Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ledger's NPM account has been hacked

github.com

Post reply on HN
Print view View original

71–80 of 130 posts

Re: Ledger's NPM account has been hacked

#71

Post by aftbit »

mattwilsonn888 wrote: post #62
cobertos wrote: post #41

Earlier quoted context omitted.

> "This morning CET, a former Ledger Employee fell victim to a phishing attack that gained access to their NPMJS account." Ouch. A _former_ employee had active credentials to phish for. > "@Tether_to has frozen the bad actor’s USDT." Wasn't like, >30% of the point of crypto to not allow people to do this sort of high-level/centralized freezing?

You can have gradations of control. USDT and USDC are centrally managed. We used to have DAI, which was fully decentralized and over-collatoralized by Ethereum tokens (the native currency of the platform DAI is rooted on) - but the founder mysteriously died as the DAO was taken over and made to begin collateralizing DAI against USDC and USDT, ironically. It is a shame how far crypto has fallen culturally that this st…

Hold on what? I missed all of this MakerDAO drama. The founder died and now assets are collatoralized by USDT instead of ETH? Looks like at least

Some links I found for further reading:

https://cointelegraph.com/news/makerdao-co-founder-nikolai-m...

https://maker.defiexplore.com/stats

Re: Ledger's NPM account has been hacked

#72

Post by chrisco255 »

woah wrote: post #42

How did the exploit work? Obviously it looks really bad for Ledger to keep having these web security failures, but the entire point of a hardware wallet is to make it so that you don't have to rely on the security of the code on your computer. If the hardware wasn't compromised (sounds like this was just JS), then there was no way for the exploit to take anyone's private key. It sounds to me like the exploit would wo…

> The only way this is possible is if users are signing transactions on their Ledger without looking at them.

This is correct. Estimates are that the attackers successfully phished about $600K.

Re: Ledger's NPM account has been hacked

#73

Post by rewtraw »

earthboundkid wrote: post #66
mattwilsonn888 wrote: post #62

Earlier quoted context omitted.

You can have gradations of control. USDT and USDC are centrally managed. We used to have DAI, which was fully decentralized and over-collatoralized by Ethereum tokens (the native currency of the platform DAI is rooted on) - but the founder mysteriously died as the DAO was taken over and made to begin collateralizing DAI against USDC and USDT, ironically. It is a shame how far crypto has fallen culturally that this st…

There is no possible way that USDT is backed one-to-one. It just isn't. If it were, it would have a simple audit trail that they would publish. They don't because it isn't. It's a scam that will at some point unravel, and everyone will lose their shirts because of "many good people" lol.

It's possibly backed greater than 1:1. Tether likely cleaned up their operations over the past few years, but the "Tether Truthers" are still anxious about fraud. Even more transparency is welcome of course.

> Cantor Fitzgerald CEO Howard Lutnick on CNBC:

> "I'm a big fan of this stablecoin called Tether...I hold their treasuries. So I keep their treasuries, and they have a lot of treasuries. They're over $90 billion now, so I'm a big fan of Tether."

https://twitter.com/leomschwartz/status/1734694800019063207 https://tether.to/en/transparency/#usdt

> Tether also reported all time high excess reserves of $2.44 billion.

https://www.theblock.co/post/230241/tether-attestation-repor...

Re: Ledger's NPM account has been hacked

#74

Post by wyck »

woah wrote: post #42

How did the exploit work? Obviously it looks really bad for Ledger to keep having these web security failures, but the entire point of a hardware wallet is to make it so that you don't have to rely on the security of the code on your computer. If the hardware wasn't compromised (sounds like this was just JS), then there was no way for the exploit to take anyone's private key. It sounds to me like the exploit would wo…

You can see a technical analysis here https://twitter.com/Neodyme/status/1735337711555285261 , this is a JS repo for app integrations for Ledger and really has nothing specifically to do with Ethereum itself or any hardware. There are several wallets solutions that make transactions easier and more secure for people using Eth, but Eth is a protocol running a network and doesn't concern itself with the app layer, and rightly so.

Re: Ledger's NPM account has been hacked

#75

Post by chrisco255 »

dboreham wrote: post #17
kossTKR wrote: post #3

Ledger has been hacked so many times now i've lost count. I remember buying one in 2019, and shortly thereafter all customer data was dumped on the internet endangering everyone who bought one. Then after deep diving the tech i threw it in the trash, it seemed like security theatre product. There's also been so many phishing attempts, fake ledgers sold, bricked ones losing funds, it's total shitshow that ecosystem if…

The only reason things like Ledger exist is because regular smart cards (e.g. Yubikey) don't yet support the signature schemes used on blockchains.

Yubikeys are fine for basic sign-in/sign-out functionality, but even on a basic web app, your auth tokens are something else independent of your Yubikey signature.

Re: Ledger's NPM account has been hacked

#76

Post by cmeacham98 »

aftbit wrote: post #18
ashishbijlani wrote: post #16

Plug: we've been building Packj [1] to detect malicious Python/NPM/Ruby/Rust/Java/PHP packages. It carries out static/dynamic/metadata analysis to look for "suspicious” attributes such as spawning of shell, invalid/expired email (i.e., no 2FA), use of files, network communication, use of decode+eval, mismatch of GitHub code vs packaged code, and several more. 1. https://github.com/ossillate-inc/packj

Can you show the result of running a scan against this compromised repo? Would your tool have caught this crypto drainer live on revoke.cash?

Tried it myself and they don't appear to have implemented the part of the scan that would catch this, relevant snippet from the logs:

    [+]    Analyzing repo-pkg src code match.... N/A [Coming soon!]

Re: Ledger's NPM account has been hacked

#77

Post by darrenf »

beeboobaa wrote: post #51
darrenf wrote: post #21

Earlier quoted context omitted.

Per HN guidelines, emphasis mine: "Please don't complain about tangential annoyances—e.g. article or website formats, name collisions , or back-button breakage. They're too common to be interesting." https://news.ycombinator.com/newsguidelines.html

Your own comment is literally complaining about a tangential annoyance (my comment)

Yes and no. I think a periodic reminder about the guidelines for everyone that sees them, not just the person I reply to, is useful

Re: Ledger's NPM account has been hacked

#78

Post by hanniabu »

mattwilsonn888 wrote: post #62
cobertos wrote: post #41

Earlier quoted context omitted.

> "This morning CET, a former Ledger Employee fell victim to a phishing attack that gained access to their NPMJS account." Ouch. A _former_ employee had active credentials to phish for. > "@Tether_to has frozen the bad actor’s USDT." Wasn't like, >30% of the point of crypto to not allow people to do this sort of high-level/centralized freezing?

You can have gradations of control. USDT and USDC are centrally managed. We used to have DAI, which was fully decentralized and over-collatoralized by Ethereum tokens (the native currency of the platform DAI is rooted on) - but the founder mysteriously died as the DAO was taken over and made to begin collateralizing DAI against USDC and USDT, ironically. It is a shame how far crypto has fallen culturally that this st…

> but the founder mysteriously died

Hello CIA

Re: Ledger's NPM account has been hacked

#79

Post by mikeryan »

binarymax wrote: post #54
forward1 wrote: post #32

Earlier quoted context omitted.

2FA only protects login. Pretty much all account security from that point on is based on portable bearer tokens.

Not sure what you mean. Every time I publish to NPM it prompts me for a one time code.

Sounds like they’re publishing to npm with a GitHub action which can be done with an automation token which bypasses 2fa

Re: Ledger's NPM account has been hacked

#80

Post by ametrau »

pants2 wrote: post #46
meowface wrote: post #23

Earlier quoted context omitted.

>I just use isolated cheap laptops and encrypted usb's now. I figure this isn't practical for most end users. Is there an alternative hardware wallet that you think is okay for most people? How do you feel about Trezor?

The modern solution is to use MPC wallets like ZenGo.

I must be missing something. It couldn’t be as dumb as using a photo of your face as the key.
Post reply on HN