Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ledger's NPM account has been hacked

github.com

Post reply on HN
Print view View original

81–90 of 130 posts

Re: Ledger's NPM account has been hacked

#81

Post by ezekg »

Daviey wrote: post #50
KomoD wrote: post #37

Earlier quoted context omitted.

Source? Their twitter says "This morning CET, a former Ledger Employee fell victim to a phishing attack that gained access to their NPMJS account." And Github Actions automatically redacts the secret in the log

You are right, I should have waited for the postmortem.. it appeared the likely way because the secret was in the release pipeline env. However.. something doesn't add up. There is no chance that a malicious actor gained access and in a couple of hours put together this exploit. Or, I can't see someone putting together this exploit, THEN trying to spear-phish in hope of getting lucky and pressing the button.

> I can't see someone putting together this exploit, THEN trying to spear-phish in hope of getting lucky and pressing the button.

How can you not see someone doing that? The effort netted them $600k.

Is this not how exploits work? Build the exploit and then try to use it by finding an "in." They don't find an "in" and then build the exploit.

Re: Ledger's NPM account has been hacked

#82

Post by mikeryan »

binarymax wrote: post #4

NPM forces 2fa, so I’m curious what the scenario was here. Was a committers phone compromised?

NPM optionally enforces 2FA. You can create an automation token to bypass it. In that case depending on how branches are protected a push to the right branch can publish a new package.

https://github.blog/changelog/2020-10-02-npm-automation-toke...

Heck if they have an automated deployment and use devs personal GitHub handles all it would take is forgetting to remove an ex employee from the right github access group. Even if you took away all other access when they left.

Re: Ledger's NPM account has been hacked

#83

Post by renonce »

rdl wrote: post #34

LOL https://twitter.com/Ledger/status/1735326240658100414 FINAL TIMELINE AND UPDATE TO CUSTOMERS: 4:49pm CET: Ledger Connect Kit genuine version 1.1.8 is being propagated now automatically. We recommend waiting 24 hours until using the Ledger Connect Kit again. The investigation continues, here is the timeline of what we know about the exploit at this moment: - This morning CET, a former Ledger Employee fell victim t…

So Ledger was able to coordinate with a number of entities to minimize the impact of the attack? Isn’t that directly contrary to crypto’s decentralized design?

If one is to make crypto really decentralized, relying on a small number of authorities for security seems contrary and maybe poisonous to that goal.

Re: Ledger's NPM account has been hacked

#84

Post by matheusmoreira »

cobertos wrote: post #41
rdl wrote: post #34

LOL https://twitter.com/Ledger/status/1735326240658100414 FINAL TIMELINE AND UPDATE TO CUSTOMERS: 4:49pm CET: Ledger Connect Kit genuine version 1.1.8 is being propagated now automatically. We recommend waiting 24 hours until using the Ledger Connect Kit again. The investigation continues, here is the timeline of what we know about the exploit at this moment: - This morning CET, a former Ledger Employee fell victim t…

> "This morning CET, a former Ledger Employee fell victim to a phishing attack that gained access to their NPMJS account." Ouch. A _former_ employee had active credentials to phish for. > "@Tether_to has frozen the bad actor’s USDT." Wasn't like, >30% of the point of crypto to not allow people to do this sort of high-level/centralized freezing?

That was the point, yes. The whole problem is people reinvented the entire centralized banking system on top of crypto. Stuff like USDT should not even exist, people were supposed to adopt crypto wholesale and only convert to fiat currency to pay taxes until the government caved and allowed paying taxes in crypto.

Re: Ledger's NPM account has been hacked

#85

Post by [deleted] »

rdl wrote: post #34

LOL https://twitter.com/Ledger/status/1735326240658100414 FINAL TIMELINE AND UPDATE TO CUSTOMERS: 4:49pm CET: Ledger Connect Kit genuine version 1.1.8 is being propagated now automatically. We recommend waiting 24 hours until using the Ledger Connect Kit again. The investigation continues, here is the timeline of what we know about the exploit at this moment: - This morning CET, a former Ledger Employee fell victim t…

[deleted]

Re: Ledger's NPM account has been hacked

#86

Post by [deleted] »

ashishbijlani wrote: post #16

Plug: we've been building Packj [1] to detect malicious Python/NPM/Ruby/Rust/Java/PHP packages. It carries out static/dynamic/metadata analysis to look for "suspicious” attributes such as spawning of shell, invalid/expired email (i.e., no 2FA), use of files, network communication, use of decode+eval, mismatch of GitHub code vs packaged code, and several more. 1. https://github.com/ossillate-inc/packj

[deleted]

Re: Ledger's NPM account has been hacked

#87

Post by jeroenhd »

koolba wrote: post #22
Daviey wrote: post #7

Earlier quoted context omitted.

The Github action leaked the creds, seemingly via a log. Looks like that action has been in use for ~4 months.

Automated publishing without a human involved kind of kills the whole point of 2FA anyway. It is kind of funny that the crypto world of multi sigs relies on blind trust of unverified UI components.

If properly configured and audited, this approach can be secure. Github is the only way configured to publish to NPM, and NPM pushes can only be initiated by signed commits from trusted accounts with MFA, the entire workflow is can be secure on its own.

I don't really see the point for a project that doesn't seem to update their code all that often, though. The risk of misconfiguring something doesn't seem worth the effort saved by having someone with a 2FA key upload a tarball generated on their dev machine.

Re: Ledger's NPM account has been hacked

#88

Post by feross »

We've been building Socket [1] to detect and block this exact type of supply chain attack. Our Socket AI scanner [2] successfully detected this attack. It uses dozens of static signals combined with an LLM to detect novel attacks that evade traditional scanning tools.

This is what Socket AI produces when given @ledgerhq/connect-kit 1.1.7 to analyze:

> The obfuscated code block is highly suspicious and likely contains malicious behavior. The presence of obfuscation and the unclear purpose of the code raise significant red flags.

Feeling very proud of our team right now as this validates that our static analysis + LLM approach works well on novel malicious dependencies. If you're interested, we maintain a listing of malicious packages detected by this system [3].

Small plug: If you’d like real-time protection against attacks like this, you can install Socket for GitHub to automatically scan every PR in your repo. The free plan is incredibly generous. If you do decide to install it, it’s important that you enable the ‘AI Detected Security Risk’ alert type in your Security Policy to activate this protection.

[1]: https://socket.dev

[2]: https://socket.dev/blog/introducing-socket-ai-chatgpt-powere...

[3]: https://socket.dev/npm/issue/malware

Re: Ledger's NPM account has been hacked

#90

Post by matheusmoreira »

coneonthefloor wrote: post #44

> Discover what security feels like Quote from their sales site.

Security is not absolute. Even cryptographic hardware can be vulnerable.

Yubico for example had to replace many of their YubiKeys after a vulnerability was detected in its secure element firmware which affected the strength of keys generated on the device. They sent me a replacement YubiKey after I contacted them.

https://www.yubico.com/support/security-advisories/ysa-2017-...

Post reply on HN