Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The fake browser update scam gets a makeover

krebsonsecurity.com

Post reply on HN
Print view View original

71–80 of 196 posts

Re: The fake browser update scam gets a makeover

#71

Post by Cthulhu_ »

warkdarrior wrote: post #23
jkaptur wrote: post #16

So the attack goes: 1) compromise some site to serve arbitrary JS 2) have it serve simple JS that requests other JS that contains the real malicious payload. And the reason for this two-step architecture is to make it convenient to change the real payload. And the problem is where to host the real payload. The first idea was Cloudflare, but Cloudflare keeps taking that sort of thing down. So now they host it "on the…

According to the following blog post, it uses a web API exposed by the Binance Smart Chain (BSC) platform: https://labs.guard.io/etherhiding-hiding-web2-malicious-code... This diagram show the full flow of the attack: https://miro.medium.com/v2/resize:fit:1400/format:webp/1*by4... Because reads from blockchain are "free" (meaning, there is no cryptocurrency payment required to read data from the smart contracts on BS…

Reminds me of malware reading a Twitter account that would act as the C&C server.

Re: The fake browser update scam gets a makeover

#72

Post by jbaczuk »

warkdarrior wrote: post #23
jkaptur wrote: post #16

So the attack goes: 1) compromise some site to serve arbitrary JS 2) have it serve simple JS that requests other JS that contains the real malicious payload. And the reason for this two-step architecture is to make it convenient to change the real payload. And the problem is where to host the real payload. The first idea was Cloudflare, but Cloudflare keeps taking that sort of thing down. So now they host it "on the…

According to the following blog post, it uses a web API exposed by the Binance Smart Chain (BSC) platform: https://labs.guard.io/etherhiding-hiding-web2-malicious-code... This diagram show the full flow of the attack: https://miro.medium.com/v2/resize:fit:1400/format:webp/1*by4... Because reads from blockchain are "free" (meaning, there is no cryptocurrency payment required to read data from the smart contracts on BS…

lol

> In response to questions from KrebsOnSecurity, the BNB Smart Chain (BSC) said its team is aware of the malware abusing its blockchain, and is actively addressing the issue. The company said all addresses associated with the spread of the malware have been blacklisted, and that its technicians had developed a model to detect future smart contracts that use similar methods to host malicious scripts.

Earlier in the article it said

> Due to the publicly accessible and unchangeable nature of the blockchain, code can be hosted ‘on-chain’ without the ability for a takedown... “So you get a free, untracked, and robust way to get your data (the malicious payload) without leaving traces,” Tal said.

Make up your mind...

It's not robust since you have to use an API (i.e. Binance API) to access the blockchain from a compromised website, then Binance can effectively "take it down" by blocking access via the API.

Now if they made the compromised website talk directly to the node on the blockchain network that would be different. Except, why not just host the malware on the website in the first place...

Re: The fake browser update scam gets a makeover

#73

Post by numtel »

jbaczuk wrote: post #72
warkdarrior wrote: post #23

Earlier quoted context omitted.

According to the following blog post, it uses a web API exposed by the Binance Smart Chain (BSC) platform: https://labs.guard.io/etherhiding-hiding-web2-malicious-code... This diagram show the full flow of the attack: https://miro.medium.com/v2/resize:fit:1400/format:webp/1*by4... Because reads from blockchain are "free" (meaning, there is no cryptocurrency payment required to read data from the smart contracts on BS…

lol > In response to questions from KrebsOnSecurity, the BNB Smart Chain (BSC) said its team is aware of the malware abusing its blockchain, and is actively addressing the issue. The company said all addresses associated with the spread of the malware have been blacklisted, and that its technicians had developed a model to detect future smart contracts that use similar methods to host malicious scripts. Earlier in th…

Anybody can spin up a mirror node, even on the mostly centralized BSC. This is just a misunderstanding.

Every public blockchain works this way afaik. I've even made a site for hosting webpages on Optimism: https://newgeocities.com

The real discussion imo is that blockchain node operators should be pressured to respond to concerns about unwanted content. There's no reason they can't coordinate on filters in the same way Ethereum validators use Flashbots to ignore Tornado Cash transactions. Although I hope they can find a better solution than blocking entire contracts because it's really nice to write a simple contract for data storage. Remember: a contract is a protocol, not a program. The validators follow the instructions but it's more like a database schema to which people submit conforming messages. As the contract creator, you're just publishing your code on chain. Each user takes responsibility for their own data.

Re: The fake browser update scam gets a makeover

#74

Post by financypants »

warkdarrior wrote: post #23
jkaptur wrote: post #16

So the attack goes: 1) compromise some site to serve arbitrary JS 2) have it serve simple JS that requests other JS that contains the real malicious payload. And the reason for this two-step architecture is to make it convenient to change the real payload. And the problem is where to host the real payload. The first idea was Cloudflare, but Cloudflare keeps taking that sort of thing down. So now they host it "on the…

According to the following blog post, it uses a web API exposed by the Binance Smart Chain (BSC) platform: https://labs.guard.io/etherhiding-hiding-web2-malicious-code... This diagram show the full flow of the attack: https://miro.medium.com/v2/resize:fit:1400/format:webp/1*by4... Because reads from blockchain are "free" (meaning, there is no cryptocurrency payment required to read data from the smart contracts on BS…

Free storage and hosting? Does this mean anyone can store random stuff in smart contracts and read from it for free?

Re: The fake browser update scam gets a makeover

#75

Post by Gigachad »

financypants wrote: post #74
warkdarrior wrote: post #23

Earlier quoted context omitted.

According to the following blog post, it uses a web API exposed by the Binance Smart Chain (BSC) platform: https://labs.guard.io/etherhiding-hiding-web2-malicious-code... This diagram show the full flow of the attack: https://miro.medium.com/v2/resize:fit:1400/format:webp/1*by4... Because reads from blockchain are "free" (meaning, there is no cryptocurrency payment required to read data from the smart contracts on BS…

Free storage and hosting? Does this mean anyone can store random stuff in smart contracts and read from it for free?

You have to pay for the initial insert but it's then hosted forever for free. For reads, you can either download the data from nodes in the network which works somewhat like a torrent, or find a service that has a full copy of the blockchain and is providing it via a HTTP interface.

Re: The fake browser update scam gets a makeover

#76

Post by staplers »

d11z wrote: post #30
andybak wrote: post #17

I'm just happy to finally see a practical use case for Blockchain technology.

It’s been great for gambling, cybercrime, and enabling the drug trade practically since its inception.

The suffocating irony of this forum being called "Hacker News" when it is filled with comments like this never fails to amaze me. A truly unimaginative bunch.

Re: The fake browser update scam gets a makeover

#77

Post by tomr75 »

financypants wrote: post #74
warkdarrior wrote: post #23

Earlier quoted context omitted.

According to the following blog post, it uses a web API exposed by the Binance Smart Chain (BSC) platform: https://labs.guard.io/etherhiding-hiding-web2-malicious-code... This diagram show the full flow of the attack: https://miro.medium.com/v2/resize:fit:1400/format:webp/1*by4... Because reads from blockchain are "free" (meaning, there is no cryptocurrency payment required to read data from the smart contracts on BS…

Free storage and hosting? Does this mean anyone can store random stuff in smart contracts and read from it for free?

it costs money to store/write a transaction to the chain (transaction fee) - binance smart chain is subsidised so runs at a loss/pretty cheap to store small amounts of data on (if you did this on ethereum would be very expensive) - retrieval is free in that you can use a public RPC to retrieve the data

Re: The fake browser update scam gets a makeover

#78

Post by d11z »

staplers wrote: post #76
d11z wrote: post #30

Earlier quoted context omitted.

It’s been great for gambling, cybercrime, and enabling the drug trade practically since its inception.

The suffocating irony of this forum being called "Hacker News" when it is filled with comments like this never fails to amaze me. A truly unimaginative bunch.

Could you give some other concrete, practical examples of use cases for cryptocurrencies instead of the passive-aggressive snark?

Re: The fake browser update scam gets a makeover

#79

Post by 7moritz7 »

clemailacct1 wrote: post #62
7moritz7 wrote: post #40

Earlier quoted context omitted.

I really think Monero in particular deserves way more criticism for their practice. Bitcoin is one thing, Monero is created for and marketed towards cybercriminals, you don't need to be a communications expert to get that premise. I haven't seen it used once for any legitimate purpose. Atleast with Bitcoin and Ethereum you can get buy some legitimate things like VPNs or NFTs https://arstechnica.com/information-techno…

Monero was built and used for privacy purposes but it gets abused by cybercriminals for malicious purposes. Just like all cryptocurrencies and even plain paper cash.

> Monero was built and used for privacy purposes

So was Encrochat

Re: The fake browser update scam gets a makeover

#80

Post by jbaczuk »

numtel wrote: post #73
jbaczuk wrote: post #72

Earlier quoted context omitted.

lol > In response to questions from KrebsOnSecurity, the BNB Smart Chain (BSC) said its team is aware of the malware abusing its blockchain, and is actively addressing the issue. The company said all addresses associated with the spread of the malware have been blacklisted, and that its technicians had developed a model to detect future smart contracts that use similar methods to host malicious scripts. Earlier in th…

Anybody can spin up a mirror node, even on the mostly centralized BSC. This is just a misunderstanding. Every public blockchain works this way afaik. I've even made a site for hosting webpages on Optimism: https://newgeocities.com The real discussion imo is that blockchain node operators should be pressured to respond to concerns about unwanted content. There's no reason they can't coordinate on filters in the same w…

seems like "blockchain" has nothing to do with it... they could just host the file on a server they do control. "Blockchains" aren't magic.
Post reply on HN