Hacker News Reader

Comment by kevmo314 | Hacker News Reader

> An Istanbul-based bug bounty hunter hypothesized that the npm projects ran by the developer effectively paved the means for the attacker to deploy a reverse shell, by opening up port 5000 on his machine that began "listening" for connections.

Is something blindly connecting to port 5000 and sending a secret payload without verifying what's connected on the other end? That seems like a recipe for chaos.

View on HN

But that's what a reverse shell does - the point here was to covertly place a listening service that could be reached from the internet and execute arbitrary code so that an attacker could control the machine.

Maybe I'm misunderstanding your question though, can you clarify?

The phrasing in the article sort of makes it sound like the npm package opened up port 5000 vs the shell.

I think it's hard to really understand the attack without seeing the code, but listening on a port (at least the chunk of code rendered in the article) is not sufficient to make the machine accessible on the internet unless the wallet machine is publicly addressable, in which case I think running untrusted code is the least of the dev's concerns.

I had guessed that perhaps it's intercepting port 5000 and something else like Metamask was connecting to 5000 assuming something more innocuous was running on it, then forwarding that information? But like I said not sure without seeing the code.

> is not sufficient to make the machine accessible on the internet unless the wallet machine is publicly addressable, in which case I think running untrusted code is the least of the dev's concerns

Whole raison d’etre of IPv6 is to enable that.

Every router I've met still runs a firewall that blocks incoming traffic by default IPv6 or no. My guess on this kind of thing would generally be that the infected computer reacher out to a service controlled by the hacker to establish the shell and the reporter misunderstood, or that the dev connected to a VPN controlled by the attacker, effectively bypassing the firewall, otherwise something is really badly configured on the devs end.

Most shells are connect back, ie the reach out to a known address to deal with NAT, etc

A malicious npm package created by the attacker specifically crafted to open up a port that listens and executes commands and otherwise untrusted or unverified code on the victim’s machine.

Reply on news.ycombinator.com