Full transcript
0:00Oh my god, the crypto criminals are at
0:02it again. Malware in debug, the debug.js
0:06package hosted on npm. Any computer that
0:09has this package installed or running
0:11should be considered fully compromised.
0:13All secrets and keys stored on that
0:15computer should be rotated immediately
0:17from a different computer. Package
0:18should be removed, but has full control
0:20of the computer may have been given to
0:21an outside entity. There is no guarantee
0:22that removing the package will remove
0:24all malicious software resulting from
0:25installing it. So, previously today,
0:27McKenzie Jackson, a developer over at
0:29Iicaido Security, had written on
0:31LinkedIn, "Urgent. I can't write much."
0:34But the largest supply chain compromise
0:36in MPM history just happened. Packages
0:39with a total of two billion weekly
0:42downloads just got turned malicious.
0:44Packages were compromised an hour ago.
0:46Please share urgently. This is a post
0:48from 5 hours ago. And here is the list
0:51of all of the packages that were hit.
0:54You can see the big numbers here. 371.41
0:57million downloads per week, 357 million
1:00downloads a week, blah blah blah. I'll
1:03give more details later in another post.
1:05And it has a cool little hacked picture
1:07for uh the library on npm's website.
1:10Yeah, a lot of big numbers there. So,
1:12the GitHub advisory that I showed at the
1:14very beginning of the video came from uh
1:17Hacker News here and a link to the npm
1:19debug and chalk packages compromised on
1:22akaido.dev and their website. And we can
1:25see the uh package maintainer, I think
1:27one of the contributors, the developers
1:28here saying, "Hi." Yep, I got pawned.
1:31Sorry everyone. Very embarrassing. And
1:33if I may, I think this is kind of neat
1:35to see really the human and personal
1:37response to, "Hey, someone being
1:39compromised that is really such a
1:41contributor and open source developer
1:43where a lot of these libraries and
1:45basically a supply chain compromise
1:47happens and then expands out to the
1:49entire industry." Very personal like
1:52human. I'm so sorry. This was a human
1:55fumble, a mistake that I made. And it's
1:57cool to see some other folks chiming in.
1:59Hey, thanking people, agreeing with
2:01everyone who is thanking this individual
2:03for owning up so quickly and talking
2:05about this was a mistake. I'm going to
2:07be bouncing around for a lot of articles
2:08here. Sorry. Uh, but this was the Ikaido
2:11post. Starting at September 8th, 1316
2:13UTC, we were notified that all of these
2:16packages have bad changes to them.
2:19packages were updated to contain a piece
2:21of code that would be executed on the
2:22client of a website which silently
2:24intercepts crypto and web 3 activity in
2:27the browser. It's the crypto coins
2:29manipulates walled interactions and
2:31rewrites payment destinations so that
2:32funds and approvals are redirected to an
2:35attacker controlled account without any
2:37obvious signs to the user. Couple
2:39screenshots here from the changes on npm
2:42packages. You can see that the index.js
2:45js or the main file endpoint for a
2:48library or package is modified to now
2:50include what is line 12 here. This
2:53const0x112
2:56fa88 equals blah blah blah. Now
2:58obviously this is word rap. You can see
3:00the giant horizontal line here. That is
3:02the malicious line obviously minified
3:05and obfuscated. So it's nonsensical and
3:07not human readable. You have to
3:09deobuscate it and then you can still
3:10kind of dig through what this thing
3:12might look like. Here's one example.
3:14This was an npm package diff for simple
3:16swizzle. And you could see the diff here
3:18obviously lines with the minus and red
3:21background were removed. Uh plus sign
3:23with a new addition and green background
3:25is what was added. Quicks or qiix. I
3:28think one of the main names for the
3:30dependency and maintainer owner for all
3:32of this. Uh could see the change in
3:34index.js where you have now this big
3:37long line. I'll tell you a little bit
3:38more about that malicious line of code
3:41in just a second. Of course, the Akaido
3:43blog does dig into it, but the fishing
3:45email is kind of interesting here. The
3:47maintainer had shared, and this was a
3:48post on Blue Sky. We can see some of the
3:51back and forth between Charlie Ericson,
3:53the author of the Akaido blog post, kind
3:55of doing all the back and forth, and he
3:57discusses how the email came from
3:59support npmjs.help.
4:02And here is the email rendered and
4:04displayed a little bit. You can see a
4:06fake npm logo hide their username as
4:09part of their ongoing commitment to
4:10security blah blah blah. Sketchy link to
4:13update 2FA now. Now the domain
4:15npmjs.help
4:17was registered just 3 days ago on
4:19September 5th. Kind of wild though. We
4:21see a little bit later attackers
4:23targeting another npmjs package
4:26maintainer. This package prototinkerwc
4:28[Music]
4:29uh we can see the entry now contains
4:32some malicious code. And scrolling down,
4:33it is the exact same line. Like the
4:36obfuscation of what would be the
4:38JavaScript included here is copy paste
4:40from the original. I don't know if that
4:42is to say, okay, that was the same bad
4:44actor or uh malicious individual that
4:47was compromising and had taken over
4:48after the two-factor authentication fish
4:51social engineering lore that had
4:53compromised Quicks QIX. But at the very
4:56least, it's seen again. Now, I know I've
4:59been making light of this a little bit
5:00jovially in the video title and the
5:02intro to this video, right? Because I
5:05don't know, this has a lot of different
5:06dimensions to it. Yes, of course,
5:08obviously, ginormous supply chain
5:11compromise and attack due to simply the
5:13number of weekly downloads for each of
5:15these packages and the sheer number of
5:17packages that were compromised. And it
5:19is wild that compromising one
5:22individual, one developer has this
5:24ripple effect across so many things in
5:28our industry, across technology,
5:30services, software, things that we use
5:32day-to-day, right? But I also am
5:35cognizant that this was a crypto
5:39stealer. That's the payload, right?
5:41That's the malware, the malicious line
5:42of code that would have detonated as
5:44these packages were pulled down and
5:45used. And that's it. Now, of course,
5:49this could have been much worse. It
5:50could be egregious, but it went for
5:54crypto wallets again. So, the first
5:57GitHub advisory thing that's like, "Oh,
5:58this machine, anything that used this
6:00package must be considered fully
6:01compromised. Rotate machine, password,
6:03secrets, all the things." That was just
6:05a little too alarmist for me. So, let me
6:07show you one last writeup. This came
6:09from Security Alliance, uh, Seal Intel.
6:12I'll include a link to all of these in
6:13the video description, but oops, no
6:16victims. the largest supply chain attack
6:18stole 5 cents. And I really like this
6:21writeup. I think this is probably the
6:23most uh comprehensive one with a little
6:25bit more of the nerd details and the
6:26gory guts that I think we're interested
6:28in. They link at the absolute timestamp
6:30when this all happened. Uh Charlie
6:32Ericson's post to notifying quicks or
6:35bad at computer. Hey, your npm account
6:38seems to have been compromised. 1 hour
6:39ago. It started posting these packages
6:41with back doors to all of your popular
6:42packages. And collectively, yes, these
6:45packages have over 2 billion downloads a
6:47week, making this likely the largest
6:48supply chain attack in history. We saw
6:50the fishing email already. Uh,
6:52npmjs.help
6:54is now down. We cannot access that,
6:56unfortunately. I wonder if it's on
6:58Wayback Machine. npmjs.help.
7:01Oo, September 8th. Do they have it?
7:04That'd be bonkers. Ah,
7:08so did it have the exact link? Because
7:10the homepage is here. obviously cloned
7:13to look like real MPM website. Record
7:16show that that domain once resolved to
7:17IP address 185.7.81.108
7:21email contained a link to this. Okay,
7:23here's the full link. Can I check way
7:25back machine with that please? A one of
7:28the scripts loaded was the credential
7:30stealer which can be found here. Okay,
7:32cool. So we do have the full JavaScript
7:35that would have been trying to steal the
7:37victim's credentials, username and
7:39password and two factor authentication
7:41to be able to log in to npm. This was
7:45the original again obfuscated to hell
7:47for what JavaScript is and does. The
7:50snippets to take a look at here are how
7:52it's retrieving after it hey gets your
7:55username or password. It uses this get
7:57URL function and that includes the
8:00parameters that would have all of the
8:02information that has just been entered
8:04on the web page and it does that for
8:06both the username and password and their
8:08onetime pad onetime password two-factor
8:10authentication thing as well as the
8:12recovery codes if they were to be asked
8:14for. So the get URL function, no matter
8:16what they pass in as the parameters
8:17here, we can see that being called just
8:19above that funnels it off as URL
8:22parameters like the question mark at the
8:24very end of an address to
8:26websocket-apiublicvm.com
8:29images JPEG.png.php.
8:31Nice. Is that one still up? I mean it's
8:36responding. That is their method of
8:38exfiltration, right? That's how the
8:39attacker is receiving and collecting all
8:42the information that the victim
8:43provided. Malware analysis though. Once
8:45the account was compromised, the
8:46attacker published updates to all
8:48packages and embedded a crypto stealer.
8:50A sample from one such package can be
8:52found here. So here they have this de
8:55obfuscated the best that they can. And
8:57you can see this check ethereum w
8:59function that's going to end up looking
9:01for window.ethereum
9:03and running a couple functions here and
9:05there. I'm not going to drag us through
9:07all of this obviously because you can
9:09make sense of and the uh article
9:11security alliance showcases it just as
9:12well. But obviously there are a boatload
9:15of cryptocurrency addresses that it's
9:17using to hot swap in place and replace
9:20any actual transactions or anything that
9:22might be sent to an attacker controlled
9:25wallet so they get money rather than the
9:27intended recipient. The stealer is not
9:30designed for desktop environments and it
9:32does not attempt to read any files or
9:34even install any malware. Rather, it
9:36checks if window.ethereum exists and if
9:39so, it installs hooks on different
9:41functions like request, send, and send
9:44async. It also overwrites the fetch and
9:46http request prototype open and
9:49prototype send functions. If
9:51windowetheum is hooked successfully, it
9:54intercepts both Ethereum and Salana
9:56requests. For Ethereum requests, it
9:58overwrites a destination address to any
10:00of the functions called to the attacker
10:02controlled wallet address. For Salana
10:04requests, it overwrites the recipient
10:06destination and keys on each account to
10:091 91111, effectively breaking the
10:12transaction. any regular normal HTTP
10:15communications over fetch or XML HTTP
10:18request. It overwrites all JSON
10:20responses and then performs a simple
10:22string replace on anything that looks
10:24like a crypto address with 280
10:28hard-coded addresses. That's the big
10:30dump of all the Bitcoin addresses or
10:32cryptocurrency wallet addresses you saw.
10:34Here's the thing. Here's where the
10:36important tidbit for this video. Despite
10:38the magnitude of the breach and all of
10:40those different packages and however
10:41many billion million zillion quadrillion
10:44downloads they get a week, the attacker
10:46appears to have only stolen around 5
10:49cents of Ethereum and 20 US of a
10:53memecoin with a whooping $588
10:57of trading volume over the past 24
10:59hours. And granted, this just happened
11:02and I think from what I understand is
11:04all cleaned up now. All the packages
11:06have okay now been put back in place to
11:09not be including a crypto stealer. So
11:12the crypto stealer stole
11:15couple bucks largest supply chain attack
11:17in history. Let me get to the actual
11:20like important tactical and actionable
11:22stuff though. If you are a package
11:23maintainer uh you could use a lot of the
11:25tooling from uh this bullet points here
11:28checking your modules file to see if it
11:30has that check ethereum w function. You
11:32can check your npm cache with other
11:34scripts that they provided. So big
11:36thanks to that. These are just regular
11:39bash script syntax command echo blah
11:41blah blah and even check your entire
11:43project. So again I will include a link
11:45to this blog in the video description.
11:48So if this is tactical for you, you can
11:50go reference those resources. Big long
11:51list of indicators of compromise. But I
11:54think the takeaway here is that this
11:57actually is kind of like a a fine
12:00experiment and test to see do you know
12:04the packages and libraries and
12:06dependencies that are in your entire
12:08codebase for any software for any
12:10project whatever do you have
12:11realistically a software bill of
12:13materials or sboom sbomb that includes
12:17all the ingredients for the recipe that
12:20is your code. Can you tell me that you
12:23are using the version of simple swizzle
12:26color is array whatever because unless
12:28you're a crypto bro right uh yes the
12:32packages had a lot of weekly downloads
12:34but the community acted quickly so the
12:36malware packages had zero downloads
12:39according to NPPM I don't know if it's
12:40strictly exactly zero because a couple
12:43of those did go to the wallet but it was
12:44removed all these things were cleaned up
12:46in less than an hour the malware just
12:48targeted crypto wallets so it's not the
12:51oh my god the sky is falling largest
12:53supply chain attack in history. Yes, I
12:56sort of kind of it is. But the impact
13:00pennies other than the manh hours and
13:03time and whatever resource, money,
13:05financial work that hopefully goes into
13:07you now being able to analyze and assess
13:09and understand am I affected regardless
13:12of it's crypto or not because okay you
13:14should have software build materials be
13:16able to query inventory know and have
13:18the visibility as to those things. Arda,
13:22who we've uh referenced before in other
13:24videos, says, "Hey, I checked the
13:25Ethereum address of the thread actor TA
13:28and not much drained." If we take a look
13:30here at the very top, you can see that
13:32same address that was mentioned in the
13:33blog and article. And if I go all the
13:35way to the very end, it's made 20 bucks.
13:39So, if anything, lessons learned or
13:41whatever, maybe. Sure. I don't know. Is
13:44that the state of cyber security? One
13:46developer gets spearfished and then tons
13:48of folks end up screaming and shouting
13:49compromised with yeah crypto stealer I
13:52don't know but gentle reminder uh
13:55software bill of materials sbombs are
13:57really what we should kind of harp on
14:00just so you know whether or not you're
14:02actually affected if it were to be
14:04something much bigger or much worse than
14:08crypto steelers again.