5 ms·

IRS-authorized eFile.com tax return software caught serving JavaScript malware

46 points by el_duderino 4y ago

costanzaDynasty 4y ago
You already know what I owe or don't owe. Send me a bill in the mail. Americans are generous givers. The reason they hate taxation is because you've made the average person equate taxes with unnecessary gamesmanship and one side honesty. If taxes were simplified, Americans would be willing to pay more. They'd gladly give the yearly cost of their tax prep to be free of the burden.
- BigCryo 4y ago
  But how will Intuit make money for their TurboTax software and how will Congress people get their donations from Intuit? Won't someone please think of the mega corporations!?
  - lockhouse 4y ago
    Tax law also needs to be complicated to hide all the loopholes used by the wealthy to avoid taxes altogether. What we desperately need is a hard reset of the tax code. Simple straightforward progressive tax brackets with no deductions whatsoever. If I overpaid send me a check. If I underpaid send me a bill.
  - WorldMaker 4y ago
    Also, these eFile middlemen/providers "deserve" their cut of fees to make profits for all the hard work they do taking credit card payments and moving funds into Federal bank accounts. It's very hard work, I'm sure.
- PopAlongKid 4y ago
  >You already know what I owe or don't owe. No, they don't. They don't know if you acquired a dependent or lost one. They don't know if you are entitled to an EV credit. They don't know if you are landlord with rental income and expenses. They don't know if you donated to charity. The list goes on and on. > If taxes were simplified, Americans would be willing to pay more Any support for that claim?
  - orf 4y ago
    The tax authority doesn’t know if you’re a landlord? That hard to believe.
    - PopAlongKid 4y ago
      Suppose I make your acquaintance and end up renting my second home to you starting next month. How would the IRS know anything about that? Even if they know I was a landlord in a prior year, they still have no way to know how much rent I received during the year, or what my expenses were.
      - orf 4y ago
        Because you have a contract, and that contract would be registered? And if you don’t have a contract, that’s a recipe for abuse of rights and tax evasion.
        PopAlongKid 4y ago
        There is no requirement to have a written contract with a tenant, or to register it with anyone, to be a landlord. The IRS in fact never asks and does not know the identity of your tenants.
        orf 4y ago
        > There is no requirement to have a written contract with a tenant Sounds horrific > The IRS in fact never asks and does not know the identity of your tenants. Why is that a requirement to registering a contract? You’re just registering the rent, address and length.
  - WorldMaker 4y ago
    > They don't know if you acquired a dependent or lost one. In many cases they do. Births need to be certified at the time. Adoptions and fosters and guardianships have their own paperwork that needs to be filed and sometimes court time. Deaths need to be certified at the time. > They don't know if you are entitled to an EV credit. Cars need to be registered and plated. > They don't know if you are landlord with rental income and expenses. Landlords can already setup income tax disclosure and withholding on rentals at the time of accrual, just about the same as any other job. It doesn't need to be an "April surprise" non-withheld lump sum to the IRS (and it probably shouldn't ever be, but I'm not your CPA). Expense-related tax credits are certainly a complication, but that's probably tax credits that should be simplified anyway. If it was desired to keep them, it would probably make sense to report them as frequently and as timely as income tax withholding is allowed to be. The only real complication to most of the above is that in the current US federal system a lot of the data is state-managed (birth/death certificates, car registrations, etc) and there'd need to be some way to, uh, federate that data in a safe way. But some of that data already needs to be "federated" anyway (SSNs key off of birth certificates).
BigCryo 4y ago
looks at Intuit
_fat_santa 4y ago
Hmm they said that the malware came from a JS file called 'popper.js' and looking at their site it looks like they are using Bootstrap. Based on this sounds like a supply chain attack.
- lockhouse 4y ago
  I’m honestly surprised this sort of thing doesn’t happen more often. One of the fastest ways to monetize an open source software package is to sell your GitHub login to a bad actor or put malware in it yourself. It would be extremely easy for a state level actor to compromise an npm dependency through bribery or blackmail.
  - FezVrasta 4y ago
    Popper.js maintainer here, we haven't been compromised. They just injected the malware in that position but the malware didn't come from our npm release
PopAlongKid 4y ago
>Note, this security incident specifically concerns eFile.com and not identical sounding domains or IRS' e-file infrastructure. What exactly does the author think "IRS-authorized" means?
- SpaghettiCthulu 4y ago
  Probably means authorized by the IRS in some way, either as a stamp of approval or specifically authorized to use some sort of e-file api.
- axsharma 4y ago
  The author here. The name eFile(.)com is bound to confuse some readers who may mistake it for IRS' e-file system/API. Probably why the company chose that brand name (SEO or whatever). IRS-authorised software providers (who need to apply and get certified https://www.irs.gov/e-file-providers/become-an-authorized-e-file-provider https://www.irs.gov/e-file-providers/become-an-authorized-e-... ) include those who can have taxpayers use their software to e-file returns to the IRS. These also include Intuit's TurboTax. Anyway, there's that and confusing domain names likes like e-file(.com) that have got nothing to do with the concerned efile(.com) or the IRS, hence that note. Other media outlets (e.g. https://www.pcworld.com/article/1682428/irs-certified-free-tax-filing-service-caught-spreading-malware.html https://www.pcworld.com/article/1682428/irs-certified-free-t... ) have put similar disclaimers in place for the avoidance of doubt: "(which is a separate, for-profit tax company, despite the identical name to IRS eFile)." Thanks for noticing.
kencausey 4y ago
Here are a couple of very recent ISC SANS posts on the issue: Supply Chain Compromise or False Positive: The Intriguing Case of efile.com [updated - confirmed malicious code] - https://isc.sans.edu/diary/Supply+Chain+Compromise+or+False+Positive+The+Intriguing+Case+of+efilecom+updated+confirmed+malicious+code/29708/ https://isc.sans.edu/diary/Supply+Chain+Compromise+or+False+... Analyzing the efile.com Malware "efail" - https://isc.sans.edu/diary/Analyzing+the+efilecom+Malware+efail/29712/ https://isc.sans.edu/diary/Analyzing+the+efilecom+Malware+ef... edit: Of course I rushed to post this comment before actually looking at the linked story. The story links and credits one of these posts.
- deleted 4y ago
  [deleted]

46 points by el_duderino 4y ago

You already know what I owe or don't owe. Send me a bill in the mail. Americans are generous givers. The reason they hate taxation is because you've made the average person equate taxes with unnecessary gamesmanship and one side honesty. If taxes were simplified, Americans would be willing to pay more. They'd gladly give the yearly cost of their tax prep to be free of the burden.

BigCryo 4y ago
But how will Intuit make money for their TurboTax software and how will Congress people get their donations from Intuit? Won't someone please think of the mega corporations!?
- lockhouse 4y ago
  Tax law also needs to be complicated to hide all the loopholes used by the wealthy to avoid taxes altogether. What we desperately need is a hard reset of the tax code. Simple straightforward progressive tax brackets with no deductions whatsoever. If I overpaid send me a check. If I underpaid send me a bill.
- WorldMaker 4y ago
  Also, these eFile middlemen/providers "deserve" their cut of fees to make profits for all the hard work they do taking credit card payments and moving funds into Federal bank accounts. It's very hard work, I'm sure.
PopAlongKid 4y ago
>You already know what I owe or don't owe. No, they don't. They don't know if you acquired a dependent or lost one. They don't know if you are entitled to an EV credit. They don't know if you are landlord with rental income and expenses. They don't know if you donated to charity. The list goes on and on. > If taxes were simplified, Americans would be willing to pay more Any support for that claim?
- orf 4y ago
  The tax authority doesn’t know if you’re a landlord? That hard to believe.
  - PopAlongKid 4y ago
    Suppose I make your acquaintance and end up renting my second home to you starting next month. How would the IRS know anything about that? Even if they know I was a landlord in a prior year, they still have no way to know how much rent I received during the year, or what my expenses were.
    - orf 4y ago
      Because you have a contract, and that contract would be registered? And if you don’t have a contract, that’s a recipe for abuse of rights and tax evasion.
      - PopAlongKid 4y ago
        There is no requirement to have a written contract with a tenant, or to register it with anyone, to be a landlord. The IRS in fact never asks and does not know the identity of your tenants.
        orf 4y ago
        > There is no requirement to have a written contract with a tenant Sounds horrific > The IRS in fact never asks and does not know the identity of your tenants. Why is that a requirement to registering a contract? You’re just registering the rent, address and length.
- WorldMaker 4y ago
  > They don't know if you acquired a dependent or lost one. In many cases they do. Births need to be certified at the time. Adoptions and fosters and guardianships have their own paperwork that needs to be filed and sometimes court time. Deaths need to be certified at the time. > They don't know if you are entitled to an EV credit. Cars need to be registered and plated. > They don't know if you are landlord with rental income and expenses. Landlords can already setup income tax disclosure and withholding on rentals at the time of accrual, just about the same as any other job. It doesn't need to be an "April surprise" non-withheld lump sum to the IRS (and it probably shouldn't ever be, but I'm not your CPA). Expense-related tax credits are certainly a complication, but that's probably tax credits that should be simplified anyway. If it was desired to keep them, it would probably make sense to report them as frequently and as timely as income tax withholding is allowed to be. The only real complication to most of the above is that in the current US federal system a lot of the data is state-managed (birth/death certificates, car registrations, etc) and there'd need to be some way to, uh, federate that data in a safe way. But some of that data already needs to be "federated" anyway (SSNs key off of birth certificates).

BigCryo 4y ago

looks at Intuit

_fat_santa 4y ago

Hmm they said that the malware came from a JS file called 'popper.js' and looking at their site it looks like they are using Bootstrap. Based on this sounds like a supply chain attack.

lockhouse 4y ago
I’m honestly surprised this sort of thing doesn’t happen more often. One of the fastest ways to monetize an open source software package is to sell your GitHub login to a bad actor or put malware in it yourself. It would be extremely easy for a state level actor to compromise an npm dependency through bribery or blackmail.
- FezVrasta 4y ago
  Popper.js maintainer here, we haven't been compromised. They just injected the malware in that position but the malware didn't come from our npm release

PopAlongKid 4y ago

>Note, this security incident specifically concerns eFile.com and not identical sounding domains or IRS' e-file infrastructure. What exactly does the author think "IRS-authorized" means?

SpaghettiCthulu 4y ago
Probably means authorized by the IRS in some way, either as a stamp of approval or specifically authorized to use some sort of e-file api.
axsharma 4y ago
The author here. The name eFile(.)com is bound to confuse some readers who may mistake it for IRS' e-file system/API. Probably why the company chose that brand name (SEO or whatever). IRS-authorised software providers (who need to apply and get certified https://www.irs.gov/e-file-providers/become-an-authorized-e-file-provider https://www.irs.gov/e-file-providers/become-an-authorized-e-... ) include those who can have taxpayers use their software to e-file returns to the IRS. These also include Intuit's TurboTax. Anyway, there's that and confusing domain names likes like e-file(.com) that have got nothing to do with the concerned efile(.com) or the IRS, hence that note. Other media outlets (e.g. https://www.pcworld.com/article/1682428/irs-certified-free-tax-filing-service-caught-spreading-malware.html https://www.pcworld.com/article/1682428/irs-certified-free-t... ) have put similar disclaimers in place for the avoidance of doubt: "(which is a separate, for-profit tax company, despite the identical name to IRS eFile)." Thanks for noticing.

kencausey 4y ago

Here are a couple of very recent ISC SANS posts on the issue: Supply Chain Compromise or False Positive: The Intriguing Case of efile.com [updated - confirmed malicious code] - https://isc.sans.edu/diary/Supply+Chain+Compromise+or+False+Positive+The+Intriguing+Case+of+efilecom+updated+confirmed+malicious+code/29708/ https://isc.sans.edu/diary/Supply+Chain+Compromise+or+False+... Analyzing the efile.com Malware "efail" - https://isc.sans.edu/diary/Analyzing+the+efilecom+Malware+efail/29712/ https://isc.sans.edu/diary/Analyzing+the+efilecom+Malware+ef... edit: Of course I rushed to post this comment before actually looking at the linked story. The story links and credits one of these posts.

deleted 4y ago
[deleted]