Chinyorwa ichi chinoongorora kurwiswa kwakaitwa Ledger semuenzaniso wekuti kupinzwa kwesimba remakonzo kwakakonzera sei kurwiswa kwesoftware supply chain (SSC) pachishandiso chekubatanidza software chakashandiswa nemahardware wallets ekambani, zvichiita kuti mutambi uyu akwanise kubvisa mari inokosha $600,000.
Kurwiswa uku kwakaitika pakupera kwegore rakazara nezviitiko zvekutengesa zvinhu. Muchinyorwa chino tinoongorora kurwiswa uku, mhedzisiro yako, kuti kwakabatwa sei, uye zvidzidzo zvingawanikwa.
Ledger nevanoshandisa hardware wallet yake ndivo vanhu vanoonekwa sevapari vemhosva dzepaindaneti. Vanoshandisa wallet drainage vairwisa vashandisi veLedger vachishandisa phising vachiedza kushandisa crypto apps, uye matsotsi anofanira kuziva macoordinates evashandisi kuti vatungamire phising campaigns. Ledger aive ne kutyorwa kwedata panosvika Chikunguru 2023 pamwe nekuva chikamu che Kubiwa kwedata munaGunyana 2020 paShopify yavo yekutengeserana paindaneti, chiitiko chakakanganisa zvikuru. Chinyorwa "Kuvandudzwa: Kuedza Kudzivirira Data Rako uye Kupomera Vapambi" zvinoratidza kuti kuputsa uku kwakadzama sei."
Ledger inofanira kutora nyaya dzekuchengetedza zvakakomba (ndiyo chikamu chakakosha chebhizinesi ravo), nerabhoritari yekutsvagisa yemukati (mugomba) kubata chitupa chekuchengetedzwa kwemudziyo, mumwe bug bounty purogiramu, magwaro ekuchengetedza, uye kutyisidzira modelling. Kusvika pari zvino zvakanaka kwazvo ...
Kurwiswa kwacho kwakaitwa sei
Ledger yakaona chimwe chinhu chinoshandiswa neLedger's Kiti yekubatanidza yeDApp neChina musi wa14 Zvita 2023. Kushandiswa uku kwakaisa kodhi yakaipa mukati meEthereum-based decentralized applications (DApps) dzaishandisa Ledger Connect Kit, zvichinyengera vashandisi kuti vasaine kutengeserana kwaipedza mari yavo yakawanda.
Kushandiswa uku kwakakurumidza kuonekwa uye chisarudzo chakaitwa nguva pfupi yadarika. Panguva iyi, vanhu vashoma vakawira mukurwiswa uku ndokusaina kutengeserana kwacho kwava kupera mari yavo.
Kurwiswa kwacho kwakatanga apo aimbove mushandi weLedger akarwiswa nephishing iyo yakawana mukana wekupinda muakaundi yake yeNPM kuburikidza ne session token. Varwi vakaburitsa mavhezheni ane hutsinye e @ledgerhq/connect-kit (1.1.5, 1.1.6 na 1.1.7, yava kurega basa). Varwisi vanogona kushandisa kodhi isina mvumo nemazinga akafanana neeapp yewallet: varwisi vanogona kubvisa mari yevashandisi nekukurumidza pasina kutaurirana, kugovera ma phishing links akawanda kuti vanyengere vashandisi, kana kushandisa kutya kwevashandisi nekuvanyengetedza kuti vatumire midziyo kukero itsva, zvichikonzera kurasikirwa nemidziyo nekuda kwekudhawunirodha wallet yenhema.
Ma "wallet front-ends" (dApps) aiwanzo shandiswa chinotakurisa-kit pasuru kubva kuLedger kuti uise Connect Kit panguva yekumhanya kubva kuJavaScript CDN (jsDelivr). Zvinosuwisa kuti URL yacho https://cdn.jsdelivr.net/npm/@ledgerhq/connect-kit@1 yakanga isiri kuisa vhezheni chaiyo (1.1.4 panguva iyoyo), saka apo mavhezheni ane njodzi akaiswa, aipihwa (uye akachengetwa) neCDN. Uye hapana checksum yakashandiswa kuve nechokwadi chekuti sosi yakatorwa kubva kuCDN ndiyo chaiyo yaitarisirwa (iyo inofanira kushandiswa pakuparadzira kodhi kubva kuCDN). Chirongwa ichi chakavakirwa pachecksum chinonzi Kuvimbika kweZviwanikwa Zvishoma (SRI).
Kodhi yakapinzwa ingangove yakashandura data rekutengeserana, zvichinyengera vashandisi kuti vasimbise mari dzakagadziriswa. Semuenzaniso, mushandisi anobvumidza kubhadhara kwe token kuti app ishande zvakanaka angangodaro akaona mvumo yekubhadhara kero yemuparidzi wedhiraivha. Pasinei nekuti hardware wallet yacho yakachengeteka sei, mari yacho yakabviswa.
Kuwanikwa uye Kuferefeta
Vashandisi vakasiyana vakatanga kutumira mameseji muX (inozivikanwawo seTwitter) ekuti kambani yeZapper "yakabatwa nechisimba". Matewu Lilley, CTO wemutengesi we cryptotrader Sushi, akatanga kunyevera mumashoko ake. Twitter romukova kuti "chinobatanidza chinowanzo shandiswa chewebhu3" chakakanganiswa. Gare gare akanongedzera ku LedgerHQ/kit yekubatanidza seraibhurari yakakanganiswa, uye vakapa ongororo yekutanga, zvishoma nezvishoma:
Chii chakaitika?
— Ndiri Software 🦇🔊 (@MatthewLilley) December 14, 2023
Muchidimbu, @Ledger vakaita ketani yezvikanganiso zvinotyisa.
1. Vari kurodha JS kubva kuCDN.
2. Hadzisi shanduro dzinokiya JS dzakatakura.
3. Vakaita kuti CDN yavo ive nedambudziko.
Ndingadzivisa kushandisa chero dApps kusvika zvikwata zvavo zvasimbisa kuti vaderedza kurwiswa. https://t.co/a3brXNQSx9
Mushandisi 0xViva akavhura tikiti muGitHub project repo: [KUKURUMIDZA] Iyi repository inoshandisa vhezheni yakaipa ye npm package @ledgerhq/connect-kit, 1.1.7.
Musi wa15 Zvita 2023, fomu rekuchengetedza blockchain SlowMost rakaburitsa chinyorwa chekuongorora kupa ruzivo rwakazara nezvemavhezheni ane hutsotsi.
Chikwama chemidziyo cheLedger hachina kukanganiswa, asi Ledger Connect Kit chete ndiyo yaishandiswa. Zvisinei, sezvo mapurogiramu mazhinji achishandisa raibhurari iyoyo, yakaita seSushiSwap, Zapper, MetalSwap, Harvest Finance, Revoke.cash, nezvimwewo, huwandu hwemhedzisiro hwacho hwaive hwakakura. Sekureva kwaLedger Connect Kit, kambani iyi yakabatsira zvikuru. bittrace.io, vamwe vakabatwa nechirwere, nekuda kwekutya, vakaedza kutamisa midziyo yavo kuenda kune imwe kero, asi vakadhawunirodha app yekunyepera yewallet!
Zuva rimwe chete iroro, Jameson Lopp nemazvo tweeted pamusoro pezvikanganiso zvakaita kuti kurwiswa uku kubudirire:
Zvinoita sekunge chiitiko chekuchengetedza chanhasi chakakonzerwa nekukundikana kutatu kwakasiyana paLedger:
— Jameson Lopp (@lopp) December 14, 2023
1. Kurodha kodhi usingafungi pasina kuisa vhezheni chaiyo uye checksum.
2. Kusashandisa "mitemo yevanhu vaviri" panyaya yekuongorora nekushandisa kodhi.
3. Kusabvisa mukana wekushanda nevashandi vekare.
Mabatirwo akaitwa chiitiko ichi
Mukuru weLedger, Pascal Gauthier, akanyora pazuva rimwe chete rekurwiswa kwacho achiti tsamba yekuzivisa kupa rumwe ruzivo nezvechiitiko ichi, izvo zvakanaka chose: Kuvanza musoro mujecha semhou ndiyo nzira yakaipa yekugadzirisa chero chiitiko chekuchengetedzwa kwepaindaneti.
Maumbirwo etsamba yacho anonakidza: Yakaona nekukurumidza kuti raibhurari yacho ine mhando dzenhema dzinopedza mari, izvo zvakanaka (kuramba chokwadi hazvina musoro):
"Nhasi tasangana nechiitiko cheLedger Connect Kit, raibhurari yeJavascript inoshandisa bhatani rinobvumira vashandisi kubatanidza mudziyo wavo weLedger kune mamwe mawebhusaiti ane wallet-connected."
Kushungurudzwa uku kwakakonzerwa nekurwiswa kwe phishing kwakaitwa nemushandi wekare, izvo zvakabvumira munhu akaipa kuisa faira rine hukasha kuLedger's NPMJS (package manager yeJavascript code inogovaniswa pakati pemaapplication).
Takashanda nekukurumidza, pamwe chete nemubatsiri wedu weWalletConnect, kugadzirisa nyaya iyi, tichivandudza NPMJS kuti ibvise uye ibvise kodhi yakaipa mukati memaminitsi makumi mana kubva payakawanikwa. Uyu muenzaniso wakanaka wekuti indasitiri iyi inoshanda pamwe chete nekukurumidza kugadzirisa matambudziko ekuchengetedza.
Chii? Aimbove mushandi ane kodzero dzekubudisa mabhuku haana kubvisirwa zvitupa zvake paNPM?
CEO akatevera nekunyora pasi zvidziviriro zvekuchengetedza zviripo asi achiratidza kuti pane chimwe chinhu chaive chisina kusimba neNPM access:
"Zvino, ndinoda kutaura kuti sei izvi zvakaitika, kuti tichavandudza sei maitiro edu ekuchengetedza kuderedza njodzi iyi mune ramangwana, uye kugovera mazano edu kuindasitiri, kuitira kuti tigone kusimba pamwe chete."
The standard Maitiro eLedger ndeekuti hapana munhu mumwe chete anogona kuisa kodhi pasina kuongororwa nemapoka akawanda. Tine masimba ekutonga kupinda, ongororo dzemukati, uye makodhi akawanda-masaini kana zvasvika kuzvikamu zvakawanda zvebudiriro yedu. Izvi ndizvo zvinoitika mu99% yemasisitimu edu emukati. Chero mushandi anosiya kambani anotorerwa mukana wekupinda muLedger system yega yega.
Ichi chaive chiitiko chisina kunaka chakasiyana. Chiyeuchidzo chekuti kuchengetedzeka hakuna kumira, uye Ledger inofanira kuramba ichivandudza masisitimu edu ekuchengetedza uye maitiro. Munzvimbo iyi, Ledger ichaisa zvidzoreso zvekuchengetedza zvakasimba, ichibatanidza kuvaka kwedu. pipeline izvo zvinoshandisa zvakasimba software supply chain security kuenda kunzira yekugovera yeNPM."
Zvaiita sekunge account yeNPM ine mvumo yekuburitsa shanduro itsva dzeraibhurari yaive nekutonga kwakasimba kwekuchengetedza kupfuura zvimwe zvikamu zvesoftware yavo. Chiitiko chakaparadzaniswa nekuda kwerombo rakaipa here?
Kuguma kwetsamba kwakawedzera standard chikamu chekutaurirana nevane masimba, "chirevo chekutonga", uye kukumbira ruregerero:
"Ledger yataurirana nevakuru vakuru uye iri kuita zvese zvatinogona kuti ibatsire sezvo kuferefeta uku kuri kuitika. Ledger ichatsigira vashandisi vakakanganiswa mukubatsira kuwana munhu akaipa uyu, kuvaunza kumatare edzimhosva, kutsvaga mari yacho, uye kushanda nemapurisa kubatsira kudzosa midziyo yakabiwa kubva kumupari wemhosva. Tinodemba zvikuru zviitiko zvakaitika nhasi kune vanhu vakakanganiswa."
Mamiriro ezvinhu ari pasi pesimba uye njodzi yacho yapera. Tinonzwisisa kutya kwakakonzerwa neizvi munharaunda uye kunharaunda yakakura.
Tsamba iyi ine nguva yakatarwa, iyo yakanaka kwazvo kuti vashandisi vanzwisise kuti chiitiko ichi chakawanikwa sei, kuti ndeapi matanho chaiwo ekudzivirira nekugadzirisa akatorwa, uye kuti kukuvara kwevashandisi vakakanganiswa kuchadzorerwa sei/kubhadharwa sei. Ichi ndicho chikamu chakanangana nemari:
"Mangwanani ano CET, aimbove mushandi weLedger akabatwa nekurwiswa kwephishing kwakawana mukana wekupinda muakaundi yavo yeNPMJS. Murwisi akaburitsa vhezheni yakaipa yeLedger Connect Kit (ichikanganisa shanduro 1.1.5, 1.1.6, uye 1.1.7). Kodhi yakaipa yakashandisa purojekiti yeWalletConnect isina hunhu kuti iendese mari kune hacker wallet. Mapoka eLedger etekinoroji nekuchengetedza akaziviswa uye kugadziriswa kwakaitwa mukati memaminitsi makumi mana kubva Ledger yazviziva. Faira rematsotsi rakaonekwa kwemaawa angangoita mashanu, asi tinotenda kuti nguva yaishandiswa mari yakanga yakaganhurirwa kune isingasviki maawa maviri.Ledger yakabatana neWalletConnect iyo yakakurumidza kudzima chirongwa che "rogue". Ledger Connect Kit vhezheni 1.1.8 yechokwadi uye yakasimbiswa yava kupararira uye yakachengeteka kushandisa.
Kune vavaki vari kugadzira uye kushandisa kodhi yeLedger Connect Kit: timu yekugadzira connect-kit pachirongwa cheNPM yava kungoverengwa chete uye haigone kusundidzira zvakananga package yeNPM nekuda kwezvikonzero zvekuchengetedza. Tatenderedza mukati medu zvakavanzika zvekuburitsa paGitHub yaLedger. Vagadziri, ndapota tarisai zvakare kuti muri kushandisa vhezheni yazvino, 1.1.8.
Ledger, pamwe chete WalletConnect pamwe chete nevamwe vedu, vakataura nezve kero yechikwama chemutambi asina kunaka. Kero yacho yava kuoneka pa Chainalysis. Tether yaisa USDT yemutambi akaipa.
Zvichienderana neizvi, kudzora kwakakurumidza sezvo chirongwa cheWalletConnect chekugadzirisa mari yekufambisa chakamiswa nekukurumidza. Asi kunyangwe izvi, mamwe mawallet akabviswa.
Mugumisiro: Maitiro Akaita Indasitiri
Vamwe vashandisi vakaratidza hasha kuna Ledger nekuda kwekutadza kudzivirira kubvumirana uku, nepo vamwe vakanyevera nezvengozi dzekuvimba nemaraibhurari evamwe.
Indasitiri yekuchengetedzwa kwemakombiyuta ine nzvimbo yayo mu cybercoin. Makambani ekubvisa mari muwallet anozivikanwa zvikuru, ayo anonyanya kushandisa mawebhusaiti ephishing kunyengedza vashandisi vekupedzisira. Bhizinesi reSaaS rinowanzoitwa (Scam-as-a-Service) rine hunyanzvi hwekubvisa mari muwallet, semutengesi wehutsotsi. Muchina wekubvisa mvura weInferno izvo kuziviswa kwekumira kwemabasa muna Mbudzi 2023. Izvi zvinoita semureza wenhema zvakadaro, zvichienderana nezviitiko zvakaonekwa munguva pfupi yapfuura muDune's @scamsnifferChirongwa chavanotevera chakatsanangurwa nechinyorwa ichi cheGroup-IB:
Vamwe vaongorori vakapa mazano pamusoro pezvakatadza kuita kuti kurwiswa uku kuitike. mhinduro nemushandisi brianddk Mutikiti riri mudura reprojekiti iyi rinotipa ruzivo nezvechikonzero chikuru:
A mashoko emumwe mushandisi, HenryQW, vakanongedzera pachinhu chechipiri chakaita kuti shanduro dzakashata dzikwanise kupararira kuburikidza neCDN:
Zvava kutanga kuona zvirongwa zvenguva refu zvekusimbisa ma crypto wallets kuti asashandise phishing attacks. Zvinoita sekunge zvinoda kutevedzera mitemo ye standard zvakafanana nezviri kuitwa ne PA-DSS Zvinoitwa nevatengesi vesoftware vemaapplication ekubhadhara zvinogona kugamuchirwa muindasitiri ye crypto.
Uye Zvino, Zvidzidzo Zvadzidzwa!
Zvinoshamisa kuti chikwama chehardware, muenzaniso wekuchengetedzwa kwemari yedhijitari, yakatyorwa nekungotsvaga mukana wekuwana zvitupa zveNPM ye "aimbove mushandi" weLedger (zvichida zita rekushandisa/password isina dziviriro ye2FA, kana token yekupinda). Chiitiko ichi chinoshanda sechiyeuchidzo chinoshamisa chekuti kana uri mukutsoropodzwa, zvivakwa zvesoftware yako zvinofanirwa kuchengetedzwa nekungwarira kwakafanana nezvigadzirwa zvesoftware kana hardware yako.
Kurwiswa kwakawanda kwesoftware supply chain kunotanga nekuisa muakaundi yemukati (kazhinji kune mugadziri wesoftware kana mainjiniya wedevops). Varwisi vanobva vaenda kudivi vachityora masisitimu emukati mune software infrastructure senge CI/CD system kana maturusi ekushandisa, kana kukwanisa kuwedzera logic yakaipa kuma source code repositories, ayo anogona kuonekwa kana paine kugadziriswa kwakakodzera kwekuchinja ne branch protection uye kodhi reviews. Asi varwisi havafanirwe kunyura zvakanyanya kana chinangwa chiri raibhurari inozivikanwa inoburitswa mu public registry, kunyanya kana vachigona kuwana mukana wekunyora (kuburitsa) marekodhi. Uye izvi ndizvo zvakaitika mukurwiswa uku.
2FA chokwadi, kunyanya kushandisa zvinhu zvakasimba zvakaita semakiyi ekuchengetedza, zvinoderedza njodzi nekushanda pamwe chete. CI/CD pipelines, ma "access token" ane mukana mudiki wekuwanikwa akachengetwa se CI/CD chakavanzika ndiyo nzira yakajairika yekushandisa (uye access token haifanirwe kubuda). Zvinosuwisa kuti, zvinoita sekunge mushandi wacho akanga asina seti yakasimba ye2FA. NPM inobvumira masangano ekusimbisa 2FA (asi izvi hazvidiwi, kwete zvekutanga), izvo zvingangodaro ndizvo zvinofanira kuva neLedger. Uye musakanganwa kuwedzera zvakakodzera kubviswa kwemagwaro ekusimbisa maitiro evashandi vekare, kunyanya nekuwana zviwanikwa zvakakosha sezvinodiwa neNPM zvesangano.
Kupinza shanduro Kushandiswa kwemaitiro ekushandisa maitiro ... chinotakurisa-kit zvakatorwa kubva kuCDN zvaifanira kunge zvakanamirwa, uye "usavimba nechero chinokanda CDN". Kuva ne kuchengetedzwa kwechecksum semuenzaniso kuburikidza neSRI (kana kunyange chirongwa chedhijitari chinosimbisawo tsime) chinofanira kushandiswa pakudhonza kubva kuCDN kuti kodhi itange kurodha.
Zvimwe zvese inyaya.
Kune ma "phishing campaigns" akajairika anoshandiswa kune vanoshandisa ma "wallets", mubvunzo ndewekuti: Chii chinoita kuti vashandisi vawire mumisungo inoiswa nematsotsi uye kusimbisa kutengeserana kwavasina kumbofunga kuita? Mawebhusaiti e "phishing" ari munharaunda iyi akagadzirwa zvakanaka uye anogutsa, achitevedzera ma "crypto brands" anozivikanwa; uye anopawo ma "token" emahara, kugadzira maNFT nemimwe mibairo. Kudzivirira vashandisi kupinda mumisungo yakadaro idambudziko rekutsvaga mhinduro.
Uye kuti usakanganwe zvine chekuita nazvo cryptohacking kurwiswa, kutyisidzira kwakajairika, uko vavengi vanotora zvivakwa zvemakore kuti vashandise vabati vemigodhi kuti vawane mari ye crypto, kazhinji mari yekuchengetedzwa kwepachivande seMonero XMR neZcash, ine nhoroondo dzekutengeserana dzakavanzika. Kubiwa kwemari ye crypto kwakakosha nekuti kunogona kukanganisa chero sangano, uye kunyangwe purofiti yemurwisi ingave yakaderera, mutengo wemunhu anenge abatwa unogona kunge wakakura (Sysdig ataurwa mu iyi mushumo kuti zvinotora $53 semutengo wesangano revanobatwa pa$1 yega yega inocherwa yeanorwisa).
References
- Tikiti “[KUKURUMIDZA] Iyi nzvimbo yekushandisa inoshandisa vhezheni yakaipa ye npm package @ledgerhq/connect-kit, 1.1.7"munzvimbo yekuchengetedza yeGithub."
- Tsamba inobva kuna CEO weLedger pamusoro pechiitiko ichi, 14 Zvita 2023.
- Mushumo weZviitiko zveKuchengetedzeka, rakanyorwa naLedger, 20 Zvita 2023.
- Kushandiswa kweLedger Kunoisa DeFi Mungozi; Sushi Anoti 'Usataurirane Nechero DApps', tumira mukati CoinDesk naOliver Knight, 14 Dec 2023.
- Kurwiswa kweSupply Chain paLedger Connect Kit: Kuongorora Mhedzisiro uye Matanho Ekudzivirira. Yakanyorwa naSlowMist pamusoro pekurwiswa, Zvita 2023.
- Pfungwa dzekuchengetedza dzeWeb3: Madhiraivha eWallet, naJammel Weaver, muRektify AI, Chikunguru 2023.
Tarisa Vhidhiyo Yedu Demo
