Hacker News Reader

Comment by jkaptur | Hacker News Reader

So the attack goes: 1) compromise some site to serve arbitrary JS 2) have it serve simple JS that requests other JS that contains the real malicious payload.

And the reason for this two-step architecture is to make it convenient to change the real payload.

And the problem is where to host the real payload. The first idea was Cloudflare, but Cloudflare keeps taking that sort of thing down. So now they host it "on the blockchain" which means it "can’t be blocked".

What I don't understand is who is actually serving the HTTP call that effectively proxies the data from the blockchain. It seems like they (like Cloudflare, or a regular hosting service) are opening themselves up to all sorts of risks by serving arbitrary content.

View on HN

According to the following blog post, it uses a web API exposed by the Binance Smart Chain (BSC) platform: https://labs.guard.io/etherhiding-hiding-web2-malicious-code...

This diagram show the full flow of the attack: https://miro.medium.com/v2/resize:fit:1400/format:webp/1*by4...

Because reads from blockchain are "free" (meaning, there is no cryptocurrency payment required to read data from the smart contracts on BSC), this is effectively free storage/hosting for the attacker.

The malicious code is served by BSC web API. According to the Krebs article, BSC "is aware of the malware abusing its blockchain, and is actively addressing the issue." I am not clear if they are taking this situation Very Seriously(TM), but I assume they are.

lol

> In response to questions from KrebsOnSecurity, the BNB Smart Chain (BSC) said its team is aware of the malware abusing its blockchain, and is actively addressing the issue. The company said all addresses associated with the spread of the malware have been blacklisted, and that its technicians had developed a model to detect future smart contracts that use similar methods to host malicious scripts.

Earlier in the article it said

> Due to the publicly accessible and unchangeable nature of the blockchain, code can be hosted ‘on-chain’ without the ability for a takedown... “So you get a free, untracked, and robust way to get your data (the malicious payload) without leaving traces,” Tal said.

Make up your mind...

It's not robust since you have to use an API (i.e. Binance API) to access the blockchain from a compromised website, then Binance can effectively "take it down" by blocking access via the API.

Now if they made the compromised website talk directly to the node on the blockchain network that would be different. Except, why not just host the malware on the website in the first place...

Anybody can spin up a mirror node, even on the mostly centralized BSC. This is just a misunderstanding.

Every public blockchain works this way afaik. I've even made a site for hosting webpages on Optimism: https://newgeocities.com

The real discussion imo is that blockchain node operators should be pressured to respond to concerns about unwanted content. There's no reason they can't coordinate on filters in the same way Ethereum validators use Flashbots to ignore Tornado Cash transactions. Although I hope they can find a better solution than blocking entire contracts because it's really nice to write a simple contract for data storage. Remember: a contract is a protocol, not a program. The validators follow the instructions but it's more like a database schema to which people submit conforming messages. As the contract creator, you're just publishing your code on chain. Each user takes responsibility for their own data.

seems like "blockchain" has nothing to do with it... they could just host the file on a server they do control. "Blockchains" aren't magic.

Blockchains - that is, the communities that use them - are at least theoretically committed to immutable permanent records of everything that happened. By design, if you tried to "retroactively" edit the contents of the blockchain, you would break the whole thing. So if the blockchain hosters stick to their avowed principles and system design, they can't remove your exploit code without taking down their whole system.

Of course in reality most blockchain folk are grifters who will happily compromise their principles as soon as you credibly threaten their pocketbook - see the Ethereum DAO for the clearest example. Still, it's funny to force them to admit it.

In fact the blockchain cannot be broken because it is a chain. Compare it to git commits. If you would hack away one commit in the middle, the whole system would change. The other commits are comparable to any other transaction (ledger) that happened anywhere. As far as i understood, 'in blockchain' =='carved in stone' .

If people actually follow the rules they claim they do then yes. In practice once you ask them to put their money where their mouth is people make an exception. Again see the Ethereum DAO incident.

It's not magic but it is a radically different pricing model: pay once, host forever.

I see it as a massive bet on storage prices continuing to decrease.

I think nocoiners completely miss this aspect, the media too

many devs will always post their applications on blockchains, and simply do system design conducive to that environment, because web 2.0 cloud models do not compete in pricing especially if you have a burst of activity

many devs bring their whole audience over, and the audience is willing to pay to update the state of the application with no overhead cost to the dev, which is also impossible to implement in web 2.0 cloud offerings, aside from just searching and hoping for free tiers

who cares if none of those applications match your use case, just call it the entertainment sector then and you still have value and utility to someone, that self perpetuates

If it becomes a problem consensus can evolve to trim inactive data (say expiring unspent outputs after N blocks in UTXO chains, "move it or lose it" model) or explicit charging for storage per unit of size and time (decay some associated balance accordingly).

or pay never and host it on the infected website

Running a BNB Smart Chain full node requires 16 TB fast NVMe disk. "Anybody" cannot do it.

Again, that's for a validator node. If you're running a mirror that's not taking part in making new blocks, you don't need the speed, just enough space. It may not be always synced to the latest block but it should work.

I believe there's other requirements for BSC validators too, like staking a bunch of BNB.

the code is still on BSC blockchain and any node will still return the information in those addresses

even binance operated nodes

the only thing Binance did was do the exact same thing that Cloudflare did, both on their HTTP routes. Binance just had one for convenience and to attract use of their blockchain, which … worked?

its actually lazy and amateurish that the hackers are using HTTP to access this code on the blockchain, they dont have to

Sounds like we should poison this vector (and IPFS) by uploading copyrighted movie torrents to this free storage system. For a change we’d be doing good.

Comically I was experimenting on this in 2013 or so and came to the conclusion it wasn't worth it except as a joke, something I'm sure lots of other people did too.

But combined with the insane browser expectation of being able run unsigned JS and such from anywhere, you could probably host an entire simple text forum on whatever public chain as long as no one cares about it being fast.

Direct API is nice but any block chain explorer service would work in a pinch.

Shoot don't even need a movie, just a picture of Mickey Mouse

At least there would be no way to take down the torrents…

or CSAM

already in bitcoin

Your plan is to DOS a system because someone abused it?

I think it was more for the lulz.

Free storage and hosting? Does this mean anyone can store random stuff in smart contracts and read from it for free?

You have to pay for the initial insert but it's then hosted forever for free. For reads, you can either download the data from nodes in the network which works somewhat like a torrent, or find a service that has a full copy of the blockchain and is providing it via a HTTP interface.

No absolute guarantee of forever.

I guess there are some ways the ethereum network can cease to exist, when that happens there are probably bigger things to worry about

Ethereum network doesn’t serve on 80 or 443

it costs money to store/write a transaction to the chain (transaction fee) - binance smart chain is subsidised so runs at a loss/pretty cheap to store small amounts of data on (if you did this on ethereum would be very expensive) - retrieval is free in that you can use a public RPC to retrieve the data

For the Blockchain reads, someone still needs to host a JSON-RPC server. Most of hosting is commercial SaaS (Infura, QuickNode, LlamaNodes) but Binance provides a free endpoint for better adoption of their chain.

This free endpoint has many abuse protection mechanisms, as free services need (see: Cloudflare). However until today no one was hosting any malicious web payloads.

It's just matter to add a new abuse rule by BNB Smart Chain team to take this down.

Why is this considered abuse? Blockchains are for storing data, and these people are storing data on it.

unless there's been an edit the parent didn't write abuse they wrote malware, which sort of anyway answers your question because we are supposed to consider the aiding and abetting of the malicious purposes of malware to be abusive.

Reminds me of malware reading a Twitter account that would act as the C&C server.

I looked at an early flavor of this and spent a while reversing the malware. This was the same malware that hit McClatchy and MediaNews a few years ago (2020, but I remember being concerned about the malware's practice of replacing the DOM with the lure and how that could have been further abused to inject fake content). It ran on many regional media sites like Denver Post, etc. This one did a lot of cleverness like fingerprinting a host via JS to ensure it was legitimate, geolocating an IP, only serving the bait once to an IP, and making sure the referrer header was set-- among other things. They also had a nice pool of domains, but they were discoverable by looking for artifacts specific to the lure. It was an interesting campaign to dig into and watch evolve.

If I recall too, the intermediate domains appeared to all be subdomains from (possibly) compromised godaddy accounts.

> It seems like they (like Cloudflare, or a regular hosting service) are opening themselves up to all sorts of risks by serving arbitrary content.

That's pretty much any website that accepts user input or integrates with an external service. I could post a base64-encoded malware to HN too, it would just get caught a lot faster (wasn't this a real thing on reddit?). I think the trick here is that it doesn't look out of place on a blockchain explorer/gateway because most of that data is opaque binary content to begin with.

Yes, but the HN can easily remove offending content. How do you remove something from blockchain?

The gateway can remove it or otherwise change it since it's a middleman.

IPFS along with ipfs http gateways is also abused like this a lot. It's hopeless to try to take things like this down, but in general taking down domains is hard.

How are you going to stop people from serving arbitrary content though? What appears to one parser as "Alice sent Bob 0.00000006767 BTC" may appear to another parser as malicious code.

So long as there is uncensorable data anywhere, this will always remain possible.

> 1) compromise some site to serve arbitrary JS 2) have it serve simple JS that requests other JS that contains the real malicious payload.

So… https://joshcsimmons.com?

This group isnt doing it, but you can load ethers.js or web3.js client side, and it can also do RPC calls to the nearest node and get the same data

I think one more important reason for hosting payload on the blockchain is to avoid automatic detection by scanning and auditing tools.

Reply on news.ycombinator.com