Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The fake browser update scam gets a makeover

krebsonsecurity.com

Post reply on HN
Print view View original

21–30 of 196 posts

Re: The fake browser update scam gets a makeover

#21

Post by dylan604 »

tremon wrote: post #9
sublinear wrote: post #7

Earlier quoted context omitted.

This isn't that complicated. Like everything else in life it's a matter of trust and awareness, not really that technical. I'll never understand why the default stance on HN is always javascript bad .

I don't think it's a matter of trust and awareness, because your browser is already happily executing the javascript payload before you have decided whether to trust the website or not. And users are completely unaware of what the payload is doing unless it's spinning at 100% cpu or throwing UI elements in the user's face. It's a matter of convenience mostly, from my point of view. The HN population consists for a la…

The browser had Javascript ON or Javascript OFF. If the browser had JS off for all until user whitelists the site, that would negate the need for plugins like uBO/NoScript/etc.

Re: The fake browser update scam gets a makeover

#22

Post by r00fus »

7moritz7 wrote: post #19

> New research shows the attackers behind one such scheme have developed an ingenious way of keeping their malware from being taken down by security experts or law enforcement: By hosting the malicious files on a decentralized, anonymous cryptocurrency blockchain Finally a practical use for web3

[flagged]

Re: The fake browser update scam gets a makeover

#23

Post by warkdarrior »

jkaptur wrote: post #16

So the attack goes: 1) compromise some site to serve arbitrary JS 2) have it serve simple JS that requests other JS that contains the real malicious payload. And the reason for this two-step architecture is to make it convenient to change the real payload. And the problem is where to host the real payload. The first idea was Cloudflare, but Cloudflare keeps taking that sort of thing down. So now they host it "on the…

According to the following blog post, it uses a web API exposed by the Binance Smart Chain (BSC) platform: https://labs.guard.io/etherhiding-hiding-web2-malicious-code...

This diagram show the full flow of the attack: https://miro.medium.com/v2/resize:fit:1400/format:webp/1*by4...

Because reads from blockchain are "free" (meaning, there is no cryptocurrency payment required to read data from the smart contracts on BSC), this is effectively free storage/hosting for the attacker.

The malicious code is served by BSC web API. According to the Krebs article, BSC "is aware of the malware abusing its blockchain, and is actively addressing the issue." I am not clear if they are taking this situation Very Seriously(TM), but I assume they are.

Re: The fake browser update scam gets a makeover

#25

Post by lawlessone »

yardstick wrote: post #15
josteink wrote: post #14

I guess someone finally found a real world use for blockchain. Too bad it was malware.

Ironic that even this blockchain still had some centralised aspects: “In response to questions from KrebsOnSecurity, the BNB Smart Chain (BSC) said its team is aware of the malware abusing its blockchain, and is actively addressing the issue. The company said all addresses associated with the spread of the malware have been blacklisted, and that its technicians had developed a model to detect future smart contracts t…

I think this is like a block explorer type url. They can refuse requests to view those blocks. I don't think they can stop the creation of those blocks.

The malware guys can probably still find another 3rd party block viewer . But it is hassle for them.

Re: The fake browser update scam gets a makeover

#26

Post by kevmo314 »

jkaptur wrote: post #16

So the attack goes: 1) compromise some site to serve arbitrary JS 2) have it serve simple JS that requests other JS that contains the real malicious payload. And the reason for this two-step architecture is to make it convenient to change the real payload. And the problem is where to host the real payload. The first idea was Cloudflare, but Cloudflare keeps taking that sort of thing down. So now they host it "on the…

> It seems like they (like Cloudflare, or a regular hosting service) are opening themselves up to all sorts of risks by serving arbitrary content.

That's pretty much any website that accepts user input or integrates with an external service. I could post a base64-encoded malware to HN too, it would just get caught a lot faster (wasn't this a real thing on reddit?). I think the trick here is that it doesn't look out of place on a blockchain explorer/gateway because most of that data is opaque binary content to begin with.

Re: The fake browser update scam gets a makeover

#27

Post by jabroni_salad »

paulpauper wrote: post #12

Good ol' Krebs and Schneier ..either way too late to a scam, or ignoring other scams, or ineffectual regardless. What about those fake "download here" Adword buttons that have been a scourge of the web for the past decade or longer infecting untold millions of computers with malware. When will anyone bring that up.

A good takeaway from this is that

1) the simplest methods can stick around the longest. His skimmer page is 13 years old and it's still relevant, for example. Similarly, we will not be rid of fake download buttons or compromised wordpress sites in our lifetimes.

2) If you write about the simple stuff, your articles will be evergreen. You don't have to time the market when your product never falls out of demand.

Re: The fake browser update scam gets a makeover

#28

Post by krebsonsecurity »

paulpauper wrote: post #12

Good ol' Krebs and Schneier ..either way too late to a scam, or ignoring other scams, or ineffectual regardless. What about those fake "download here" Adword buttons that have been a scourge of the web for the past decade or longer infecting untold millions of computers with malware. When will anyone bring that up.

Not sure if it's exactly the same thing as what you just mentioned, but I did write recently about criminals using paid Google ads to get their links for popular software downloads show up before even the first organic search result. And it includes the right icons and branding, and people click and are brought to a site that looks an awful lot like a site Microsoft might use to let you download Teams, and you get an information stealer program instead.

Tl;dr, there are multiple ransomware groups that are using this method to find new infostealer victims.

https://krebsonsecurity.com/2023/09/snatch-ransom-group-expo...

Re: The fake browser update scam gets a makeover

#29

Post by taway1237 »

7moritz7 wrote: post #19

> New research shows the attackers behind one such scheme have developed an ingenious way of keeping their malware from being taken down by security experts or law enforcement: By hosting the malicious files on a decentralized, anonymous cryptocurrency blockchain Finally a practical use for web3

I'm surprised Krebs says something like this, because it's not novel at all. I'm in the industry, and malware used public blockchains at least as far back as 2017 (probably way before, but that's when I first analysed a sample that does that).
Post reply on HN