port
port
ETH+0.18%
1/? You can get drained by installing a vscode/cursor extension! Recently, some people has noticed that there are malicious copies of popular extensions like Solidity and Hardhat! Previously, ~$500,000 was stolen due to a malicious code editor extension. 🧵👇
Gallery 1
- in this thread, I will be compiling all the tweets I can find about the malicious code editor extensions - threador arc??? keep reading
2/10 These issues have been resurfacing a few times early year but this time @0xZodomo 's thread put many more eyes on it.
zodomo.eth (🌍,💻)
zodomo.eth (🌍,💻)
Is there a malicious solidity VSCode extension? It seems the version from `juan-blanco` has more downloads/better reviews, despite being new. The version from `juanblanco` has bad reviews, less downloads, but longer history. The newer version DID NOT WORK, so I looked further. 🧵
Gallery 1
Gallery 2
3/10 Then, @pcaversaccio, one of the ct security chads started looking into it.
sudo rm -rf --no-preserve-root /
sudo rm -rf --no-preserve-root /
This extension is fake and probably very malicious - always check _who_ published it (Microsoft when provenance for extensions??). If you installed the extension, disconnect immediately from the internet, move all of your hot wallet assets on that device to a safe hardware wallet & open a ticket with us at SEAL 911.
Gallery 1
Gallery 2
4/10 More quoting that tweet above:
sudo rm -rf --no-preserve-root /
sudo rm -rf --no-preserve-root /
so the malicious part is in the `modal.js` file; TL;DR is the following. The obfuscation applied is: - `hexColors` array holds Base64 fragments padded with `#` - Reversed, joined, stripped of `#`, Base64-decoded - Decoded code executed via hidden `eval` (`ZXZhbA==`) The behaviour is: - Targets Windows (`win32`) and macOS (`darwin`) only - Disables `TLS` certificate verification (`NODE_TLS_REJECT_UNAUTHORIZED = "0"`). - Fetches remote JS from: Windows → p92nd[.]pages[.]dev/cj292ke.txt macOS → p92nd[.]pages[.]dev/ufjm20r.txt - Executes fetched code via `eval` (arbitrary code execution) - Uses `process.exit(0)` for stealth termination on errors or empty payload I won't got into more details for now. Actions are taken.
Gallery 1
7/10 A kaspersky employee sharing his analysis
Georgy Kucherin
Georgy Kucherin
A few weeks ago, I was responding to a cybersecurity incident - $500,000 have been stolen from a #blockchain developer. The infected operating system was freshly installed, and the victim was vigilant about cybersecurity. How could this happen? New supply chain attack? [1/6]
8/10 Another tweet by @juanfranblanco
Juan Blanco ☀️☀️🍞🍞🦇🔊
Juan Blanco ☀️☀️🍞🍞🦇🔊
@code There is a new solidity extension impersonating mine, my name etc. This extension has just been published today, and has managed to even fake a whopping 20 million downloads. This might include malware.
Gallery 1
Feel free to plug in more threads / tweets below!
Sourced fromtwitter
2.6K
78
The content on this page is provided by third parties. Unless otherwise stated, OKX TR is not the author of the cited article(s) and does not claim any copyright in the materials. The content is provided for informational purposes only and does not represent the views of OKX TR. It is not intended to be an endorsement of any kind and should not be considered investment advice or a solicitation to buy or sell digital assets. To the extent generative AI is utilized to provide summaries or other information, such AI generated content may be inaccurate or inconsistent. Please read the linked article for more details and information. OKX TR is not responsible for content hosted on third party sites. Digital asset holdings, including stablecoins and NFTs, involve a high degree of risk and can fluctuate greatly. You should carefully consider whether trading or holding digital assets is suitable for you in light of your financial condition.