The Blueprint of a North Korean Attack on Open-Source
1–10 of 13 posts
Re: The Blueprint of a North Korean Attack on Open-Source
#2Author here. We were analyzing a compromised contributor account targeting better-auth when we noticed something interesting about the attack vector. Most coverage of supply chain attacks focuses on the "what happened" but I wanted to document the "how it actually works" with the deobfuscated code.
Wwo things stood out: 1. hiding the payload in next.config.mjs is clever because GitHub's UI truncates long lines so the malicious string is literally invisible when scrolling through the file. second, storing the c2 payload on binance smart chain means theres no server to take down. The axios attack was mitigated by removing the GitHub-hosted payload. This one can't be.
2. found 30+ repos with the same signature string. Pretty sure there's way more we didn't catch with basic string matching.
happy to answer questions about the deobfuscation process or the c2 protocol analysis.
Re: The Blueprint of a North Korean Attack on Open-Source
#3The blockchain angle to circumvent takedowns of the payload hosting here is really interesting.
Re: The Blueprint of a North Korean Attack on Open-Source
#4break one maintainer, own the ecosystem. btw, beautiful graphs
Re: The Blueprint of a North Korean Attack on Open-Source
#5Author here. We were analyzing a compromised contributor account targeting better-auth when we noticed something interesting about the attack vector. Most coverage of supply chain attacks focuses on the "what happened" but I wanted to document the "how it actually works" with the deobfuscated code. Wwo things stood out: 1. hiding the payload in next.config.mjs is clever because GitHub's UI truncates long lines so the…
> GitHub's UI truncates long lines so the malicious string is literally invisible when scrolling through the file.
It looks like the screen recording was made on a Mac. Does your browser (Chrome?) respect the OS-wide ‘Always show scroll bars’ setting?
After all, it’s not that GitHub is “truncating” the lines, it’s that scroll bars aren’t visible - so it’s not immediately obvious that there’s code outside of the viewport.
Re: The Blueprint of a North Korean Attack on Open-Source
#6The blockchain angle to circumvent takedowns of the payload hosting here is really interesting.
The blockchain is a red herring, it's still just connecting to an HTTPS server which serves the payload. Not that different from using any other web host which turns a blind eye to abuse.
Re: The Blueprint of a North Korean Attack on Open-Source
#7Author here. We were analyzing a compromised contributor account targeting better-auth when we noticed something interesting about the attack vector. Most coverage of supply chain attacks focuses on the "what happened" but I wanted to document the "how it actually works" with the deobfuscated code. Wwo things stood out: 1. hiding the payload in next.config.mjs is clever because GitHub's UI truncates long lines so the…
Your website fingerprints devices so hard it throws a warning after rendering content.
Re: The Blueprint of a North Korean Attack on Open-Source
#8Author here. We were analyzing a compromised contributor account targeting better-auth when we noticed something interesting about the attack vector. Most coverage of supply chain attacks focuses on the "what happened" but I wanted to document the "how it actually works" with the deobfuscated code. Wwo things stood out: 1. hiding the payload in next.config.mjs is clever because GitHub's UI truncates long lines so the…
> GitHub's UI truncates long lines so the malicious string is literally invisible when scrolling through the file. It looks like the screen recording was made on a Mac. Does your browser (Chrome?) respect the OS-wide ‘Always show scroll bars’ setting? After all, it’s not that GitHub is “truncating” the lines, it’s that scroll bars aren’t visible - so it’s not immediately obvious that there’s code outside of the viewp…
> it’s that scroll bars aren’t visible
well truncating or not, that seems to be a major security UI issue...?
Re: The Blueprint of a North Korean Attack on Open-Source
#9Author here. We were analyzing a compromised contributor account targeting better-auth when we noticed something interesting about the attack vector. Most coverage of supply chain attacks focuses on the "what happened" but I wanted to document the "how it actually works" with the deobfuscated code. Wwo things stood out: 1. hiding the payload in next.config.mjs is clever because GitHub's UI truncates long lines so the…
Your website fingerprints devices so hard it throws a warning after rendering content.
are you using Safari's Lockdown Mode?