone who wants to check: https://mempool.space/address/bc1qrzh7d0yy8c3arqxc23twkjujxxaxcm08uqh60v https://mempool.space/address/bc1qrzh7d0yy8c3arqxc23twkjujxx... https://etherscan.io/address/0x10A8B2e2790879FFCdE514DdE615b4732312252D https://etherscan.io/address/0x10A8B2e2790879FFCdE514DdE615b... They are empty as of now.

like_any_other 11mo ago

Do browsers still let websites read the clipboard?

integralid 11mo ago
That's not done in the browser, malware is hidden in the Ubuntu download (but that's a rather amateurish work, image was not compromised, malware was distributed as .exe file next to it).
retsl 11mo ago
Not without approval, see https://developer.mozilla.org/en-US/docs/Web/API/Clipboard_API#security_considerations https://developer.mozilla.org/en-US/docs/Web/API/Clipboard_A... or https://web.dev/articles/async-clipboard#security_and_permissions https://web.dev/articles/async-clipboard#security_and_permis.... But that is not relevant here. Instead of the .torrent files, the compromised website served a .zip file, which contained a .exe. When opened, it shows a GUI to select a Xubuntu version and a button to generate the link. When that button was clicked, the malware showed a download link to the user and, in the background, deployed a second stage to %APPDATA%\osn10963\elzvcf.exe and executed it. The second stage monitors the clipboard for cryptocurrency addresses which it will replace with attacker-controlled ones. The second stage is also added to HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ to ensure it is run whenever the user logs in. Both stages have some limited anti-debugging and anti-VM functionality.