Plot to steal cryptocurrency foiled by NPM

https://blog.npmjs.org/post/185397814280/plot-to-steal-cryptocurrency-foiled-by-the-npm

by soheilpro • 7 years ago

83 60 7 years ago

blog.npmjs.org

nwrk• 7 years ago

Good write up and great job of NPM security team. Thanks!

theamk• 7 years ago

Does anyone know how this was done? Was it some sort of automatic AI system? Dedicated people watching update feeds 24/7? Random person noticing github commit and notifying npm?

ben_jones• 7 years ago

Wouldn't be too hard to monitor drastic changes to packages, or monitor for packages like cryptomining being added to an otherwise bland set of dependencies.

The bottom line is NPM should start warning people that this is a COMMON occurrence, how many NPM users are novices or bootcamp grads who don't even know that it happens?

motohagiography• 7 years ago

Obvious way to do this would be with some variation of ranking the edit distance or simple entropy differences, and alerting/prioritizing significant updates for further scrutiny in another workflow pipeline. Bug fixes are relatively low distace, where a new module would show up as a bump. It would FP on code cleanups, but who actually does those. There are more sophisticated methods than these used in products today, but this is something an amateur could implement. Compute is huge, but cost/benefit is a product problem.

Some string searches would be easy wins as well, given wallet file names, detecting new public keys, etc. Can think of a few AV products that would benefit users by being able to state an app has added an update that resembles a new module with functionality they might not have signed up for in the original EULA.

If you are an enterprise customer, I'd ask your AV vendor for it as a feature. Realistically, the best control is don't put a cryptocurrency wallet on a device that has automatic updates from untrusted sources.

neonate• 7 years ago

"The attack was carried out by using a pattern that is becoming more and more popular; publishing a ‘useful’ package (electron-native-notify) to npm, waiting until it was in use by the target, and then updating it to include a malicious payload."

Gary Bernhardt has an interesting comment: https://twitter.com/garybernhardt/status/1137459482135416832

jw1224• 7 years ago

re: Bernhardt's tweet —

This is exactly what many of us predicted when NPM introduced a world of thousands of separate dependencies per app. The main reactions to that skepticism were "stop being so negative" and "don't try to stop progress."

I'm sure "many of us" predicted planes would crash when they first took flight, but nonetheless the benefits of commercial air travel vastly outweigh the risks.

npm, having been a huge benefit to developers and the JS ecosystem for many years, should not have its problems dismissed with an "I told you so" attitude.

drngdds• 7 years ago

The problems with the JS ecosystem probably could have been solved in a way that doesn't involve every nontrivial project dynamically downloading thousands of transitive dependencies by god-knows-who. It's not like package repositories and dependency management were uncharted waters before npm came along.

a-nikolaev• 7 years ago

https://hackernoon.com/im-harvesting-credit-card-numbers-and... -- nice story linked in his thread

NetOpWibby2• 7 years ago

Well that was terrifying.

jeffdavis• 7 years ago

Not entirely fair to npm. The battle is software complexity in general. Perhaps npm made the problem worse, but they hardly started it.

stock_toaster• 7 years ago

And with github's recent "automatically create dep update PR" feature for security notifications, it would presumably be even easier to get people to update to a malicious version. Just claim the old version had a security vulnerability!

cortesoft3• 7 years ago

Yeah, the fact that a pull request to add a dependency that did so little went through unchallenged is the real scary part.

zaphirplane• 7 years ago

I dont see what’s special about npm compared to pip, gem, nuget, maven as tools

MoronInAHurry• 7 years ago

NPM foils plot that was only possible due to ridiculous house of cards built by NPM.

I notice that the NPM blog post also fails to mention that it was actually successful and resulted in about 1 million KMD (current value ~$1.7M) being stolen. The Komodo blog post contains that information: https://komodoplatform.com/update-agama-vulnerability/

Even worse, they had also successfully stolen about 9 times more than that. The only reason it was prevented was because the seeds were being sent to a public server, and Komodo was able to access and use them to "steal" the 8 million coins (and 96 BTC) from those wallets before the attacker did.

This was a successful $10M+ theft that NPM is somehow trying to spin into a positive.

matthewbauer5• 7 years ago

I don’t think it’s fair to single npm out here. The truth is any package manager that lets anyone publish package updates is vulnerable to this type of attack.

matthewbauer5• 7 years ago

Semver probably makes the problem worse though.

SanchoPanda• 7 years ago

NPM isn't being singled out as part of a hypothetical risk analysis, this is about an attack that actually happened via NPM.

dtech• 7 years ago

npm encourages an auto-upgrading versioning scheme: take version x or higher.

It's great for keeping dependencies up-to-date, but this makes it immensely vulnerable to the kind of malware injection, as publishing a library version with payload will immediately propagate throughout the ecosystem.

In most other version managers (e.g. maven) every library and application specifies a hard-coded version, which requires users to manually upgrade, giving a window were a malicious version can be detected before it affects anyone.

GordonS2• 7 years ago

NPM has, specifically and deliberately, played down the successful theft here, making out that they completely foiled it.

If they hadn't done such a scummy, corporate spin job on this, I'd be inclined to agree with you - but they did.

wheelerwj2• 7 years ago

agreed for the most part. "Foiled" is pretty much the wrong word here. Maybe "Detected and halted further loss..."

gcb02• 7 years ago

That's wrong too.

What they did was to allow komodo to, vigilante style, outright steal the coins, and hold them hostage until you entertain them with proof of ownership/identity and whatever other ridiculous requirements they come up with.

But it's npm and kleptocurrency. Nothing of value lost.

Chazprime• 7 years ago

I’m honestly amazed this hasn’t happened more often; it’s ridiculous that a developer has to install thousands of lines of code to create a simple “hello world” website.

fold_left• 7 years ago

[citation needed]

aasasd3• 7 years ago

Guess someone slipped you a wrong thing instead of Node, because for me, about five lines and zero dependencies work fine.

spyder• 7 years ago

Hm... to claim the coins they saved, you have to receive and send a small transaction from the compromised wallet to verify ownership. But how do they make sure that it's not claimed by the hackers who may have the seed of these wallets? The only thing they say is that they don't send it if there is multiply claims (probably one from hacker and one from real owner).

aasasd3• 7 years ago

I went straight to the comments on this HN submission because I knew NPM couldn't just be good guys.

GordonS2• 7 years ago

I posted this a couple of days ago, but I guess at the wrong time of day - when I saw it got no interest, I thought "I'll bet this is one of those articles that someone else posts later, that the mods let through"!

This comment is a bit meta, but I actually really like this "second chance" feature of hacker news. Mods could in theory "boost" such stories by making them sticky, but I like this kind of hands-off, no-meddling approach :)

xigency• 7 years ago

I received an email from Dan once recommending I repost a Show HN submission I had made that had no hits. Hacker News is pretty well moderated overall.

progval• 7 years ago

I expected the article to explain how they detected it, but it's reduced to just:

After being notified by our internal security tooling of this threat

PunchTornado• 7 years ago

if you're dealing with money, you shouldn't install any dependency unless you run a security check.

you should never update a dependency unless you run a security check.

this isn't npm's fault.

cortesoft3• 7 years ago

Yeah, but it is so common in the NPM world that no one batted an eye when it was added.

detaro• 7 years ago

What does "run a security check" entail?

acdha• 7 years ago

I get where you’re coming from, but doesn’t that mean you need at least one full time security auditor just to keep pace? Node projects seem to pretty quickly hit hundreds or thousands of dependencies, which means updates happen most days.

siriusfeynman• 7 years ago

But doesn’t that mean you need at least one full time security auditor just to keep pace

Crazy idea - maybe you shouldn't be writing financial software if you're not going to audit the code that you're using

koolba• 7 years ago

Here's a free idea for somebody at NPM or any other third party security provider: Tracking changes to network or fs access across versions

It should be possible to scan JS modules to determine either the fixed set of dependencies, the fixed set of system dependencies (ex: require('fs')), or whether it's not determinate (code contains "eval" or otherwise invokes require(...) with a non-constant). Including a package that has fs or net access would automatically include that taint as well.

The idea for this is that a malicious package would be more easily noticed as something like leftpad(...) suddenly requiring net access should be flagged. It's not a panacea as something malicious that already has fs or net access could do something new, but it would help add some sanity checks and give a smaller set of packages and versions to manually review.

I think deno (Node.js creator's new project using Typescript + Golang) has a similar idea but built in to the individual packages themselves where they need to explicitly include permissions for fs, net, etc. That'd be a great idea but getting to that point from the current (and growing) Node.js/NPM world is going to take a while.

781• 7 years ago

This is a losing game (think halting problem). This exact scenario was played by antivirus software versus malware in the 90s/00s. The antivirus was trying to figure out if the binary did something like modify a file on disk, while the virus was trying to obfuscate that or find innovative ways of doing it.

A isolation/capability solution is the only one that could work, leftpad shouldn't have access to anything but basic CPU compute.

aasasd3• 7 years ago

Have a look at JSFuck: http://www.jsfuck.com

34679• 7 years ago

Doesn't add up if you look at the dates they claim the malware was injected and the dates of the most recent transactions of all the addresses swept. Some of those addresses hadn't been used in over a year.

jjn2009• 7 years ago

These issues are entirely caused by NPM in the first place. Anyone who starts a node project ends up with a massive web of unaudited code which can only be dealt with my moving off NPM and adding packages to your own private repo after youve audited them yourself. Which is an almost impossible task.

NetOpWibby2• 7 years ago

I cannot wait for Entropic[1] to take off so I can just use that (and also replace my self-hosted Verdaccio with it).

[1] https://github.com/entropic-dev/entropic

Plot to steal cryptocurrency foiled by NPM

Related Stories