3 ms·

I don’t get it. This malware makes a single https request to https endpoint for which users can affect contents, api.blockcypher.com. This does not seem too mu

by theamk 6y ago

I don’t get it. This malware makes a single https request to https endpoint for which users can affect contents, api.blockcypher.com. This does not seem too much different from many other places which can be changed by user - reddit, hn user profile, airtable, github, comment section at random website, mailing list archive, etc... I’d think the solution is going to be the same, too: contact the server and ask them to block URL. In this case, blockcypher should detect the api calls with the right properties (address, query string, user agent) and return error code on them. If they feel creative, maybe return modified answer which will break malware’s shell parser, but will not affect regular json calls. If the blockcypher refuses to cooperate, you deal with it like you do with bulletproof hosting: add hostname to malicious domain list and block at all protected customers’ sites.

sgeisler 6y ago
Well, the problem with that strategy is that there are many such explorers and returning wrong data isn't in their best interest. Remember that the recipient address doesn't need to be owned by the attacker, it could be one of a big exchange which is of interest. Also the whole process of getting stuff blocked fine granular enough to be viable may slow down blocking enough to be very profitable.
- theamk 6y ago
  Well, generally blocking bot c&c accounts isn’t in anyone’s “best interest”. The amount of traffic those bots generate is negligible, and there is a non-zero overhead to read an email from cybersecurity company, decide if this is legit, and enact the block in question. Still, most companies cooperate. (Thinking about it, I am not quite sure why.. is it a desire to be a good internet citizen? Or fear of being blocked by corporate firewall?) Who owns the recipient address is completely immaterial. So is the existence of other exporters. No one says they have to mess with blockchain or the site’s database - all they need is one api endpoint. How many non-malware accesses are there that use v1 api, query that specific address, use curl user agent, and send ?limit=2 query? I bet none. That script is not flexible at all, it has a single hardcoded URL. Finally, regarding the slow blocking : it is a valid concern, but it exists no matter if there is a blockchain or not. Remember that story about bots using invisible characters in the comments below someone’s Instagram account? I wonder how long it took researchers to explain that those innocuous looking comments from fresh accounts are actually malware related. Or imagine using some sort of foreign-language web forum as C&C: the admins there might not want to cooperate with US-based cyber security researchers at all.
wizeman 6y ago
Maybe that would stop this specific malware, but I'm guessing they could adapt and start incorporating a lightweight (SPV) node which can connect to the P2P bitcoin network and keep track of the transactions associated with a specific address without downloading the blockchain (except for the block headers and the transactions you are interested in, mostly).
- theamk 6y ago
  You mean like DHT, distributed hash table? You don’t need bitcoin for this, just bittorrent. Already done at least in 2016: https://www.cyber.nj.gov/threat-center/threat-profiles/botnet-variants/hajime-botnet https://www.cyber.nj.gov/threat-center/threat-profiles/botne... I do not see what new functionality will bitcoin bring to this.
  - mkj 6y ago
    With bitcoin noone will want to change existing history because that's a forked chain, loss of value for lots of people. With bittorrent you could possibly convince all the hosts to get rid of some malware information which isn't adding much value. That DHT malware link's interesting, thanks.

by theamk 6y ago

sgeisler 6y ago

Well, the problem with that strategy is that there are many such explorers and returning wrong data isn't in their best interest. Remember that the recipient address doesn't need to be owned by the attacker, it could be one of a big exchange which is of interest. Also the whole process of getting stuff blocked fine granular enough to be viable may slow down blocking enough to be very profitable.

theamk 6y ago
Well, generally blocking bot c&c accounts isn’t in anyone’s “best interest”. The amount of traffic those bots generate is negligible, and there is a non-zero overhead to read an email from cybersecurity company, decide if this is legit, and enact the block in question. Still, most companies cooperate. (Thinking about it, I am not quite sure why.. is it a desire to be a good internet citizen? Or fear of being blocked by corporate firewall?) Who owns the recipient address is completely immaterial. So is the existence of other exporters. No one says they have to mess with blockchain or the site’s database - all they need is one api endpoint. How many non-malware accesses are there that use v1 api, query that specific address, use curl user agent, and send ?limit=2 query? I bet none. That script is not flexible at all, it has a single hardcoded URL. Finally, regarding the slow blocking : it is a valid concern, but it exists no matter if there is a blockchain or not. Remember that story about bots using invisible characters in the comments below someone’s Instagram account? I wonder how long it took researchers to explain that those innocuous looking comments from fresh accounts are actually malware related. Or imagine using some sort of foreign-language web forum as C&C: the admins there might not want to cooperate with US-based cyber security researchers at all.

wizeman 6y ago

Maybe that would stop this specific malware, but I'm guessing they could adapt and start incorporating a lightweight (SPV) node which can connect to the P2P bitcoin network and keep track of the transactions associated with a specific address without downloading the blockchain (except for the block headers and the transactions you are interested in, mostly).

theamk 6y ago
You mean like DHT, distributed hash table? You don’t need bitcoin for this, just bittorrent. Already done at least in 2016: https://www.cyber.nj.gov/threat-center/threat-profiles/botnet-variants/hajime-botnet https://www.cyber.nj.gov/threat-center/threat-profiles/botne... I do not see what new functionality will bitcoin bring to this.
- mkj 6y ago
  With bitcoin noone will want to change existing history because that's a forked chain, loss of value for lots of people. With bittorrent you could possibly convince all the hosts to get rid of some malware information which isn't adding much value. That DHT malware link's interesting, thanks.