9 ms·

Plot to steal cryptocurrency foiled by NPM

83 points by soheilpro 7y ago

koolba 7y ago
Here's a free idea for somebody at NPM or any other third party security provider: Tracking changes to network or fs access across versions It should be possible to scan JS modules to determine either the fixed set of dependencies, the fixed set of system dependencies (ex: require('fs')), or whether it's not determinate (code contains "eval" or otherwise invokes require(...) with a non-constant). Including a package that has fs or net access would automatically include that taint as well. The idea for this is that a malicious package would be more easily noticed as something like leftpad(...) suddenly requiring net access should be flagged. It's not a panacea as something malicious that already has fs or net access could do something new, but it would help add some sanity checks and give a smaller set of packages and versions to manually review. I think deno (Node.js creator's new project using Typescript + Golang) has a similar idea but built in to the individual packages themselves where they need to explicitly include permissions for fs, net, etc. That'd be a great idea but getting to that point from the current (and growing) Node.js/NPM world is going to take a while.
- 781 7y ago
  This is a losing game (think halting problem). This exact scenario was played by antivirus software versus malware in the 90s/00s. The antivirus was trying to figure out if the binary did something like modify a file on disk, while the virus was trying to obfuscate that or find innovative ways of doing it. A isolation/capability solution is the only one that could work, leftpad shouldn't have access to anything but basic CPU compute.
- aasasd 7y ago
  Have a look at JSFuck: http://www.jsfuck.com http://www.jsfuck.com
34679 7y ago
Doesn't add up if you look at the dates they claim the malware was injected and the dates of the most recent transactions of all the addresses swept. Some of those addresses hadn't been used in over a year.
jjn2009 7y ago
These issues are entirely caused by NPM in the first place. Anyone who starts a node project ends up with a massive web of unaudited code which can only be dealt with my moving off NPM and adding packages to your own private repo after youve audited them yourself. Which is an almost impossible task.
NetOpWibby 7y ago
I cannot wait for Entropic[1] to take off so I can just use that (and also replace my self-hosted Verdaccio with it). [1] https://github.com/entropic-dev/entropic https://github.com/entropic-dev/entropic
nwrk 7y ago
Good write up and great job of NPM security team. Thanks!
theamk 7y ago
Does anyone know how this was done? Was it some sort of automatic AI system? Dedicated people watching update feeds 24/7? Random person noticing github commit and notifying npm?
- ben_jones 7y ago
  Wouldn't be too hard to monitor drastic changes to packages, or monitor for packages like cryptomining being added to an otherwise bland set of dependencies. The bottom line is NPM should start warning people that this is a COMMON occurrence, how many NPM users are novices or bootcamp grads who don't even know that it happens?
- motohagiography 7y ago
  Obvious way to do this would be with some variation of ranking the edit distance or simple entropy differences, and alerting/prioritizing significant updates for further scrutiny in another workflow pipeline. Bug fixes are relatively low distace, where a new module would show up as a bump. It would FP on code cleanups, but who actually does those. There are more sophisticated methods than these used in products today, but this is something an amateur could implement. Compute is huge, but cost/benefit is a product problem. Some string searches would be easy wins as well, given wallet file names, detecting new public keys, etc. Can think of a few AV products that would benefit users by being able to state an app has added an update that resembles a new module with functionality they might not have signed up for in the original EULA. If you are an enterprise customer, I'd ask your AV vendor for it as a feature. Realistically, the best control is don't put a cryptocurrency wallet on a device that has automatic updates from untrusted sources.
neonate 7y ago
"The attack was carried out by using a pattern that is becoming more and more popular; publishing a ‘useful’ package (electron-native-notify) to npm, waiting until it was in use by the target, and then updating it to include a malicious payload." Gary Bernhardt has an interesting comment: https://twitter.com/garybernhardt/status/1137459482135416832 https://twitter.com/garybernhardt/status/1137459482135416832
- cortesoft 7y ago
  Yeah, the fact that a pull request to add a dependency that did so little went through unchallenged is the real scary part.
- zaphirplane 7y ago
  I dont see what’s special about npm compared to pip, gem, nuget, maven as tools
- jw1224 7y ago
  re: Bernhardt's tweet — > This is exactly what many of us predicted when NPM introduced a world of thousands of separate dependencies per app. The main reactions to that skepticism were "stop being so negative" and "don't try to stop progress." I'm sure "many of us" predicted planes would crash when they first took flight, but nonetheless the benefits of commercial air travel vastly outweigh the risks. npm, having been a huge benefit to developers and the JS ecosystem for many years, should not have its problems dismissed with an "I told you so" attitude.
  - drngdds 7y ago
    The problems with the JS ecosystem probably could have been solved in a way that doesn't involve every nontrivial project dynamically downloading thousands of transitive dependencies by god-knows-who. It's not like package repositories and dependency management were uncharted waters before npm came along.
    - dboreham 7y ago
MoronInAHurry 7y ago
NPM foils plot that was only possible due to ridiculous house of cards built by NPM. I notice that the NPM blog post also fails to mention that it was actually successful and resulted in about 1 million KMD (current value ~$1.7M) being stolen. The Komodo blog post contains that information: https://komodoplatform.com/update-agama-vulnerability/ https://komodoplatform.com/update-agama-vulnerability/ Even worse, they had also successfully stolen about 9 times more than that. The only reason it was prevented was because the seeds were being sent to a public server, and Komodo was able to access and use them to "steal" the 8 million coins (and 96 BTC) from those wallets before the attacker did. This was a successful $10M+ theft that NPM is somehow trying to spin into a positive.
- spyder 7y ago
  Hm... to claim the coins they saved, you have to receive and send a small transaction from the compromised wallet to verify ownership. But how do they make sure that it's not claimed by the hackers who may have the seed of these wallets? The only thing they say is that they don't send it if there is multiply claims (probably one from hacker and one from real owner).
- aasasd 7y ago
  I went straight to the comments on this HN submission because I knew NPM couldn't just be good guys.
- matthewbauer 7y ago
  I don’t think it’s fair to single npm out here. The truth is any package manager that lets anyone publish package updates is vulnerable to this type of attack.
  - matthewbauer 7y ago
    Semver probably makes the problem worse though.
    - wheelerwj 7y ago
GordonS 7y ago
I posted this a couple of days ago, but I guess at the wrong time of day - when I saw it got no interest, I thought "I'll bet this is one of those articles that someone else posts later, that the mods let through"! This comment is a bit meta, but I actually really like this "second chance" feature of hacker news. Mods could in theory "boost" such stories by making them sticky, but I like this kind of hands-off, no-meddling approach :)
- xigency 7y ago
  I received an email from Dan once recommending I repost a Show HN submission I had made that had no hits. Hacker News is pretty well moderated overall.
progval 7y ago
I expected the article to explain how they detected it, but it's reduced to just: > After being notified by our internal security tooling of this threat
PunchTornado 7y ago
if you're dealing with money, you shouldn't install any dependency unless you run a security check. you should never update a dependency unless you run a security check. this isn't npm's fault.
- cortesoft 7y ago
  Yeah, but it is so common in the NPM world that no one batted an eye when it was added.
- detaro 7y ago
  What does "run a security check" entail?
- acdha 7y ago
  I get where you’re coming from, but doesn’t that mean you need at least one full time security auditor just to keep pace? Node projects seem to pretty quickly hit hundreds or thousands of dependencies, which means updates happen most days.
  - siriusfeynman 7y ago
    > But doesn’t that mean you need at least one full time security auditor just to keep pace Crazy idea - maybe you shouldn't be writing financial software if you're not going to audit the code that you're using

83 points by soheilpro 7y ago

Here's a free idea for somebody at NPM or any other third party security provider: Tracking changes to network or fs access across versions It should be possible to scan JS modules to determine either the fixed set of dependencies, the fixed set of system dependencies (ex: require('fs')), or whether it's not determinate (code contains "eval" or otherwise invokes require(...) with a non-constant). Including a package that has fs or net access would automatically include that taint as well. The idea for this is that a malicious package would be more easily noticed as something like leftpad(...) suddenly requiring net access should be flagged. It's not a panacea as something malicious that already has fs or net access could do something new, but it would help add some sanity checks and give a smaller set of packages and versions to manually review. I think deno (Node.js creator's new project using Typescript + Golang) has a similar idea but built in to the individual packages themselves where they need to explicitly include permissions for fs, net, etc. That'd be a great idea but getting to that point from the current (and growing) Node.js/NPM world is going to take a while.

781 7y ago
This is a losing game (think halting problem). This exact scenario was played by antivirus software versus malware in the 90s/00s. The antivirus was trying to figure out if the binary did something like modify a file on disk, while the virus was trying to obfuscate that or find innovative ways of doing it. A isolation/capability solution is the only one that could work, leftpad shouldn't have access to anything but basic CPU compute.
aasasd 7y ago
Have a look at JSFuck: http://www.jsfuck.com http://www.jsfuck.com

34679 7y ago

Doesn't add up if you look at the dates they claim the malware was injected and the dates of the most recent transactions of all the addresses swept. Some of those addresses hadn't been used in over a year.

jjn2009 7y ago

These issues are entirely caused by NPM in the first place. Anyone who starts a node project ends up with a massive web of unaudited code which can only be dealt with my moving off NPM and adding packages to your own private repo after youve audited them yourself. Which is an almost impossible task.

NetOpWibby 7y ago

I cannot wait for Entropic[1] to take off so I can just use that (and also replace my self-hosted Verdaccio with it). [1] https://github.com/entropic-dev/entropic https://github.com/entropic-dev/entropic

nwrk 7y ago

Good write up and great job of NPM security team. Thanks!

theamk 7y ago

Does anyone know how this was done? Was it some sort of automatic AI system? Dedicated people watching update feeds 24/7? Random person noticing github commit and notifying npm?

ben_jones 7y ago
Wouldn't be too hard to monitor drastic changes to packages, or monitor for packages like cryptomining being added to an otherwise bland set of dependencies. The bottom line is NPM should start warning people that this is a COMMON occurrence, how many NPM users are novices or bootcamp grads who don't even know that it happens?
motohagiography 7y ago
Obvious way to do this would be with some variation of ranking the edit distance or simple entropy differences, and alerting/prioritizing significant updates for further scrutiny in another workflow pipeline. Bug fixes are relatively low distace, where a new module would show up as a bump. It would FP on code cleanups, but who actually does those. There are more sophisticated methods than these used in products today, but this is something an amateur could implement. Compute is huge, but cost/benefit is a product problem. Some string searches would be easy wins as well, given wallet file names, detecting new public keys, etc. Can think of a few AV products that would benefit users by being able to state an app has added an update that resembles a new module with functionality they might not have signed up for in the original EULA. If you are an enterprise customer, I'd ask your AV vendor for it as a feature. Realistically, the best control is don't put a cryptocurrency wallet on a device that has automatic updates from untrusted sources.

neonate 7y ago

"The attack was carried out by using a pattern that is becoming more and more popular; publishing a ‘useful’ package (electron-native-notify) to npm, waiting until it was in use by the target, and then updating it to include a malicious payload." Gary Bernhardt has an interesting comment: https://twitter.com/garybernhardt/status/1137459482135416832 https://twitter.com/garybernhardt/status/1137459482135416832

cortesoft 7y ago
Yeah, the fact that a pull request to add a dependency that did so little went through unchallenged is the real scary part.
zaphirplane 7y ago
I dont see what’s special about npm compared to pip, gem, nuget, maven as tools
jw1224 7y ago
re: Bernhardt's tweet — > This is exactly what many of us predicted when NPM introduced a world of thousands of separate dependencies per app. The main reactions to that skepticism were "stop being so negative" and "don't try to stop progress." I'm sure "many of us" predicted planes would crash when they first took flight, but nonetheless the benefits of commercial air travel vastly outweigh the risks. npm, having been a huge benefit to developers and the JS ecosystem for many years, should not have its problems dismissed with an "I told you so" attitude.
- drngdds 7y ago
  The problems with the JS ecosystem probably could have been solved in a way that doesn't involve every nontrivial project dynamically downloading thousands of transitive dependencies by god-knows-who. It's not like package repositories and dependency management were uncharted waters before npm came along.
  - dboreham 7y ago

MoronInAHurry 7y ago

NPM foils plot that was only possible due to ridiculous house of cards built by NPM. I notice that the NPM blog post also fails to mention that it was actually successful and resulted in about 1 million KMD (current value ~$1.7M) being stolen. The Komodo blog post contains that information: https://komodoplatform.com/update-agama-vulnerability/ https://komodoplatform.com/update-agama-vulnerability/ Even worse, they had also successfully stolen about 9 times more than that. The only reason it was prevented was because the seeds were being sent to a public server, and Komodo was able to access and use them to "steal" the 8 million coins (and 96 BTC) from those wallets before the attacker did. This was a successful $10M+ theft that NPM is somehow trying to spin into a positive.

spyder 7y ago
Hm... to claim the coins they saved, you have to receive and send a small transaction from the compromised wallet to verify ownership. But how do they make sure that it's not claimed by the hackers who may have the seed of these wallets? The only thing they say is that they don't send it if there is multiply claims (probably one from hacker and one from real owner).
aasasd 7y ago
I went straight to the comments on this HN submission because I knew NPM couldn't just be good guys.
matthewbauer 7y ago
I don’t think it’s fair to single npm out here. The truth is any package manager that lets anyone publish package updates is vulnerable to this type of attack.
- matthewbauer 7y ago
  Semver probably makes the problem worse though.
  - wheelerwj 7y ago

GordonS 7y ago

I posted this a couple of days ago, but I guess at the wrong time of day - when I saw it got no interest, I thought "I'll bet this is one of those articles that someone else posts later, that the mods let through"! This comment is a bit meta, but I actually really like this "second chance" feature of hacker news. Mods could in theory "boost" such stories by making them sticky, but I like this kind of hands-off, no-meddling approach :)

xigency 7y ago
I received an email from Dan once recommending I repost a Show HN submission I had made that had no hits. Hacker News is pretty well moderated overall.

progval 7y ago

I expected the article to explain how they detected it, but it's reduced to just: > After being notified by our internal security tooling of this threat

PunchTornado 7y ago

if you're dealing with money, you shouldn't install any dependency unless you run a security check. you should never update a dependency unless you run a security check. this isn't npm's fault.

cortesoft 7y ago
Yeah, but it is so common in the NPM world that no one batted an eye when it was added.
detaro 7y ago
What does "run a security check" entail?
acdha 7y ago
I get where you’re coming from, but doesn’t that mean you need at least one full time security auditor just to keep pace? Node projects seem to pretty quickly hit hundreds or thousands of dependencies, which means updates happen most days.
- siriusfeynman 7y ago
  > But doesn’t that mean you need at least one full time security auditor just to keep pace Crazy idea - maybe you shouldn't be writing financial software if you're not going to audit the code that you're using