Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ledger's NPM account has been hacked

github.com

Post reply on HN
Print view View original

91–100 of 130 posts

Re: Ledger's NPM account has been hacked

#91

Post by woah »

wyck wrote: post #74
woah wrote: post #42

How did the exploit work? Obviously it looks really bad for Ledger to keep having these web security failures, but the entire point of a hardware wallet is to make it so that you don't have to rely on the security of the code on your computer. If the hardware wasn't compromised (sounds like this was just JS), then there was no way for the exploit to take anyone's private key. It sounds to me like the exploit would wo…

You can see a technical analysis here https://twitter.com/Neodyme/status/1735337711555285261 , this is a JS repo for app integrations for Ledger and really has nothing specifically to do with Ethereum itself or any hardware. There are several wallets solutions that make transactions easier and more secure for people using Eth, but Eth is a protocol running a network and doesn't concern itself with the app layer, and…

Yea my point is that Ethereum has created a complex system without paying enough attention to generating human-readable signing blobs. This is not something that a wallet can help with. The information displayed on the Ledger's screen needs to be human readable so that people know what they are signing. This is something that needs to be solved by the community creating transaction format specifications and the people writing the Ledger Ethereum app.

Ledger deserves a lot of criticism for insecure JS, but the whole point of a hardware wallet is not to have to worry about the JS you are running.

Re: Ledger's NPM account has been hacked

#92

Post by mikeryan »

asylteltine wrote: post #57

When will npm finally take security seriously? How many incidents do they need? Don’t allow non hardware mfa and add verified namespaces already!

It’s not NPMs job to secure your repo. They provide the tools to protect it. It’s your job as a maintainer to not shoot yourself in the foot.

Re: Ledger's NPM account has been hacked

#93

Post by theteapot »

feross wrote: post #88

We've been building Socket [1] to detect and block this exact type of supply chain attack. Our Socket AI scanner [2] successfully detected this attack. It uses dozens of static signals combined with an LLM to detect novel attacks that evade traditional scanning tools. This is what Socket AI produces when given @ledgerhq/connect-kit 1.1.7 to analyze: > The obfuscated code block is highly suspicious and likely contains…

Apparently 1.1.5|6 we're also compromised?

Re: Ledger's NPM account has been hacked

#94

Post by matheusmoreira »

kossTKR wrote: post #3

Ledger has been hacked so many times now i've lost count. I remember buying one in 2019, and shortly thereafter all customer data was dumped on the internet endangering everyone who bought one. Then after deep diving the tech i threw it in the trash, it seemed like security theatre product. There's also been so many phishing attempts, fake ledgers sold, bricked ones losing funds, it's total shitshow that ecosystem if…

I've found the most secure key management is to keep important keys offline and stored on paper and only load them into a live tails/whonix system for brief uses. I even contributed a binary decoding feature to zbar to let me store them on printed QR codes and easily input them back in.

> bricked ones losing funds

Well of course. It's just a computer and all computers fail. Cheap laptops can also fail and destroy your keys. USB flash storage failure is even more likely. This is the number one argument for storing keys on paper which is actually known to last centuries.

Re: Ledger's NPM account has been hacked

#95

Post by rahen »

meowface wrote: post #23
kossTKR wrote: post #3

Ledger has been hacked so many times now i've lost count. I remember buying one in 2019, and shortly thereafter all customer data was dumped on the internet endangering everyone who bought one. Then after deep diving the tech i threw it in the trash, it seemed like security theatre product. There's also been so many phishing attempts, fake ledgers sold, bricked ones losing funds, it's total shitshow that ecosystem if…

>I just use isolated cheap laptops and encrypted usb's now. I figure this isn't practical for most end users. Is there an alternative hardware wallet that you think is okay for most people? How do you feel about Trezor?

For "most people", I wouldn't know, but for the typical HN reader, I would advise something open-source, verifiable, DIY, stateless and air-gapped, and that is the seedsigner:

https://seedsigner.com

To me, this is the perfect solution for a long term saving account, completed with a Lightning wallet for spending. The coldcard and Jade wallet are also great options.

Re: Ledger's NPM account has been hacked

#96

Post by lrvick »

And once again calls to allow optional signing support natively to NPM will be rejected citing that it might intimidate drive-by devs who do not want to learn to setup a yubikey or nitrokey for artifact signing.

I have talked to the NPM team about this multiple times over the last several years and they literally believe no signing at all is better than some devs feeling pressured to sign.

You need no stronger evidence of the NPM teams negligence than these two times they refused to even accept community contributed optional signing support saying they would come up with something better than PGP. Still waiting 10 years later.

https://github.com/npm/npm/pull/4016

https://github.com/node-forward/discussions/issues/29#issuec...

Meanwhile PGP secures the supply chain of the Linux distros that power the whole internet, and Debian signs hundreds of npm packages used in their dependency graph, but it is still not good enough for NPM.

You can use the well tested and rust-written Sequoia/sq now and never touch GnuPG. You can also self certify your keys with keyoxide. The past complaints are largely moot and still people stick to their guns on this.

https://openpgp.dev/book/

Re: Ledger's NPM account has been hacked

#97

Post by [deleted] »

feross wrote: post #88

We've been building Socket [1] to detect and block this exact type of supply chain attack. Our Socket AI scanner [2] successfully detected this attack. It uses dozens of static signals combined with an LLM to detect novel attacks that evade traditional scanning tools. This is what Socket AI produces when given @ledgerhq/connect-kit 1.1.7 to analyze: > The obfuscated code block is highly suspicious and likely contains…

[deleted]

Re: Ledger's NPM account has been hacked

#99

Post by stevelacy »

feross wrote: post #88

We've been building Socket [1] to detect and block this exact type of supply chain attack. Our Socket AI scanner [2] successfully detected this attack. It uses dozens of static signals combined with an LLM to detect novel attacks that evade traditional scanning tools. This is what Socket AI produces when given @ledgerhq/connect-kit 1.1.7 to analyze: > The obfuscated code block is highly suspicious and likely contains…

Is it possible to consume the malware list as JSON/SSE?
Post reply on HN