8 ms·

According to the following blog post, it uses a web API exposed by the Binance Smart Chain (BSC) platform: https://labs.guard.io/etherhiding-hiding-web2-malicio

According to the following blog post, it uses a web API exposed by the Binance Smart Chain (BSC) platform: https://labs.guard.io/etherhiding-hiding-web2-malicious-code-in-web3-smart-contracts-65ea78efad16 https://labs.guard.io/etherhiding-hiding-web2-malicious-code... This diagram show the full flow of the attack: https://miro.medium.com/v2/resize:fit:1400/format:webp/1*by4S5wz1jVZrx_gQYQZKyA.png https://miro.medium.com/v2/resize:fit:1400/format:webp/1*by4... Because reads from blockchain are "free" (meaning, there is no cryptocurrency payment required to read data from the smart contracts on BSC), this is effectively free storage/hosting for the attacker. The malicious code is served by BSC web API. According to the Krebs article, BSC "is aware of the malware abusing its blockchain, and is actively addressing the issue." I am not clear if they are taking this situation Very Seriously(TM), but I assume they are.

gumby 3y ago
Sounds like we should poison this vector (and IPFS) by uploading copyrighted movie torrents to this free storage system. For a change we’d be doing good.
- dmoy 3y ago
  Shoot don't even need a movie, just a picture of Mickey Mouse
  - gumby 3y ago
    At least there would be no way to take down the torrents…
  - fortran77 3y ago
    or CSAM
    - edgineer 3y ago
      already in bitcoin
      - deleted 3y ago
        [deleted]
- yetanotherloss 3y ago
  Comically I was experimenting on this in 2013 or so and came to the conclusion it wasn't worth it except as a joke, something I'm sure lots of other people did too. But combined with the insane browser expectation of being able run unsigned JS and such from anywhere, you could probably host an entire simple text forum on whatever public chain as long as no one cares about it being fast. Direct API is nice but any block chain explorer service would work in a pinch.
- yjftsjthsd-h 3y ago
  Your plan is to DOS a system because someone abused it?
  - lazide 3y ago
    I think it was more for the lulz.
Cthulhu_ 3y ago
Reminds me of malware reading a Twitter account that would act as the C&C server.
jbaczuk 3y ago
lol > In response to questions from KrebsOnSecurity, the BNB Smart Chain (BSC) said its team is aware of the malware abusing its blockchain, and is actively addressing the issue. The company said all addresses associated with the spread of the malware have been blacklisted, and that its technicians had developed a model to detect future smart contracts that use similar methods to host malicious scripts. Earlier in the article it said > Due to the publicly accessible and unchangeable nature of the blockchain, code can be hosted ‘on-chain’ without the ability for a takedown... “So you get a free, untracked, and robust way to get your data (the malicious payload) without leaving traces,” Tal said. Make up your mind... It's not robust since you have to use an API (i.e. Binance API) to access the blockchain from a compromised website, then Binance can effectively "take it down" by blocking access via the API. Now if they made the compromised website talk directly to the node on the blockchain network that would be different. Except, why not just host the malware on the website in the first place...
- yieldcrv 3y ago
  the code is still on BSC blockchain and any node will still return the information in those addresses even binance operated nodes the only thing Binance did was do the exact same thing that Cloudflare did, both on their HTTP routes. Binance just had one for convenience and to attract use of their blockchain, which … worked? its actually lazy and amateurish that the hackers are using HTTP to access this code on the blockchain, they dont have to
- numtel 3y ago
  Anybody can spin up a mirror node, even on the mostly centralized BSC. This is just a misunderstanding. Every public blockchain works this way afaik. I've even made a site for hosting webpages on Optimism: https://newgeocities.com https://newgeocities.com The real discussion imo is that blockchain node operators should be pressured to respond to concerns about unwanted content. There's no reason they can't coordinate on filters in the same way Ethereum validators use Flashbots to ignore Tornado Cash transactions. Although I hope they can find a better solution than blocking entire contracts because it's really nice to write a simple contract for data storage. Remember: a contract is a protocol, not a program. The validators follow the instructions but it's more like a database schema to which people submit conforming messages. As the contract creator, you're just publishing your code on chain. Each user takes responsibility for their own data.
financypants 3y ago
Free storage and hosting? Does this mean anyone can store random stuff in smart contracts and read from it for free?
- Gigachad 3y ago
  You have to pay for the initial insert but it's then hosted forever for free. For reads, you can either download the data from nodes in the network which works somewhat like a torrent, or find a service that has a full copy of the blockchain and is providing it via a HTTP interface.
  - quickthrower2 3y ago
    No absolute guarantee of forever.
    - Rastonbury 3y ago
      I guess there are some ways the ethereum network can cease to exist, when that happens there are probably bigger things to worry about
      - quickthrower2 3y ago
        Ethereum network doesn’t serve on 80 or 443
- tomr75 3y ago
  it costs money to store/write a transaction to the chain (transaction fee) - binance smart chain is subsidised so runs at a loss/pretty cheap to store small amounts of data on (if you did this on ethereum would be very expensive) - retrieval is free in that you can use a public RPC to retrieve the data
- deleted 3y ago
  [deleted]
miohtama 3y ago
For the Blockchain reads, someone still needs to host a JSON-RPC server. Most of hosting is commercial SaaS (Infura, QuickNode, LlamaNodes) but Binance provides a free endpoint for better adoption of their chain. This free endpoint has many abuse protection mechanisms, as free services need (see: Cloudflare). However until today no one was hosting any malicious web payloads. It's just matter to add a new abuse rule by BNB Smart Chain team to take this down.
diego_sandoval 3y ago
Why is this considered abuse? Blockchains are for storing data, and these people are storing data on it.
- bryanrasmussen 3y ago
  unless there's been an edit the parent didn't write abuse they wrote malware, which sort of anyway answers your question because we are supposed to consider the aiding and abetting of the malicious purposes of malware to be abusive.

gumby 3y ago

Sounds like we should poison this vector (and IPFS) by uploading copyrighted movie torrents to this free storage system. For a change we’d be doing good.

dmoy 3y ago
Shoot don't even need a movie, just a picture of Mickey Mouse
- gumby 3y ago
  At least there would be no way to take down the torrents…
- fortran77 3y ago
  or CSAM
  - edgineer 3y ago
    already in bitcoin
    - deleted 3y ago
      [deleted]
yetanotherloss 3y ago
Comically I was experimenting on this in 2013 or so and came to the conclusion it wasn't worth it except as a joke, something I'm sure lots of other people did too. But combined with the insane browser expectation of being able run unsigned JS and such from anywhere, you could probably host an entire simple text forum on whatever public chain as long as no one cares about it being fast. Direct API is nice but any block chain explorer service would work in a pinch.
yjftsjthsd-h 3y ago
Your plan is to DOS a system because someone abused it?
- lazide 3y ago
  I think it was more for the lulz.

Cthulhu_ 3y ago

Reminds me of malware reading a Twitter account that would act as the C&C server.

jbaczuk 3y ago

lol > In response to questions from KrebsOnSecurity, the BNB Smart Chain (BSC) said its team is aware of the malware abusing its blockchain, and is actively addressing the issue. The company said all addresses associated with the spread of the malware have been blacklisted, and that its technicians had developed a model to detect future smart contracts that use similar methods to host malicious scripts. Earlier in the article it said > Due to the publicly accessible and unchangeable nature of the blockchain, code can be hosted ‘on-chain’ without the ability for a takedown... “So you get a free, untracked, and robust way to get your data (the malicious payload) without leaving traces,” Tal said. Make up your mind... It's not robust since you have to use an API (i.e. Binance API) to access the blockchain from a compromised website, then Binance can effectively "take it down" by blocking access via the API. Now if they made the compromised website talk directly to the node on the blockchain network that would be different. Except, why not just host the malware on the website in the first place...

yieldcrv 3y ago
the code is still on BSC blockchain and any node will still return the information in those addresses even binance operated nodes the only thing Binance did was do the exact same thing that Cloudflare did, both on their HTTP routes. Binance just had one for convenience and to attract use of their blockchain, which … worked? its actually lazy and amateurish that the hackers are using HTTP to access this code on the blockchain, they dont have to
numtel 3y ago
Anybody can spin up a mirror node, even on the mostly centralized BSC. This is just a misunderstanding. Every public blockchain works this way afaik. I've even made a site for hosting webpages on Optimism: https://newgeocities.com https://newgeocities.com The real discussion imo is that blockchain node operators should be pressured to respond to concerns about unwanted content. There's no reason they can't coordinate on filters in the same way Ethereum validators use Flashbots to ignore Tornado Cash transactions. Although I hope they can find a better solution than blocking entire contracts because it's really nice to write a simple contract for data storage. Remember: a contract is a protocol, not a program. The validators follow the instructions but it's more like a database schema to which people submit conforming messages. As the contract creator, you're just publishing your code on chain. Each user takes responsibility for their own data.

financypants 3y ago

Free storage and hosting? Does this mean anyone can store random stuff in smart contracts and read from it for free?

Gigachad 3y ago
You have to pay for the initial insert but it's then hosted forever for free. For reads, you can either download the data from nodes in the network which works somewhat like a torrent, or find a service that has a full copy of the blockchain and is providing it via a HTTP interface.
- quickthrower2 3y ago
  No absolute guarantee of forever.
  - Rastonbury 3y ago
    I guess there are some ways the ethereum network can cease to exist, when that happens there are probably bigger things to worry about
    - quickthrower2 3y ago
      Ethereum network doesn’t serve on 80 or 443
tomr75 3y ago
it costs money to store/write a transaction to the chain (transaction fee) - binance smart chain is subsidised so runs at a loss/pretty cheap to store small amounts of data on (if you did this on ethereum would be very expensive) - retrieval is free in that you can use a public RPC to retrieve the data
deleted 3y ago
[deleted]

miohtama 3y ago

For the Blockchain reads, someone still needs to host a JSON-RPC server. Most of hosting is commercial SaaS (Infura, QuickNode, LlamaNodes) but Binance provides a free endpoint for better adoption of their chain. This free endpoint has many abuse protection mechanisms, as free services need (see: Cloudflare). However until today no one was hosting any malicious web payloads. It's just matter to add a new abuse rule by BNB Smart Chain team to take this down.

diego_sandoval 3y ago

Why is this considered abuse? Blockchains are for storing data, and these people are storing data on it.

bryanrasmussen 3y ago
unless there's been an edit the parent didn't write abuse they wrote malware, which sort of anyway answers your question because we are supposed to consider the aiding and abetting of the malicious purposes of malware to be abusive.