Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ledger's NPM account has been hacked

github.com

Post reply on HN
Print view View original

121–130 of 130 posts

Re: Ledger's NPM account has been hacked

#121

Post by bob1029 »

feross wrote: post #88

We've been building Socket [1] to detect and block this exact type of supply chain attack. Our Socket AI scanner [2] successfully detected this attack. It uses dozens of static signals combined with an LLM to detect novel attacks that evade traditional scanning tools. This is what Socket AI produces when given @ledgerhq/connect-kit 1.1.7 to analyze: > The obfuscated code block is highly suspicious and likely contains…

Could you slide a gzip window over the source code and flag any relatively high entropy region(s) for human review? Would this maybe be more deterministic than an LLM?

How about a multi-stage system that uses the LLM to attempt analysis of the statistically-detected high entropy regions by way of an assortment of tools, such as b64 decode?

I like where you are headed with this. Just some thoughts I had.

Re: Ledger's NPM account has been hacked

#122

Post by cxr »

woah wrote: post #120
JeremyNT wrote: post #113

Earlier quoted context omitted.

Yet it doesn't seem to really answer the question. I get that what we're looking at a browser extension that relies on a bunch of webshit, some of which was malware. As somebody not versed in "web3" specific webshits, I thought the point of a hardware token is that there was some kind of verification on the device itself. So this doesn't seem sufficient to "drain" a wallet - right? My assumption would be that the com…

Not sure if anyone actually read my original post. The problem is that Ethereum transactions are not especially human readable so they are commonly signed blind. As you point out, this is a problem.

So it wasn't the case that dynamically loading and executing a blob of unreviewed third-party code containing the offending section is what was responsible for those transactions being initiated. Oh wait, it was.

Re: Ledger's NPM account has been hacked

#123

Post by woah »

cxr wrote: post #122
woah wrote: post #120

Earlier quoted context omitted.

Not sure if anyone actually read my original post. The problem is that Ethereum transactions are not especially human readable so they are commonly signed blind. As you point out, this is a problem.

So it wasn't the case that dynamically loading and executing a blob of unreviewed third-party code containing the offending section is what was responsible for those transactions being initiated. Oh wait, it was.

The whole point of a hardware wallet is that the security of your computer shouldn't matter.

Re: Ledger's NPM account has been hacked

#124

Post by [deleted] »

woah wrote: post #123
cxr wrote: post #122

Earlier quoted context omitted.

So it wasn't the case that dynamically loading and executing a blob of unreviewed third-party code containing the offending section is what was responsible for those transactions being initiated. Oh wait, it was.

The whole point of a hardware wallet is that the security of your computer shouldn't matter.

[deleted]

Re: Ledger's NPM account has been hacked

#125

Post by cxr »

woah wrote: post #123
cxr wrote: post #122

Earlier quoted context omitted.

So it wasn't the case that dynamically loading and executing a blob of unreviewed third-party code containing the offending section is what was responsible for those transactions being initiated. Oh wait, it was.

The whole point of a hardware wallet is that the security of your computer shouldn't matter.

Exclusively focusing on the security failures arising from end-user UI/social engineering and ignoring the failures arising from poor engineering billed as modern software development best practices is another type of failure.

Re: Ledger's NPM account has been hacked

#126

Post by pcdoodle »

matheusmoreira wrote: post #119
lrvick wrote: post #96

And once again calls to allow optional signing support natively to NPM will be rejected citing that it might intimidate drive-by devs who do not want to learn to setup a yubikey or nitrokey for artifact signing. I have talked to the NPM team about this multiple times over the last several years and they literally believe no signing at all is better than some devs feeling pressured to sign. You need no stronger eviden…

The Debian PGP system is very impressive. Looks like the maintainers actually met each other, verified each other's identities and created the fabled web of trust. https://wiki.debian.org/OpenPGP > When joining the Debian project, developers need to identify themselves by providing an OpenPGP key that is signed by at least two existing members of the project.

This PGP thing sounds pretty cool. What is recommended for getting started these days?

Re: Ledger's NPM account has been hacked

#127

Post by cxr »

latchkey wrote: post #70
koolba wrote: post #22

Earlier quoted context omitted.

Automated publishing without a human involved kind of kills the whole point of 2FA anyway. It is kind of funny that the crypto world of multi sigs relies on blind trust of unverified UI components.

Technically, it is just the frontends. You can always interact with the contracts directly and that can't ever be shut down (if you know what you're doing). Can you do that with your bank? Let's also not forget that every other website on the planet that relies on npm also relies on the blind trust of unverified UI components. This isn't just silo'd to crypto.

> Let's also not forget that every other website on the planet that relies on npm also relies on the blind trust of unverified UI components.

It feels like you think you're making a really good point here. In reality, it's just a run-of-the-mill appeal to popularity. The programmers doing this sort of thing on other websites are in the wrong, too.

Re: Ledger's NPM account has been hacked

#128

Post by magento »

kossTKR wrote: post #3

Ledger has been hacked so many times now i've lost count. I remember buying one in 2019, and shortly thereafter all customer data was dumped on the internet endangering everyone who bought one. Then after deep diving the tech i threw it in the trash, it seemed like security theatre product. There's also been so many phishing attempts, fake ledgers sold, bricked ones losing funds, it's total shitshow that ecosystem if…

Phishing attempts are irrelevant as long as users check TXes before they sign. Fake ledgers are also irrelevant because the software does a check if the hardware is legit. Bricked Ledgers losing funds is only a thing if a user didn't keep a backup of their seed phrase, which would make them lose funds regardless of what wallet they used.

Re: Ledger's NPM account has been hacked

#129

Post by arifromzengo »

pants2 wrote: post #46
meowface wrote: post #23

Earlier quoted context omitted.

>I just use isolated cheap laptops and encrypted usb's now. I figure this isn't practical for most end users. Is there an alternative hardware wallet that you think is okay for most people? How do you feel about Trezor?

The modern solution is to use MPC wallets like ZenGo.

Thanks for the shout-out. Obviously I agree. Multi-factor wallets are more secure than single factor wallets, by default.

Having no seed phrase vulnerability (single point of failure) significantly reduces the surface area for attack vectors. Added layers of security (like the built-in web3 firewall) help protect against Web3 attack vectors.

Re: Ledger's NPM account has been hacked

#130

Post by arifromzengo »

ametrau wrote: post #80
pants2 wrote: post #46

Earlier quoted context omitted.

The modern solution is to use MPC wallets like ZenGo.

I must be missing something. It couldn’t be as dumb as using a photo of your face as the key.

You are missing something. Happy to jump into the details if you're interested.

3D FaceLock is one of the parts of the wallet recovery process: It's a biometric liveness verification (backed by 600,000 USD bug bounty). But 1) It's only one of the factors, and 2) It's never been hacked/spoofed.

Zengo's MPC wallet uses a 2/2 signing mechanism (similar conceptually to a multi-sig). You initiate transactions from your Zengo app (inside the app is the Personal Secret Share, which interacts with your wallet's secure enclave/TEE during the signing process). The Remote Share on Zengo's server essentially co-signs the transactions.

By removing a single point of failure (private key or seed phrase) it is much more challenging for a hacker to steal/spend funds or take over a Zengo wallet - indeed... we have over 1,000,000 users (since 2018) and 0 wallets hacked, 0 wallets drained. More info here: www.zengo.com/security

Also happy to answer more qs. Cheers.

Post reply on HN