6 ms·

Dodged a bullet indeed I find it insane that someone would get access to a package like this, then just push a shitty crypto stealer. You're a criminal with a

• com2kid 1y ago
  > You're a criminal with a one-in-a-million opportunity. Wouldn't you invest an extra week pushing a more fledged out exploit? Because the way this was pulled off, it was going to be found out right away. It wasn't a subtle insertion, it was a complete account take over. The attacker had only hours before discovery - so the logical thing to do is a hit and run. They asked what is the most money that can be extracted in just a few hours in an automated fashion (no time to investigate targets manually one at a time) and crypto is the obvious answer. Unless the back doors were so good they weren't going to be discovered even though half the world would be dissecting the attack code, there was no point in even trying.
  • pluto_modadic 1y ago
    "found out right away"... by people with time to review security bulletins. There's loads of places I could see this slipping through the cracks for months.
    • zahlman 1y ago
      Yes, but this is an ecosystem large enough to include people who have that time (and inclination and ability); and once they have reported a problem, everyone is on high alert.
      • wongarsu 1y ago
        If you steal the cookies from dev machines or steal ssh keys along with a list of recent ssh connections or do any other credential theft there are going to be lots of people left impacted. Yes, lots of people reading tech news or security bulletins is going to check if they were compromised and preemptively revoke those credentials. But that's work, meaning even among those informed there will be many who just assume they weren't impacted. Lots of people/organisations are going to be complacent and leave you with valid credentials
        • ameliaquining 1y ago
          If a dev doesn't happen to run npm install during the period between when the compromised package gets published and when npm yanks it (which for something this high-profile is generally measured in hours, not days), then they aren't going to be impacted. So an attacker's patience won't be rewarded with many valid credentials.
          • giveita 1y ago
            Dev, or their IDE, agent, etc.
            • komali2 1y ago
              Their build chain, CI environment, server...
              • ameliaquining 1y ago
                npm ci wouldn't trigger this, it doesn't pick up newly published package versions. I suppose if you got a PR from Dependabot updating you to the compromised package, and happened to merge it within the window of vulnerability, then you'd get hit, but that will likewise not affect all that many developers. Or if you'd configured Dependabot to automatically merge all updates without review; I'm not sure how common that is.
        • 1y ago
    • joshuat 1y ago
      The window of installation time would be pretty minimal, and the operating window would only be as long as those who deployed while the malicious package was up waited to do another deploy.
    • benoau 1y ago
      There's probably already hundreds of thousands of Jira tickets to fix it with no sprint assigned....
      • brazzy 1y ago
        I feel attacked. And very, very happy that we're proxying all access to npm through Artifactory, which allowed us to block the affected versions and verify that they were in fact never pulled by any of our builds.
        • pixl97 1y ago
          About to say, if you're in a company of any size and you're not doing it this way, you're doing it wrong.
        • Aeolun 1y ago
          Only problem is the artifactory instance is on the other side if the world instead of behind the convenient npmjs CDN, so installing packages takes 5x longer..
      • hylaride 1y ago
        Ugh, have some respect. Some of us have PTSD dealing with security issues where the powers that be prevented us dealing with them due to them deprioritizing them during backlog grooming. My last company literally refused to do any security work except CVE turndowns - because it was contractually promised via a customer contract.
    • andrewstuart2 1y ago
      I'm assuming they meant the account takeover was likely to be found out right away. You change your password on a major site like that and you're going to get an email about it. Login from a new location also triggers these emails, though I admit I haven't logged onto NPM in quite a long time so I don't know that they do this. It might get missed, but I sure notice any time account emails come through even if it's not saying "your password was reset."
  • bobbylarrybobby 1y ago
    If they'd waited a week before using their ill-gotten credentials to update the packages, would they have been detected in that week?
    • captn3m0 1y ago
      That is what the tj-actions attacker did: https://unit42.paloaltonetworks.com/github-actions-supply-chain-attack/ https://unit42.paloaltonetworks.com/github-actions-supply-ch...
  • jowea 1y ago
    To be fair, this wasn't a super demanding 0-day attack, it was a slightly targeted email phish. Maybe the attacker isn't that sophisticated and just went with what is familiar?
  • nialv7 1y ago
    > it was a complete account take over is that so? from the email it looks like they MITM'd the 2FA setup process, so they will have qix's 2FA secret. they don't have to immediately start taking over qix's account and lock him out. they should have had all the time they need to come up with a more sophisticated payload.
  • nurettin 1y ago
    > They asked what is the most money that can be extracted in just a few hours in an automated fashion (no time to investigate targets manually one at a time) and crypto is the obvious answer. A decade ago my root/123456 ssh password got pwned in 3-4 days. (I was gonna change to certificate!) Hetzner alerted me saying that I filled my entire 1TB/mo download quota. Apparently, the attacker (automation?) took over and used it to scrape alibaba, or did something with their cloud on port 443. It took a few hours to eat up every last byte. It felt like this was part of a huge operation. They also left a non-functional crypto miner in there that I simply couldn't remove. So while they could cryptolock, they just used it for something insidious and left it alone.
• balls187 1y ago
  > You're a criminal with a one-in-a-million opportunity. Wouldn't you invest an extra week pushing a more fledged out exploit? The plot of Office Space might offer clues. Also isn't it crime 101 that greedy criminals are the ones who are more likely to get caught?
• thewebguyd 1y ago
  > My work laptop, depending on the period of my life, you could have had access to stuff you wouldn't believe either. What gets me is everyone acknowledges this, yet HN is full of comments ripping on IT teams for the restrictions & EDR put in place on dev laptops. We on the ops side have known these risks for years and that knowledge of those risks are what drives organizational security policies and endpoint configuration. Security is hard, and it is very inconvenient, but it's increasingly necessary.
  • balls187 1y ago
    Funny, I read that quote, and assumed it meant something unsavory, and not say, root access to an AWS account.
  • dghlsakjg 1y ago
    I think people rip on EDR and security when 1. They haven’t had it explained why it does what it does or 2. It is process for process sake. To wit: I have an open ticket right now from an automated code review tool that flagged a potential vulnerability. I and two other seniors have confirmed that it is a false alarm so I asked for permission to ignore it by clicking the ignore button in a separate security ticket. They asked for more details to be added to the ticket, except I don’t have permissions to view the ticket. I need to submit another ticket to get permission to view the original ticket to confirm that no less than three senior developers have validated this as a false alarm, which is information that is already on another ticket. This non-issue has been going on for months at this point. The ops person who has asked me to provide more info won’t accept a written explanation via Teams, it has to be added to the ticket. Stakeholders will quickly treat your entire security system like a waste of time and resources when they can plainly see that many parts of it are a waste of time and resources. The objection isn’t against security. It is against security theater.
    • MichaelZuo 1y ago
      This sounds sensible for the “ops person”? It might not be sensible for the organization as a whole, but there’s no way to determine that conclusively, without going over thousands of different possibilities, edge cases, etc.
• root_axis 1y ago
  Stolen cryptocurrency is a sure thing because fraudulent transactions can't be halted, reversed, or otherwise recovered. Things like a random dev's API and SSH keys are close to worthless unless you get extremely lucky, and even then you have to find some way to sell or otherwise make money from those credentials, the proceeds of which will certainly be denominated in cryptocurrency anyway.
  • jimbo808 1y ago
    And it's probably the lowest risk way to profit from this attack
  • buu700 1y ago
    Agreed. I think we're all relieved at the harm that wasn't caused by this, but the attacker was almost certainly more motivated by profit than harm. Having a bunch of credentials stolen en masse would be a pain in the butt for the rest of us, but from the attacker's perspective your SSH key is just more work and opsec risk compared to a clean crypto theft. Putting it another way: if I'm a random small-time burglar who happens to find himself in Walter White's vault, I'm stuffing as much cash as I can fit into my bag and ignoring the barrel of methylamine.
  • babypuncher 1y ago
    Ultimately, stolen cryptocurrency doesn't cause real world damage for real people, it just causes a bad day for people who gamble on questionable speculative investments. The damage from this hack could have been far worse if it was stealing real money people rely on to feed their kids.
    • aspenmayer 1y ago
      You have the context sort of wrong. To do a comparable “real money” heist en masse, you would be stealing from the banks or from the customers of one, or via debit or credit cards. It’s real enough money, but those fraudulent transactions would be covered by existing protections, like FDIC insurance or chargebacks. I don’t think anyone could steal much cash from a single heist from a bank or other hard target, so your analogy is confusing. There is no analogous situation in which “real money” could be stolen from customers or financial institutions or the interchange system that would impinge end users. That’s the whole reason people use them. Even in friendly fraud situations, the money isn’t gone, it’s just frozen, so you might have to wait a month or so to get it unfrozen after the FBI et al clear the source of funds. Sure, if someone takes my grocery money, that’s a real loss, and that’s why I don’t carry large sums of cash. But that isn’t what happened here. Can you explain what you meant so I can understand? I think you had a point, I just don’t think that the risk of the kind of attack in TFA is comparable to someone getting their grocery money stolen, because the financial situation for that individual in-person theft can’t really occur on the same scale as the attack in TFA, and even if it could, that’s kind of on the end user for carrying more cash than they can defend.
• doubleorseven 1y ago
  i fell for this malware once. had the malware on my laptop even with mb in the background. i copy paste and address and didn't even check it. my bad indeed. those guys makes a lot of money from this "one shot" moments
• BoredPositron 1y ago
  As long as we get lucky nothing is going to change.
• jeroenhd 1y ago
  Get in, steal a couple hundred grand, get out, do the exact same thing a few months later. Repeat a few times and you can live worry free until retirement if you know to evade the cops. Even if you steal other stuff, you're going to need to turn it all into cryptocurrency anyway, and how much is an AWS key really going to bring in. There are criminals that focus on extracting passwords and password manager databases as well, though they often also end up going after cryptocurrency websites. There are probably criminals out there biding their time, waiting for the perfect moment to strike, silently infiltrating companies through carefully picked dependencies, but those don't get caught as easily as the ones draining cryptocurrency wallets.
  • scubbo 1y ago
    > do the exact same thing a few months later > one-in-a-million opportunity
  • zingababba 1y ago
    This guy made 66$ - https://x.com/SolanaFloor/status/1965144417565900868 https://x.com/SolanaFloor/status/1965144417565900868
    • sebstefan 1y ago
      I think at this point just retire from cybercrime
  • dylan604 1y ago
    > if you know to evade the cops. step 1: live in a place where the cops do not police this type of activity step 2: $$$$
  • spir 1y ago
    Earlier this year, a crypto app web UI attack stole $1.5 billion. A couple hundred grand is not what these attackers are after.
• paradite 1y ago
  Because it's North Korea and crypto currency is the best assets they can get for pragmatic reasons. For anything else you need a fiat market, which is hard to deal with remotely.
• sim7c00 1y ago
  one in a million opportunity? the guy registered a domain and sent some emails dude. its cheap as hell
  • heywoods 1y ago
    Maybe one in a million is hyperbolic but that’s sorta the game with these attacks isn’t it? Registering thousands upon thousands of domains + tens of thousands of emails until you catch something from the proverbial pond.
  • k4rnaj1k 1y ago
    [dead]
• hombre_fatal 1y ago
  You give an example of an incredibly targeted attack of snooping around manually on someone's machine so you can exfiltrate yet more sensitive information like credit card numbers (how, and then what?) But (1) how do you do that with hundreds or thousands of SSH/API keys and (2) how do you actually make money from it? So you get a list of SSH or specific API keys and then write a crawler that can hopefully gather more secrets from them, like credit card details (how would that work btw?) and then what, you google "how to sell credentials" and register on some forum to broker a deal like they do in movies? Sure sounds a hell of a lot more complicated and precarious than swapping out crypto addresses in flight.
• pianopatrick 1y ago
  Seems possible to me that someone has done an attack exactly like you describe and just was never caught.
• WhyNotHugo 1y ago
  The pushed payload didn't generate any new traffic. It merely replaced the recipient of a crypto transaction to a different account. It would have been really hard to detect. Ex-filtrating API keys would have been picked up a lot faster. OTOH, this modus operandi is completely inconsistent with the way they published the injected code: by taking over a developer's account. This was going to be noticed quickly. If the payload had been injected in a more subtle way, it might have taken a long time to figure out. Especially with all the levenshtein logic that might convince a victim they'd somehow screwed up.
  • SchemaLoad 1y ago
    Not only that, but it picked an address from a list which had similar starting/ending characters so if you only checked part of the wallet address, you'd still get exploited.
• alexvitkov 1y ago
  API/SSH keys can easily be swapped, it's more hassle than it's worth. Be glad they didn't choose to spread the payload of one of the 100 ransomware groups with affiliate programs.
• yieldcrv 1y ago
  yeah a shitty crypto stealer is more lucrative, more quickly monetized, has less OPSEC issues for the thief if done right, easier to launder nobody cares about your trade secrets, or some nation's nuclear program, just take the crypto
• ignoramous 1y ago
  > find it insane that someone would get access to a package like this, then just push a shitty crypto stealer Consumer financial fraud is quite big and relatively harmless. Industrial espionage, otoh, can potentially put you in the cross hairs of powerful and/or rouge elements, and so, only the big actors get involved, but in a targeted way, preferring to not leave much if any trace of compromise.
• boznz 1y ago
  It is not a one-in-a-million opportunity though. I hate to take this to the next level, but as criminal elements wake up to the fact that a few "geeks" can possibly get them access to millions of dollars expect much worse to come. As a maintainer of any code that could gain bad guys access, I would be seriously considering how well my physical identity is hidden on-line.
  • pixl97 1y ago
    As foretold by the prophet https://xkcd.com/538/ https://xkcd.com/538/
  • jongjong 1y ago
    I just made a very similar comment. Spot on. It's laughable to think that this trivial opportunity that literally any developer could pull off with a couple of thousand dollars is a one-in-a-million. North Korea probably has enough money to buy up a significant percentage of all popular npm dependencies and most people would sell willingly and unwittingly. In the case of North Korea, it's really crazy because hackers over there can do this legally in their own country, with the support of their government! And most popular npm developers are broke.
    • tonyhart7 1y ago
      actually, unless you are billionaire or high profile individual You wouldn't get targeted not because they cant but its not worth it many state sponsored attack is well documented in a lot of book that people can read they don't want to add much record because its create buzz
  • SchemaLoad 1y ago
    This is why banks make you approve transactions on your phone now. The fact that a random NPM package can redirect your money is a massive issue
    • cxr 1y ago
      This attack was enabled by the normalization of orgs' aggressive 2FA postures.
• jmull 1y ago
  There's nothing wrong with staying focused (on grabbing the money). Your ideas are potentially lubricative over time, but first it creates more work and risk for the attacker.
• deleted 1y ago
  [deleted]
• deepanwadhwa 1y ago
  What makes you so sure that the exploit is over? Maybe they wanted their secondary exploit to get caught to give everyone a sense of security? Their primary exploit might still be lurking somewhere in the code?
  • pixl97 1y ago
    Well, because it is really easy to diff an npm package. The attacker had access to the user's npm repository only.
• jongjong 1y ago
  Maybe their goal was just surviving, not getting rich. Also, you underestimate how trivial this 'one-in-a-million opportunity' is; it's definitely not a one-in-a-million! Almost anybody with basic coding ability and a few thousand dollars could pull off this hack. There are thousands of libraries which are essentially worthless with millions of downloads and the author who maintains is basically broke and barely uses their npm account anymore. Anybody could just buy those npm accounts under false pretenses for a couple of thousands and then do whatever they want with tens of thousands (or even hundreds of thousands) of compromised servers. The library author is legally within their rights to sell their digital assets and it's not their business what the acquirer does with them.