Wannan rubutun ya yi nazarin harin da aka kai wa Ledger a matsayin misali na yadda wani phising na mashi ya kai hari ga sarkar samar da software (SSC) kan kayan aikin haɗin software da walat ɗin kayan aikin kamfanin ke amfani da su, wanda hakan ya ba wa ɗan wasan damar zubar da kuɗi mai darajar dala $600,000 aƙalla.
Wannan harin ya zo ne a ƙarshen shekara mai cike da matsalolin samar da kayayyaki. A cikin wannan rubutun za mu yi nazari kan harin, tasirinsa, yadda aka shawo kansa, da kuma darussan da za a iya koya.
Ledger da masu amfani da walat ɗinsa na hardware sune abubuwan da masu aikata laifukan yanar gizo ke kai hari a kansu. Masu zubar da walat suna kai hari ga masu amfani da Ledger ta hanyar yunƙurin yin phising a kan manhajojin crypto, kuma masu aikata laifin suna buƙatar sanin tsarin masu amfani don jagorantar kamfen ɗin phising. Ledger yana da keta bayanai kafin Yuli 2023 da kuma kasancewa wani ɓangare na Satar bayanai ta Satumba 2020 a kan Shopify na kasuwancinsu na e-commerce, wani lamari mai matuƙar tasiri. Rubutun "Sabuntawa: Kokarin Kare Bayananka da kuma Gurfanar da Masu Satar Labarai"ya nuna zurfin waɗannan keta haddin.
Ledger yana buƙatar ɗaukar tsaro da muhimmanci (babban ɓangare ne na kasuwancinsu), tare da dakin bincike na ciki (ci gaba) sarrafawa takardar shaidar tsaron na'ura, a bug falala shirin, wasiƙun labarai na tsaro, Da kuma barazanar yin samfuri. Zuwa yanzu haka yana da kyau…
Yadda aka kai harin
Ledger ya gano wani abu ta amfani da Ledger's Kit ɗin Haɗa DApp a ranar Alhamis 14 ga Disamba 2023. Wannan amfani ya shigar da lambar mugunta a cikin aikace-aikacen da ba a rarraba su ba na Ethereum (DApps) waɗanda ke amfani da Ledger Connect Kit, yana yaudarar masu amfani don sanya hannu kan ma'amaloli waɗanda ke zubar da walat ɗinsu.
An gano wannan cin amanar cikin sauri kuma an aiwatar da wani tsari na ɗan lokaci bayan haka. A halin yanzu, ƙaramin adadin masu amfani sun faɗa cikin harin kuma suka sanya hannu kan yarjejeniyar ciniki, wanda hakan ya jawo wa kansu asarar kuɗi.
Harin ya fara ne lokacin da wani tsohon ma'aikacin Ledger ya fada cikin wani harin phishing wanda ya sami damar shiga asusun NPM ɗinsa ta hanyar alamar zaman. @ledgerhq/connect-kit (1.1.5, 1.1.6 da 1.1.7, yanzu sun yi ritaya). Maharan za su iya gudanar da lambar sirri tare da matakin izini iri ɗaya kamar manhajar walat: maharan za su iya zubar da kuɗin masu amfani nan take ba tare da hulɗa ba, rarraba hanyoyin haɗin yanar gizo da yawa don yaudarar masu amfani, ko amfani da firgicin masu amfani ta hanyar shawo kansu su canja wurin kadarori zuwa sabon adireshi, wanda ke haifar da asarar kadarori saboda saukar da walat ɗin karya.
Gaban walat (dApps) yawanci suna amfani da walat ɗin gaba Mai loda kayan haɗin-kit fakitin daga Ledger don loda Kayan Haɗin a lokacin aiki daga JavaScript CDN (jsDelivr). Abin takaici, URL ɗin https://cdn.jsdelivr.net/npm/@ledgerhq/connect-kit@1 ba a haɗa ainihin sigar ba (1.1.4 a lokacin), don haka lokacin da aka loda nau'ikan ɓarna, CDN ya yi musu hidima (kuma ya adana su). Kuma ba a yi amfani da checksum don tabbatar da cewa albarkatun da aka sauke daga CDN a zahiri shine wanda ake tsammani ba (wanda ya kamata a yi amfani da shi lokacin rarraba lambar daga CDN). An sanya wa wannan tsarin da aka dogara da checksum suna. Mutuncin Ƙarƙashin Ƙasa (SRI).
Lambar da aka saka wataƙila ta yi amfani da bayanan ma'amala, tana yaudarar masu amfani don tabbatar da biyan kuɗi da aka yi da gangan. Misali, mai amfani da ya amince da biyan kuɗi don ba da damar aikin wani app yana iya ganin amincewa don biyan kuɗi zuwa adireshin mai kutse. Komai amincin walat ɗin kayan aikin, an cire kuɗi.
Ganowa da Bincike
Masu amfani daban-daban sun fara aika saƙonni a cikin X (wanda aka fi sani da Twitter) cewa an "sace" Zapper. An yaba wa Mathew Lilley, CTO na Sushi, wanda ya fara yin gargaɗi a cikin wani Twitter post cewa an yi wa "mahaɗin yanar gizo da aka saba amfani da shi" kutse. Daga baya ya nuna a LedgerHQ/connect-kit a matsayin ɗakin karatu da aka yi wa katsalandan, kuma ya ba da kimantawa ta farko, kaɗan kaɗan:
Me ya faru?
— Ni Software ne 🦇🔊 (@MatthewLilley) Disamba 14, 2023
A takaice, @Ledger ya yi jerin munanan kurakurai.
1. Suna loda JS daga CDN.
2. Ba JS ne ke ɗauke da sigar kullewa ba.
3. An yi musu ɓarna a CDN ɗinsu.
Zan guji amfani da DUK WANI dApps har sai ƙungiyoyinsu sun tabbatar da cewa sun rage harin. https://t.co/a3brXNQSx9
Mai amfani 0xViva ya buɗe tikitin shiga cikin wurin ajiyar aikin GitHub: [GAGGAWA] Wannan ma'ajiyar tana amfani da sigar ɓarna ta npm package @ledgerhq/connect-kit, 1.1.7.
A ranar 15 ga Disamba, 2023, fom ɗin tsaron blockchain SlowMost ya buga wani rubutun bincike bayar da cikakkun bayanai game da nau'ikan miyagun halaye.
Ba a yi wa walat ɗin kayan aikin Ledger lahani ba, sai dai Ledger Connect Kit. Duk da haka, tunda aikace-aikace da yawa suna amfani da wannan ɗakin karatu, kamar SushiSwap, Zapper, MetalSwap, Harvest Finance, Revoke.cash, da sauransu, girman tasirin ya kasance mai mahimmanci. A cewar bittrace.io, wasu waɗanda abin ya shafa, saboda firgici, sun yi ƙoƙarin canja wurin kadarori zuwa wani sabon adireshi, amma sun sauke wata manhajar walat ta bogi!
A wannan rana, Jameson Lopp daidai tweeted akan kurakuran da suka ba da damar kai harin ya yi nasara:
Da alama lamarin tsaro na yau shine ƙarshen gazawar Ledger guda uku daban-daban:
— Jameson Lopp (@lopp) Disamba 14, 2023
1. Loda lambar a makance ba tare da sanya takamaiman sigar da checksum ba.
2. Rashin aiwatar da "dokokin mutum biyu" game da sake duba lambar da kuma tura ta.
3. Rashin soke damar shiga tsohon ma'aikaci.
Yadda aka magance lamarin
Shugaban kamfanin Ledger, Pascal Gauthier, ya wallafa a ranar da aka kai harin a wani wasiƙar bayyanawa bayar da ƙarin bayani game da lamarin, wanda tabbas yana da kyau: Ɓoye kai a cikin yashi kamar jimina ita ce hanya mafi muni ta magance duk wani lamari na tsaro ta yanar gizo.
Tsarin wasiƙar yana da ban sha'awa: Nan da nan ta fahimci akwai nau'ikan ɓarna na ɗakin karatu waɗanda ke zubar da kuɗi, wanda hakan yana da kyau (ƙin yarda da gaskiyar magana ba gaskiya ba ne):
"A yau mun fuskanci wani amfani a kan Ledger Connect Kit, wani ɗakin karatu na Javascript wanda ke aiwatar da maɓalli wanda ke ba masu amfani damar haɗa na'urar Ledger ɗinsu zuwa DApps na ɓangare na uku (shafukan yanar gizo masu haɗin walat).
Wannan cin zarafi ya faru ne sakamakon wani tsohon ma'aikaci da ya faɗa cikin harin phishing, wanda ya ba wa wani mummunan ɗan wasa damar loda fayil mai cutarwa zuwa NPMJS na Ledger (mai sarrafa fakiti don lambar Javascript da aka raba tsakanin manhajoji).
Mun yi aiki cikin sauri, tare da abokin hulɗarmu WalletConnect, don magance matsalar, ta hanyar sabunta NPMJS don cirewa da kashe lambar ɓarna cikin mintuna 40 da gano ta. Wannan kyakkyawan misali ne na yadda masana'antar ke aiki tare cikin sauri don magance ƙalubalen tsaro.
Me? Tsohon ma'aikaci mai haƙƙin wallafawa bai janye takardun shaidarsa a NPM ba?
Shugaban kamfanin ya biyo baya da lissafa matakan tsaro da ake da su amma yana nuna cewa akwai rauni game da damar NPM:
"Yanzu, ina so in yi bayani game da dalilin da ya sa hakan ya faru, yadda za mu inganta ayyukanmu na tsaro don rage wannan haɗarin a nan gaba, da kuma raba shawarwarinmu ga masana'antar, don mu kasance masu ƙarfi tare."
The standard Aikin Ledger shine babu wani mutum ɗaya da zai iya amfani da lambar ba tare da an yi nazari a kansa daga ɓangarori da yawa ba. Muna da ingantattun hanyoyin samun dama, sake dubawa na ciki, da kuma sa hannu kan lambobi da yawa idan ana maganar yawancin sassan ci gabanmu. Wannan haka yake a cikin kashi 99% na tsarinmu na ciki. Duk wani ma'aikaci da ya bar kamfanin za a kwace masa damar shiga daga kowane tsarin Ledger.
Wannan lamari ne mai ban takaici da ya faru. Abin tunatarwa ne cewa tsaro ba ya tsayawa, kuma dole ne Ledger ya ci gaba da inganta tsarin tsaro da hanyoyinmu. A wannan fanni, Ledger zai aiwatar da ingantattun tsare-tsare na tsaro, wanda zai haɗa gininmu. pipeline wanda ke aiwatar da tsare-tsare masu tsauri software supply chain security zuwa tashar rarrabawa ta NPM."
To, da alama asusun NPM mai izinin buga sabbin sigogin ɗakin karatu yana da ƙarancin tsaro fiye da sauran sassan kayan aikin software ɗin su. Shin wani lamari ne da ya keɓe saboda rashin sa'a?
Ƙarshen wasiƙar ya fi standard sashe na hulɗa da hukumomi, "bayanin da ke ƙarƙashin iko", da kuma neman afuwa:
"Ledger ya yi aiki da hukumomi kuma yana yin duk abin da za mu iya don taimakawa yayin da wannan binciken ke ci gaba. Ledger zai tallafa wa masu amfani da abin ya shafa wajen taimakawa wajen gano wannan mummunan ɗan wasan, gurfanar da su a gaban shari'a, bin diddigin kuɗaɗen, da kuma yin aiki tare da jami'an tsaro don taimakawa wajen dawo da kadarorin da aka sace daga mai satar. Muna matukar nadama da abubuwan da suka faru a yau ga mutanen da abin ya shafa.
Yanzu haka an shawo kan lamarin kuma barazanar ta wuce. Mun fahimci firgicin da wannan ya haifar wa al'umma da kuma tsarin halittu baki daya.
Wasikar ta haɗa da jadawalin lokaci, wanda yake da kyau ga masu amfani su fahimci yadda aka gano lamarin, wane takamaiman matakan kariya da gyara aka ɗauka, da kuma yadda za a dawo/biya diyya ga lalacewar da aka yi wa masu amfani da abin ya shafa. Wannan shine ɓangaren da ya fi dacewa da tsabar kuɗi:
"A safiyar yau CET, wani tsohon ma'aikacin Ledger ya faɗa cikin wani harin phishing wanda ya sami damar shiga asusun NPMJS ɗinsa. Maharin ya buga wani mummunan sigar Ledger Connect Kit (wanda ya shafi sigar 1.1.5, 1.1.6, da 1.1.7). Lambar mugunta ta yi amfani da wani aikin WalletConnect na ɗan damfara don sake tura kuɗi zuwa walat ɗin ɗan damfara. An sanar da ƙungiyoyin fasaha da tsaro na Ledger kuma an fara gyara cikin mintuna 40 da Ledger ya fahimci lamarin. Fayil ɗin mugunta ya kasance a shirye na tsawon awanni 5, duk da haka mun yi imanin cewa taga inda aka yi asarar kuɗi ta takaita ne ga ƙasa da awanni biyu.An haɗa Ledger da WalletConnect wanda ya kashe aikin da ba a san shi ba cikin sauri. Sigar Ledger Connect Kit ta 1.1.8 ta gaske kuma an tabbatar da ita yanzu tana yaɗuwa kuma tana da aminci don amfani.
Ga masu gini waɗanda ke haɓakawa da hulɗa da lambar Ledger Connect Kit: ƙungiyar haɓaka connect-kit akan aikin NPM yanzu an karanta su ne kawai kuma ba za su iya tura fakitin NPM kai tsaye ba saboda dalilai na tsaro. Mun juya sirrin da za a buga a cikin GitHub na Ledger. Masu haɓakawa, da fatan za a sake duba cewa kuna amfani da sabuwar sigar, 1.1.8.
Ledger, tare da WalletNarine da abokan hulɗarmu, sun ba da rahoton adireshin walat ɗin ɗan wasan da ba shi da kyau. Adireshin yanzu yana bayyane akan Chainalysis. Tether ya daskarar da USDT na mugun ɗan wasan kwaikwayo.
A cewar wannan, an yi gaggawa wajen hana ayyukan WalletConnect na damfara don sake tura kuɗi cikin gaggawa. Amma duk da haka, an cire wasu walat ɗin.
Bayan haka: Yadda Masana'antar ta Yi Martani
Wasu masu amfani da shafin sun nuna fushinsu ga Ledger saboda gazawar hana sulhun, yayin da wasu kuma suka yi gargaɗi game da haɗarin dogaro da ɗakunan karatu na wasu kamfanoni.
Masana'antar tsaro ta yanar gizo tana da wani matsayi a fannin cybercoin. Yaƙin neman zaɓe na cire walat sananne ne, wanda galibi yana amfani da shafukan yanar gizo na leƙen asiri don yaudarar masu amfani. Kasuwancin SaaS na yau da kullun (Scam-as-a-Service) yana da ƙwararrun masu aiki don cire walat, kamar mai sayar da zamba. Magudanar Ruwa ta Inferno wanda an sanar da dakatar da ayyukan a watan Nuwamba 2023. Wannan alama alama ce ta ƙarya ko ta yaya, bisa ga ayyukan da aka gani kwanan nan a Dune's @scamsnifferWannan rubutu na Group-IB ya yi bayani game da tsarin da suka bi:
Wasu masu sharhi sun bayar da shawarwari kan abin da ya kasa yiwuwa a kai harin. sharhi daga mai amfani briandk A cikin tikitin da ke kan ma'ajiyar aikin, yana ba mu haske game da tushen dalilin:
A sharhin wani mai amfani, HenryQW, ya nuna abu na biyu da ya sa ƙwayoyin cuta suka sami damar yaɗuwa ta hanyar CDN:
Ya yi wuri a ga shirye-shiryen dogon lokaci don sanya walat ɗin crypto ya fi ƙarfi akan hare-haren phishing. Da alama ana buƙatar bin ƙa'idodi standard kama da abin da PA-DSS Ana iya maraba da masu siyar da software na aikace-aikacen biyan kuɗi a masana'antar crypto.
Kuma Yanzu, Darussa da aka Koya!
Abin mamaki ne yadda walat ɗin kayan aiki, misali na tsaron crypto, an karya shi kawai ta hanyar rage damar shiga takardun shaidar NPM na "tsohon ma'aikaci" na Ledger (mai yiwuwa sunan mai amfani/kalmar sirri ba tare da kariyar 2FA ba, ko alamar shiga). Wannan lamari yana aiki a matsayin tunatarwa mai ban mamaki cewa lokacin da kake fuskantar suka, kayan aikin software ɗinka suna buƙatar kariya da kulawa iri ɗaya da samfuran software ko kayan aikinka.
Yawancin hare-haren sarkar samar da software suna farawa ne ta hanyar lalata asusun cikin gida (sau da yawa ga mai haɓakawa ko injiniyan haɓaka software). Sannan maharan ko dai suna motsawa a gefe don karya tsarin cikin gida a cikin kayan aikin software kamar CI/CD tsarin ko kayan aikin tura bayanai, ko kuma a sami damar ƙara dabaru masu cutarwa ga ma'ajiyar lambar tushe, wanda za a iya gano shi idan an yi amfani da canje-canje da kyau tare da kariyar reshe da sake duba lambar. Amma masu kai hari ba sa buƙatar yin zurfi sosai idan abin da ake nema shine ɗakin karatu mai shahara wanda aka buga a cikin rajistar jama'a, musamman idan za su iya samun damar buga (rubuta) takardun shaida. Kuma wannan shine abin da ya faru a wannan harin.
2FA tantancewa, musamman amfani da abubuwa masu ƙarfi kamar maɓallan tsaro, yana iyakance haɗarin ta hanyar ayyukan hulɗa. CI/CD pipelines, alamun shiga tare da ƙarancin damar shiga da aka adana azaman CI/CD sirri shine hanyar da aka saba bi (kuma bai kamata a fallasa alamar shiga ba). Abin takaici, da alama ma'aikacin ba shi da saitin 2FA mai ƙarfi. NPM yana ba da damar ƙungiyoyi don aiwatar da 2FA (amma wannan zaɓi ne, ba tsoho ba), wanda wataƙila Ledger ya kamata ya samu. Kuma kar a manta da ƙara abin da ya dace. soke takardun shaidar aiki hanyoyin da za a bi don tsoffin ma'aikata, musamman tare da samun damar albarkatu masu mahimmanci kamar tsarin NPM da ƙungiyar ke da shi.
Raba sigar don dogaro da abubuwan da aka sake dubawa na sigar aiki ne da ke rage yaɗuwar abubuwan da suka shafi mugunta. A cikin mahallin lamarin Ledger, nau'ikan ɗakin karatu da ke nuna cewa Mai loda kayan haɗin-kit Ya kamata a saka alamar da aka ɗauka daga CDN, kuma "kada ku amince da duk abin da CDN ya jefa". Tabbatar da checksum Misali ta hanyar SRI (ko ma tsarin sa hannu na dijital wanda ke tabbatar da asalin) ya kamata a yi amfani da shi lokacin cirewa daga CDN don loda lambar aiki mai ƙarfi.
Sauran labarin ne.
Ga kamfen ɗin phishing na gargajiya da aka yi wa masu amfani da walat, tambayar ita ce: Me ke sa masu amfani su faɗa cikin tarko da masu laifi suka kafa da kuma tabbatar da ma'amaloli da ba su taɓa niyyar yi ba? Shafukan phishing a cikin wannan yanki an tsara su da kyau kuma sun gamsar, suna kwaikwayon shahararrun samfuran crypto; kuma suna bayar da alamun kyauta, sarrafa NFTs da sauran lada. Guje wa masu amfani da su faɗa cikin irin waɗannan tarkuna matsala ce da ke neman mafita.
Kuma kada a manta masu alaƙa satar bayanai ta hanyar cryptohacking hare-hare, barazana mafi girma, inda abokan gaba ke kwace kayayyakin more rayuwa na girgije don gudanar da masu hakar ma'adinai don cryptocurrency, sau da yawa don tsabar kuɗi na sirri kamar Monero XMR da Zcash, tare da tarihin ma'amala ɓoyayye. Cryptojacking yana da mahimmanci saboda yana iya shafar KOWANE ƙungiya, kuma kodayake ribar mai kai hari na iya zama ƙasa, farashin wanda aka azabtar na iya zama babba (Sysdig da aka ambata a cikin wannan rahoto cewa yana ɗaukar dala $53 a matsayin kuɗin ƙungiyar da abin ya shafa ga kowace dala $1 da aka haƙa wa maharin).
References
- Tikitin "[GAGGAWA] Wannan ma'ajiyar tana amfani da sigar ɓarna ta npm package @ledgerhq/connect-kit, 1.1.7"a cikin ma'ajiyar Github.
- Wasika daga Shugaban Kamfanin Ledger kan lamarin, 14 Disamba 2023.
- Rahoton Abin da Ya Faru a Tsaro, ta Ledger, 20 Disamba 2023.
- Amfani da Ledger na Haɗari da DeFi; Sushi ya ce 'Kada ku yi mu'amala da kowace dApps', a saka a ciki CoinDesk ta Oliver Knight, 14 Dec 2023.
- Harin Sarkar Samar da Kayayyaki akan Kayan Haɗin Ledger: Binciken Tasirin da Matakan Rigakafi. Rubutu daga SlowMist game da harin, Disamba 2023.
- Ka'idojin Tsaro na Web3: Magudanar Ruwa ta Wallet, na Jammel Weaver, a cikin Rektify AI, Jul 2023.
Kalli Bidiyon Nunin Mu
