Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ledger's NPM account has been hacked

github.com

Post reply on HN
Print view View original

11–20 of 130 posts

Re: Ledger's NPM account has been hacked

#11

Post by lxgr »

zaphod420 wrote: post #9

One of the comments on the github issue... https://github.com/LedgerHQ/connect-kit/issues/29 "The @ledgerhq/connect-kit-loader allows dApps to load Connect Kit at runtime from a CDN so that we can improve the logic and UI without users having to wait for wallet libraries and dApps updating package versions and releasing new builds. This looks like an extremely dangerous approach now, if I understand it correctly, con…

Is there even an alternative? Once you can inject arbitrary code into a library that a web app loads and executes (except if it’s in an iFrame), it’s game over, no?

Re: Ledger's NPM account has been hacked

#12

Post by lxgr »

kossTKR wrote: post #3

Ledger has been hacked so many times now i've lost count. I remember buying one in 2019, and shortly thereafter all customer data was dumped on the internet endangering everyone who bought one. Then after deep diving the tech i threw it in the trash, it seemed like security theatre product. There's also been so many phishing attempts, fake ledgers sold, bricked ones losing funds, it's total shitshow that ecosystem if…

Do you build and program these laptops and USB drives yourself?

Re: Ledger's NPM account has been hacked

#13

Post by nullstyle »

kossTKR wrote: post #3

Ledger has been hacked so many times now i've lost count. I remember buying one in 2019, and shortly thereafter all customer data was dumped on the internet endangering everyone who bought one. Then after deep diving the tech i threw it in the trash, it seemed like security theatre product. There's also been so many phishing attempts, fake ledgers sold, bricked ones losing funds, it's total shitshow that ecosystem if…

"bricked ones losing funds"

That's the user's fault. The product makes it very clear you need to create a recovery sheet and store it in a safe deposit box or other secure place. If you actively ignore the instructions you deserve it.

Could you share some of your deep dive and tell us about what concerns you found? I use one of their wallets and I'd like to investigate more now as well.

Re: Ledger's NPM account has been hacked

#14

Post by rekoil »

kossTKR wrote: post #3

Ledger has been hacked so many times now i've lost count. I remember buying one in 2019, and shortly thereafter all customer data was dumped on the internet endangering everyone who bought one. Then after deep diving the tech i threw it in the trash, it seemed like security theatre product. There's also been so many phishing attempts, fake ledgers sold, bricked ones losing funds, it's total shitshow that ecosystem if…

A few months ago they also pushed a new feature which, if enabled, literally exfiltrated your secret key to external parties, requiring only 2 to reassemble the full key...

Avoid

Avoid

Avoid

Re: Ledger's NPM account has been hacked

#15

Post by [deleted] »

lxgr wrote: post #12
kossTKR wrote: post #3

Ledger has been hacked so many times now i've lost count. I remember buying one in 2019, and shortly thereafter all customer data was dumped on the internet endangering everyone who bought one. Then after deep diving the tech i threw it in the trash, it seemed like security theatre product. There's also been so many phishing attempts, fake ledgers sold, bricked ones losing funds, it's total shitshow that ecosystem if…

Do you build and program these laptops and USB drives yourself?

[deleted]

Re: Ledger's NPM account has been hacked

#16

Post by ashishbijlani »

Plug: we've been building Packj [1] to detect malicious Python/NPM/Ruby/Rust/Java/PHP packages. It carries out static/dynamic/metadata analysis to look for "suspicious” attributes such as spawning of shell, invalid/expired email (i.e., no 2FA), use of files, network communication, use of decode+eval, mismatch of GitHub code vs packaged code, and several more.

1. https://github.com/ossillate-inc/packj

Re: Ledger's NPM account has been hacked

#17

Post by dboreham »

kossTKR wrote: post #3

Ledger has been hacked so many times now i've lost count. I remember buying one in 2019, and shortly thereafter all customer data was dumped on the internet endangering everyone who bought one. Then after deep diving the tech i threw it in the trash, it seemed like security theatre product. There's also been so many phishing attempts, fake ledgers sold, bricked ones losing funds, it's total shitshow that ecosystem if…

The only reason things like Ledger exist is because regular smart cards (e.g. Yubikey) don't yet support the signature schemes used on blockchains.

Re: Ledger's NPM account has been hacked

#18

Post by aftbit »

ashishbijlani wrote: post #16

Plug: we've been building Packj [1] to detect malicious Python/NPM/Ruby/Rust/Java/PHP packages. It carries out static/dynamic/metadata analysis to look for "suspicious” attributes such as spawning of shell, invalid/expired email (i.e., no 2FA), use of files, network communication, use of decode+eval, mismatch of GitHub code vs packaged code, and several more. 1. https://github.com/ossillate-inc/packj

Can you show the result of running a scan against this compromised repo? Would your tool have caught this crypto drainer live on revoke.cash?

Re: Ledger's NPM account has been hacked

#19

Post by capableweb »

ashishbijlani wrote: post #16

Plug: we've been building Packj [1] to detect malicious Python/NPM/Ruby/Rust/Java/PHP packages. It carries out static/dynamic/metadata analysis to look for "suspicious” attributes such as spawning of shell, invalid/expired email (i.e., no 2FA), use of files, network communication, use of decode+eval, mismatch of GitHub code vs packaged code, and several more. 1. https://github.com/ossillate-inc/packj

And since you're bragging/plugging it here, I take it you tested it against this repository+version and it detected it?
Post reply on HN