4 ms·

I call bullshit on this: "The attacker is using a public blockchain - immutable, decentralized, impossible to take down - as their C2 server." "There's no host

I call bullshit on this: "The attacker is using a public blockchain - immutable, decentralized, impossible to take down - as their C2 server." "There's no hosting provider to contact, no registrar to pressure, no infrastructure to shut down. The Solana blockchain just... exists. " Yes, but you still need to connect to it. Blocking access to *.solana.com is enough to stop the trojan from accessing its 2nd stage. "Connections to Solana RPC nodes look completely normal. Security tools won't flag it. " Then your security tools are badly configured. Lots of crypto traffic should be treated as a red flag in almost any corporate environment. "there's literally no way to take it down" There is, you just have to accept that Solana goes down with it. Why is A-OK in a work environment.

maccam912 1y ago
There's also the backup C2 path though, via google calendar. Wayyy less of a red flag.
- fxtentacle 1y ago
  I'm surprised that Google hasn't deactivated the link in the 24+ hours since that article went online.
  - dns_snek 1y ago
    That should tell you (everyone) how much these companies actually care about our security the next time they claim to be stripping away our freedoms "for our security".
    - throwaway48476 1y ago
      Google is a malware services company. They make money when someone creates malware OBS and pays Google for it to be the top result.
knallfrosch 1y ago
That blocks Solana only on your corporate network.
djmips 1y ago
Obviously... SMH - what a tough read this blog post was.
iSnow 1y ago
>Yes, but you still need to connect to it. Blocking access to *.solana.com is enough to stop the trojan from accessing its 2nd stage. How is that if you can just run a bunch of Solana RPC servers? For what would you need to access solana.com or a subdomain?
rezonant 1y ago
> There is, you just have to accept that Solana goes down with it. And nothing of value was lost.

maccam912 1y ago

There's also the backup C2 path though, via google calendar. Wayyy less of a red flag.

fxtentacle 1y ago
I'm surprised that Google hasn't deactivated the link in the 24+ hours since that article went online.
- dns_snek 1y ago
  That should tell you (everyone) how much these companies actually care about our security the next time they claim to be stripping away our freedoms "for our security".
  - throwaway48476 1y ago
    Google is a malware services company. They make money when someone creates malware OBS and pays Google for it to be the top result.

knallfrosch 1y ago

That blocks Solana only on your corporate network.

djmips 1y ago

Obviously... SMH - what a tough read this blog post was.

iSnow 1y ago

>Yes, but you still need to connect to it. Blocking access to *.solana.com is enough to stop the trojan from accessing its 2nd stage. How is that if you can just run a bunch of Solana RPC servers? For what would you need to access solana.com or a subdomain?

rezonant 1y ago

> There is, you just have to accept that Solana goes down with it. And nothing of value was lost.