hhj

Critical FortiManager Vulnerability Exploited in Zero-Day Attacks

Ghhh

23-Oct-2024

8 min read

NPM

Ethereum

Malicious npm packages impersonate popular Ethereum libraries to steal private k...

Recent investigations have revealed two separate but related attacks targeting the Ethereum developer community through malicious npm packages. These attacks involve typosquatting popular Ethereum libraries and inserting malicious code to exfiltrate private keys and compromise developer systems. Understanding these incidents is crucial for safeguarding projects and personal security in the blockchain ecosystem. ### First Attack: Trojanized Ethers Forks Attempting to Steal Private Keys A series of malicious packages were [published](https://blog.phylum.io/trojanized-ethers-forks-on-npm-attempting-to-steal-ethereum-private-keys/) on npm impersonating the widely used [ethers library](https://www.npmjs.com/package/ethers), which facilitates interaction with the Ethereum blockchain and has over 1.3 million weekly downloads. The attacker created packages with names similar to the legitimate library: - `[ethers-mew](https://npm-stat.com/charts.html?package=ethers-mew)` - `[ethers-web3](https://npm-stat.com/charts.html?package=ethers-web3)` - `[ethers-6](https://npm-stat.com/charts.html?package=ethers-6)` - `[ethers-eth](https://npm-stat.com/charts.html?package=ethers-eth)` - `[ethers-aaa](https://npm-stat.com/charts.html?package=ethers-aaa)` - `[ethers-audit](https://npm-stat.com/charts.html?package=ethers-audit)` - `[ethers-test](https://npm-stat.com/charts.html?package=ethers-test)` These packages contain malicious code designed to: - **1. Exfiltrate Ethereum Private Keys:** When a developer instantiated a new Wallet using the malicious library, the code would send the private key to a remote server controlled by the attacker (https://ether-sign.com/api/checkServer). - **2. Gain Unauthorized SSH Access:** The malware attempted to append the attacker's SSH public key to the root user's authorized_keys file, potentially granting the attacker remote SSH access to the developer's machine. ### Technical Details - **Wallet Constructor Modification:** The Wallet class in the malicious package includes additional code that calls a function checkAddress with the private key as an argument. - **Layered Indirection:** The checkAddress function calls another function checkServer, which makes an HTTP POST request to the attacker's server, sending the private key. - **SSH Key Insertion:** A function named superSignKey writes the attacker's SSH public key to the root user's authorized_keys file. - **Obfuscation Tactics:** The attacker uses plausible function names and mimics the structure of the legitimate ethers library to avoid detection. The malicious code is spread across multiple files and modules, making it harder to trace. ### Indicators of Compromise (IOCs) - **Malicious Domain:** ether-sign.com (Registered on October 15, 2023) - **IP Address:** 88.99.95.50 (Hosted on Hetzner Online) - **Attacker's SSH Public Key:** An SSH key associated with the username cp@DESKTOP-7BQLEIP is inserted into the authorized_keys file. --- ### Second Attack: Typosquat of Ethereum-Cryptography Package Sending Private Keys to Remote Server An earlier attack involved typosquatting the widely-used ethereum-cryptography package, which has over 1.2 million downloads and contains cryptographic primitives essential for Ethereum development. The attacker published malicious packages with names similar to the legitimate package: - `ethereum-cryptographyy (note the extra 'y')` - `ethereum-cryptographyyy` Additionally, the attacker created a malicious version of a critical dependency: @jackshanyeshuzi/curvess (typosquat of @noble/curves) ### Malicious Activities - **1. Exfiltration of Private Keys:** The attacker modified the cryptographic functions to send private keys to a server located in China (wallet.cba123.cn). - **2. Maintaining Core Functionality:** The malicious packages retained all the legitimate functionalities to avoid raising suspicion, with the only addition being the code that exfiltrates the private key. - **3. Attempted Obfuscation:** In later versions, the attacker attempted to obfuscate the malicious code, although the obfuscation was relatively amateurish and could still be deciphered upon close inspection. ### Technical Details - **Modified Dependencies:** The attacker changed the package's dependencies to point to the malicious @jackshanyeshuzi/curvess instead of the legitimate @noble/curves. - **Insertion of Malicious Code:** Within the cryptographic functions, specifically in files like weierstrass.js, the attacker inserted code that sends the user's private key to the remote server. - **Server Location:** The domain wallet.cba123.cn is registered in China, and WHOIS records confirm its location. ### Indicators of Compromise (IOCs) Malicious Domain: wallet.cba123.cn Affected Packages and Versions: Multiple versions of `ethereum-cryptographyyy` and @jackshanyeshuzi/curvess were published over a short period. ### Timeline of Malicious Activity - **August 3, 2023:** Initial publication of @jackshanyeshuzi/curvess and ethereum-cryptographyy. - **August 4, 2023:** Multiple updates and additional malicious packages published. The attacker unpublished some packages shortly after publishing them, possibly to avoid detection. --- ### Comparative Analysis #### Attack Vectors Both attacks leveraged typosquatting, creating packages with names similar to popular libraries to deceive developers into installing them. The attackers exploited the trust developers place in widely-used open-source packages, especially those related to cryptography. #### Malicious Payloads - **Private Key Exfiltration:** The primary goal in both attacks was to steal Ethereum private keys, which could lead to immediate financial loss and compromise of blockchain assets. - **System Compromise:** The first attack also attempted to gain SSH access to the developer's machine, potentially allowing the attacker to execute arbitrary commands and access sensitive data. ### Obfuscation Techniques Both attackers attempted to hide their malicious code within legitimate-looking functions and modules. They used plausible function names and maintained the overall structure of the original libraries to avoid detection during casual code reviews. #### Differences The first attack was more aggressive in attempting to gain system-level access through SSH key insertion. The second attack focused solely on exfiltrating private keys and tried to maintain a low profile by keeping the malicious code changes minimal. ### Recommendations #### 1. Vigilance in Dependency Management - **Verify Package Names:** Pay close attention to package names to avoid typosquatting traps. Even a single character difference can indicate a malicious package. - **Check Package Metadata:** Review the number of downloads, version history, and publisher information. New packages with low download counts and recent publication dates should be treated with caution. #### 2. Use Trusted Sources - **Official Repositories:** Whenever possible, use packages from verified publishers or official repositories. - **Package Signing:** Consider using packages that are signed or verified through checksum to ensure integrity. #### 3. Code Review - **Inspect Dependencies:** Before adding new dependencies, especially those handling sensitive operations like cryptography, review the source code if feasible. - **Automated Scanning Tools:** Utilize security tools that can automatically scan dependencies for known vulnerabilities or malicious code patterns. #### 4. Network Monitoring - **Monitor Outgoing Traffic:** Use network monitoring solutions to detect and block unauthorized outbound requests to unknown domains. - **Alert on Suspicious Activity:** Set up alerts for unusual network activities, such as HTTP requests to domains not associated with your development work. #### 5. System Security Practices - **Regular Audits:** Periodically audit system files like authorized_keys to detect unauthorized modifications. - **Least Privilege Principle:** Avoid running development tools and applications with root or administrator privileges unless necessary. - **Update and Patch:** Keep your systems and applications updated to protect against known vulnerabilities. #### 6. Community Awareness - **Report Suspicious Packages:** If you discover a malicious package, report it to the package registry and the wider community. - **Stay Informed:** Keep abreast of security advisories and reports from reputable sources within the developer community.

23-Oct-2024

6 min read

GitLab

Access Token

An analysis of the Internet Archive's data breach via exposed GitLab tokens, com...

The [Internet Archive](https://www.secureblink.com/cyber-security-news/internet-archive-hacked-31-million-users-exposed), a cornerstone of digital preservation, has experienced another significant data breach. This time, the breach occurred through their Zendesk email support platform after threat actors exploited exposed [GitLab](https://www.secureblink.com/cyber-security-news/gitlab-addressed-a-critical-ssrf-flaw-discovered-to-expose-the-orgs'-internal-servers) authentication tokens. Despite prior warnings, the organization failed to rotate these tokens adequately, leading to unauthorized access to sensitive data. ### Background of the Internet Archive Breach Beginning last night, numerous individuals reported receiving unexpected emails in response to old [support tickets](https://developer.zendesk.com/api-reference/ticketing/tickets/ticket-attachments/#show-attachment) submitted to the Internet Archive. These emails, originating from the organization's official Zendesk server, alerted users to the breach: >>> _"It's dispiriting to see that even after being made aware of the breach weeks ago, IA has still not done the due diligence of rotating many of the API keys that were exposed in their gitlab secrets. As demonstrated by this message, this includes a Zendesk token with perms to access 800K+ support tickets sent to info@archive.org since 2018."_ The threat actor emphasized the magnitude of the breach, highlighting access to over 800,000 support tickets submitted since 2018. The authenticity of these emails was verified through email headers that passed all DKIM, DMARC, and SPF authentication checks, confirming they were sent from an authorized Zendesk server. ### Exposure of Personal Identifiable Information (PII) Compounding the severity of the breach, some users had previously uploaded personal identification documents when requesting the removal of content from the Wayback Machine. Depending on the level of access the threat actor had within Zendesk, these sensitive attachments might now be compromised. ![zendesk-emails.jpg](https://sb-cms.s3.ap-south-1.amazonaws.com/zendesk_emails_7a398d2ed5.jpg) ***Email snapshot sent by threat actor to Internet Archive Zendesk (Source: BleepingComputer)*** The Zendesk Attachments API allows users to upload files to support tickets, which are then accessible through links in the agent interface and notification emails. Attachments are represented as JSON objects containing details like file_name, content_type, and content_url. If the threat actor exploited this API, they could have downloaded personal documents submitted by users. ### Timeline and Failure to Act BleepingComputer attempted repetatively to [warn](https://www.bleepingcomputer.com/news/security/internet-archive-breached-again-through-stolen-access-tokens/) the Internet Archive about the exposed GitLab authentication tokens. On October 9th, they reported that the Internet Archive suffered two simultaneous attacks: - 1. A data breach compromising user data for 33 million users. - 2. A DDoS attack orchestrated by a pro-Palestinian group named SN_BlackMeta. While these attacks transpired concurrently, they were perpetrated by different threat actors. Misreporting led many to incorrectly attribute the data breach to SN_BlackMeta, frustrating the actual hacker who then reached out to Secure Blink to claim responsibility and provide details. ![js-alert.jpg](https://sb-cms.s3.ap-south-1.amazonaws.com/js_alert_70e8ef5478.jpg) ***Data Breach Notification on Internet Archive JavaScript Alert (Source: BleepingComputer)*** ### Mechanism of the Breach The initial point of compromise was an exposed GitLab configuration file on one of the Internet Archive's development servers (services-hls.dev.archive.org). This file contained an authentication token that had been exposed since at least December 2022. The threat actor used this token to download the Internet Archive's source code. ![gitlab-token.jpg](https://sb-cms.s3.ap-south-1.amazonaws.com/gitlab_token_9b779b3389.jpg) ***Internet Archive Exposed GitLab Authentication Token (Source: BleepingComputer)*** Within the source code, additional credentials and authentication tokens were discovered, including those for the organization's database management system. This access allowed the hacker to: ### Download the user database. #### Access further source code. **Modify the website.** The threat actor claims to have exfiltrated 7TB of data, though no samples were provided for verification. The inclusion of API access tokens for the Internet Archive's Zendesk support system in the stolen data further exacerbated the situation. **Negligence in Security Practices** Despite multiple warnings from Secure Blink, the Internet Archive failed to rotate the compromised authentication tokens promptly. The threat actor highlighted this negligence in their communication: >> _"Whether you were trying to ask a general question, or requesting the removal of your site from the Wayback Machine, your data is now in the hands of some random guy. If not me, it'd be someone else."_ This statement attempts to underscores the critical importance of proactive security measures and timely responses to potential threats. ### Understanding the Zendesk Attachments API Vulnerability The Zendesk Attachments API is designed to facilitate the uploading and attaching of files to support ticket comments. Key functionalities include: - **Uploading Files:** Users can upload files and attach them to ticket comments. - **Attachment Accessibility:** Attachments appear as links in the agent interface and notification emails. - **Attachment Properties:** Attachments are represented as JSON objects with properties such as content_type, content_url, file_name, size, etc. Given the potential sensitivity of the uploaded files (e.g., personal IDs), unauthorized access to these attachments poses a significant privacy risk. The API documentation specifies that while files are visible to any authenticated user until the upload token is consumed, once associated with a ticket, visibility is restricted. However, in this breach, the threat actor's access to the Zendesk platform could bypass these restrictions. ### Implications for Users and Organizations The breach has several profound implications: - **User Data Exposure:** Personal data, including identification documents, may have been compromised. - **Trust Erosion:** Users may lose confidence in the Internet Archive's ability to safeguard their information. - **Regulatory Scrutiny:** Potential violations of data protection regulations could lead to legal repercussions. ### Recommendations and Preventative Measures #### For Users: - **Monitor Accounts:** Keep an eye on personal accounts for any suspicious activity. - **Change Passwords:** Update passwords for accounts associated with the Internet Archive. - **Identity Protection:** Consider credit monitoring services if personal IDs were uploaded. #### For the Internet Archive and Similar Organizations: - **Rotate Credentials Regularly:** Implement policies for regular rotation of authentication tokens and API keys. - **Audit and Monitor:** Conduct frequent security audits to identify and remediate vulnerabilities. - **Implement Least Privilege Access:** Limit access permissions to only what is necessary for each role. - **Enhance Incident Response:** Develop robust incident response plans to address breaches swiftly. The Internet Archive's data breach is not just a stark reminder of the vulnerabilities that can arise from lapses in security protocols. In an era where data is a critical commodity, both organizations and users must remain super weary. Proactive security measures, timely response to threats, and user education are critical components in safeguarding against such breaches.

21-Oct-2024

6 min read

ESET

Data Wiper

Hackers breached ESET Israel's partner, Comsecure, using legitimate servers to s...

Hackers have breached Comsecure, ESET's exclusive partner in Israel, to conduct a sophisticated phishing campaign targeting Israeli businesses. The attackers utilized legitimate ESET infrastructure to distribute data wiper malware disguised as antivirus software, aiming for destructive attacks on Israeli organizations. ### What Happened? #### Compromise of ESET Israel's Partner On October 8th, a phishing campaign was launched where emails branded with ESET's logo were sent from the legitimate domain eset.co.il. This indicates that the email servers of ESET's Israeli distributor, Comsecure, were compromised. #### Phishing Emails Sent from Legitimate Servers The phishing emails appeared authentic as they passed SPF, DKIM, and DMARC authentication checks. This means that the emails originated from verified ESET servers, making them highly convincing to recipients and difficult for security systems to detect. ### Phishing Campaign Details #### Disguised as ESET's Advanced Threat Defense Team The emails pretended to be from _"ESET's Advanced Threat Defense Team,"_ warning recipients about state-backed attackers targeting their devices. The message leveraged fear of sophisticated threats to prompt immediate action. ### Introduction of "ESET Unleashed" To counter the alleged threat, the email offered a download link to _"ESET Unleashed,"_ purportedly a more advanced antivirus tool. The download link was hosted on the legitimate eset.co.il domain, adding further credibility. #### Malicious Payload Contents of the Downloaded ZIP File The ZIP archive contained: Four legitimate ESET DLL files digitally signed by ESET's code-signing certificate. An unsigned Setup.exe file, which was the malicious data wiper. ### Advanced Evasion Techniques The data wiper employed several evasion tactics: **Anti-Virtualization:** The malware detected virtual environments, making it difficult for researchers to analyze it in virtual machines. **Mutex Usage:** It used a Mutex associated with the [Yanluowang ransomware](https://www.secureblink.com/threat-research/yanluowang-ransomware-linked-to-thieflock-operators) group, potentially to confuse attribution efforts. ### Connection to Legitimate Israeli Websites Upon execution, the malware reached out to www.oref.org.il, a legitimate Israeli news site. This could be a tactic to blend in with normal traffic or verify internet connectivity. ### Impact on Israeli Organizations #### Targeting Cybersecurity Professionals Initial reports indicate that the phishing emails were sent to cybersecurity personnel within Israeli organizations. Compromising these individuals could allow attackers deeper access into secure systems. #### Irreversible Data Destruction The malware is a data wiper designed to irreversibly delete files and corrupt partition tables, making data recovery extremely difficult, if not impossible. #### Lack of Immediate Disclosure Despite the severity of the breach, there was a notable delay in public disclosure from ESET and Comsecure. This lack of transparency may have hindered affected organizations from taking prompt defensive actions. ### Attribution and Political Motivations Embedded Threats and Dates Analysis by cybersecurity experts revealed embedded messages within the malware: > _"Hey ESET, wait for the leak... Doing business with the occupiers puts you in scope!"_ An embedded date was also found, possibly correlating with significant events or other attacks. ### Links to Iranian Threat Actors There are indications that the attack may be linked to Iranian groups such as Handala and CyberToufan, known for: - Using data wipers in attacks against Israel. - Embedding political messages in their malware. - Aiming to sow chaos and disrupt Israel's economy rather than financial gain. ### Technical Details #### File Hashes of Malicious Files **ZIP Archive:** `2d55c68aa7781db7f2324427508947f057a6baca78073fee9a5ad254147c8232` **Setup.exe:** `2abff990d33d99a0732ddbb3a39831c2c292f36955381d45cd8d40a816d9b47a` ### YARA Rule for Detection A YARA rule has been shared by Kevin Beaumont to aid in detecting the malware: `rule ESETIsraelWiper` { `strings:` `$a = "Hey ESET, wait for the leak.. Doing` `business with the occupiers puts you in scope!"` `condition:` `$a` `}` ### ESET's Response ESET has added an antivirus signature Win32/Agent.AGFH to detect related malicious activity. ### Recommendations for Organizations #### Immediate Actions - Update Antivirus Definitions: Ensure that all antivirus software is updated to detect the latest threats. - Educate Staff: Inform employees about the phishing campaign, emphasizing caution with unexpected emails, even from legitimate sources. - Monitor Network Traffic: Watch for unusual outbound connections, especially to known legitimate websites from unexpected applications. ### Long-Term Strategies - Strengthen Email Security: Implement advanced email security solutions that can detect anomalies beyond standard SPF, DKIM, and DMARC checks. - Regular Security Audits: Conduct frequent audits of partner and supplier security measures to prevent supply chain attacks. - Incident Response Planning: Develop and regularly update incident response plans to handle breaches promptly and effectively. Conclusion The breach of ESET's Israeli partner, Comsecure, underscores the evolving tactics of threat actors exploiting trusted infrastructure and employing sophisticated evasion techniques; attackers can deliver destructive payloads with devastating effects. Organizations must remain vigilant, prioritize transparency, and foster collaboration within the cybersecurity community to combat such threats. --- ### FAQs #### What is a data wiper? - A data wiper is malware designed to irreversibly delete files on a computer and often corrupts the partition table, making data recovery extremely difficult. #### How did the phishing emails bypass security systems? - The emails were sent from legitimate ESET servers and passed SPF, DKIM, and DMARC authentication checks, making them appear authentic to both recipients and email security systems. #### Who is believed to be behind the attack? - While not definitively attributed, evidence suggests possible involvement of Iranian-linked threat actors like Handala and CyberToufan, known for politically motivated attacks against Israel. #### What should I do if I receive such an email? - Do not download or execute any files from the email. Contact your IT security team immediately and report the incident. ### Has ESET released an official statement? - Yes, ESET has acknowledged the incident and released antivirus signatures to detect the malware. However, there was a delay in public disclosure, which has raised concerns.

19-Oct-2024

5 min read

Our Product

Resource Library

Subscribe to Our Weekly Threat Digest

Contact Us

PRODUCT

threatspyBulk IP/Domain Lookup

threatspy

Bulk IP/Domain Lookup

SOLUTIONS

By Industry

Healthcare

Healthcare

Education

Education

IT & Telecom

IT & Telecom

By Role

Government

Government

CISO/CTO

CISO/CTO

DevSecOps

DevSecOps

RESOURCES

Threat Feed

Threat Feed

Threat Research

Threat Research

White Paper

White Paper

SB Blogs

SB Blogs

COMPANY

Our Story

Our Story

Our Team

Our Team

Career

Career

Press And Media

Press And Media

Contact Us

Contact Us

hhj

Critical FortiManager Vulnerability Exploited in Zero-Day Attacks

Related Articles

NPM

Ethereum

Malicious npm packages impersonate popular Ethereum libraries to steal private k...

GitLab

Access Token

An analysis of the Internet Archive's data breach via exposed GitLab tokens, com...

ESET

Data Wiper

Hackers breached ESET Israel's partner, Comsecure, using legitimate servers to s...

Product

Solutions

Resources

Company

Find Us Online

contact@secureblink.com

@ Copyright 2024 Secure Blink. All rights reserved.

4th Floor, Plot No- 7-10 Sector 126, Noida, UP -201303

threatspy
Bulk IP/Domain Lookup