Axios NPM Supply Chain Attack

There were two malicious version versions and this is one of probably. I don't know how to quantify this, but this is one of the more popular MPM or JavaScript libraries anywhere. It has more than 100 million weekly downloads, which is massive. Obviously it's a huge part of a lot of JavaScript applications and programs. So anybody that had, you know, their apps set to auto update and download new versions of this library every time there's one available might have gotten hit with this in that two to three hour exposure window.

And once the package was installed, it ends up installing a payload. And it was cross-platform. There was a, a Unix payload, a Mac OS payload and a Windows payload, all of which were rats, remote access Trojans with various capabilities, you know, system reconnaissance, data exfiltration, all that kind of fun stuff. And this very quickly, like spread across, you know, Infosec, Twitter and everywhere else and is turned into a pretty big deal. And I think not, you know, there's two factors. One, it's a very popular library. And two, there was, there's just been this string of supply chain attacks in the last 10 days that I think have everybody on edge. You know, this is just kind of the the cherry on top of a a crap sundae that we've been dealing with for a while. Yeah, it's funny cuz we covered the team PCP kind of slew of supply chain attacks last week.

And they had, you know, if, if our viewers recall, they had kind of targeted a bunch of different, you know, things like trivia and then some of these other ones and had jumped from one to the other. And so seeing this, I think a lot of people were like, is this team PCP? But no, it seems like this is different. And I think I've seen Mandiant, Google Mandiant came out and Elastic and they had attributed it to the DPRK. I'm not sure where that, you know, where the direct attribution kind of clues are coming from there, but it, it has been really something that is keeping people on edge, as you said. And you know, supply chain attacks, you know, not new at all.

But it, it's such a big kind of punch in terms of how it impacts people and the downstream trickle, downstream trickle effects. And even on this one you mentioned this has like 100 million weekly downloads, which is just the scale of that is insane. So even if it was, the exposure window was like 3 hours. Like it's still such a big kind of blast radius there. Yeah, it is. I'm not great at math, but in that three hours that could be, you know, hundreds of thousands or millions of downloads potentially.

And I know your colleague at Huntress, John Hammond did a I'm convinced that John doesn't sleep. I, I assume that like at some point he does, but I've, I have no evidence of it. He, I know he did a live stream at some point last night when this was all happening and then recorded something that that's up now. You can go find it on John's YouTube channel. But he was talking about one of the interesting factors of this is that the maintainer's account that got compromised had MFA enabled on it. So the the question that everyone is asking is like, how did, how did the attacker bypass that? And John said in his his video, and I'm not, I don't have the message in front of me, but the maintainer at some point on GitHub said it looks like the attacker somehow got access to my backup codes and used one of my MFA backup codes to bypass, you know, the on device 2

factor. I I'm struggling to figure out how that might have happened remotely. And unless those things are he had them stored somewhere that was then somehow accessible. I I don't know well. I could have thought of as well. Yeah, yeah. Unless they were stored in an e-mail or something connected to a compromised e-mail account or something along those lines. But you know, it, it sort of goes to show that this was not a simple operation. I mean, there are various ways to bypass MFA. That's not a common one.

Usually it takes some version of the victim doing something like, you know, like push notification bombing where you're just like, OK, fine. Eventually you get tired of it and you and you say yes to the to the push or something like that, or somebody calls you on the phone or some nonsense like that. This kind of MFA bypass is much less common. Right. Yeah. I'll be curious to see kind of what we learn more about that as as this progresses. And then also just the sheer like numbers of impact.

And I know you mentioned before, you know how that might all roll out. But like what kind of, you know, how many organizations are going to come out and have their own kind of issues and data exfiltrated and what kind of data breach notifications we're going to see because of this? And I, you know, I don't think we'll see that information come out for, you know, we'll continue to see that come out and rolling over the next like, you know, days, weeks, whatever. But I'm very curious to see kind of the long term impact of this. I think this is going to be one of the ones that has a long tail because the this library is so popular and the way that it's used, like it's used in a lot of CI and CD pipelines and, and those sorts of things. So it's in a lot of cases probably auto updating. And I think there's going to be a lot of developers and probably organizations that have no idea that they were hit with this and they may not find out for quite a while. It could be hours to days to

weeks before they actually figure this out because not everybody is paying, you know, close attention to security news like this every single moment of their lives like we are. You know, there's people actually building apps that will find out about this a few days from now when, you know, they read a Reddit post or something. And then it, you know, they kind of unwind things and figure out, oh, God, this, this got us or something like that. Yeah. I think it's going to be one of those where we're going to see a whole bunch of, you know, stuff spread out over a long timeline.

Yeah, definitely it is. And you know it is funny like the in terms of the malware and you mentioned this a little bit in the article that you wrote, but it's cross-platform as well. So you know as you as you said, it's Windows, Mac OS, Linux, like it does not discriminate. So that's another kind of aspect of the proliferation I guess of this type of attack, so. Yeah, which is that also shows that this was not something done on a whim. You know, this is, this is a team or an individual that knows what they're doing and has some resources at their disposal. You know, if they can develop a RAT that's cross-platform like that for Mac, Windows and Linux.

I think I said Unix earlier. I don't know where my brain is, but the, that does lend itself to, you know, kind of the professional team aspect of this. And you mentioned that Mandy and I think you said Elastic are sort of pointing the figure at North Korea. I, I saw that too. And I think John might have mentioned it in his, his video as well. And I the one indicator that I saw is somebody mentioned that the, there was some kind of malware artifact that was similar to something that some North Korean actor had used in the past. But I also feel like, you know, North Korea has just become kind of the go to.

Like if you don't have a better idea, like it's like the bad kid in your neighborhood. Like if somebody, you know, knocked your trash can over, you're like, I was, it was that kid. You know, you just kind of like, because like, nobody's ever going to argue with you. Nobody's going to North Korea is not going to come out and say no, that wasn't us. That's not our style, You know, we do that so. Yeah, it says I'm looking up right now. The they it looks like some researchers said the Mac OS binary that was delivered by the specific post install hook that they had tracked has an overlap with like a back door that yeah and linked to that specific DPRK actor. So, but yes, I think you know, given kind of the like details of certain amount of sophistication that we're seeing with the initial access and

other types of things, you know, I guess it does make sense that this would be like, you know, at least a, a group that is somewhat more like categorized or like fully formed than just, you know, people that are doing this kind of offhanded so. Yeah, yeah, for sure. And the, the timeline on this is really interesting. It's in the the blog blog post that that you guys have up on Huntress that John wrote that has like a timeline of both the intrusion itself as well as like the pre attack staging and all of that.

So that the trojanized package was something that didn't even exist before this whole episode. It's sort of a typo squatted version of a legitimate package, but it it just depends a name to the front of it. It's called plain crypto JS, I believe. And you know that this was created like 18 hours before the intrusion. And then, you know, researchers started sort of noticing this thing showing up. And then once the the package was published and put into the Axios versions that, you know, consumed it and then went live, Huntress saw like infections within seconds after that, which is bananas.

Like that shows you like that auto update, you know, hamster wheel that that can really turn into a a whole, you know, pile of trouble in these. Cases, yeah, absolutely. And that's probably what the attackers knew that was going to happen and kind of what they were going for, because it seems like it is like a quick hit and just kind of cast that wide net and try to get those initial infections and as. And that's that's usually the nature of supply chain attacks anyways, instead of them being a little more targeted.

And in fact, that's really kind of what we saw last week with what Team PCP was doing as well, which was just trying to get AS big and broad of a scale of attack and victims as they could and. Then. Kind of crunching in and not going for stealth really, but going for like trying to get, just trying to get in and get out. Yeah, that's kind of the the beauty and the horror of supply chain attacks is they can, they can have these like massive long range effects and these huge blast radiuses, as you said, Linds, and they can go on.

You know, even though this was the malicious packages in this case were taken down after a couple of hours, the damage was already done. And, you know, this attack was obviously planned in advance and they knew what they were doing to a certain extent. And I don't know what their ultimate goal was. You know, they might have had, you know, some specific organization or app in mind or something like that and just decided this was like the the way to go. But supply chain attacks can, you know, have really, really long, you know, tails and tremendously broad downstream effects.

And, you know, they can be a a huge bang for your buck if you're the threat actor on the other side of it. We've seen that like there's still effects from solar winds happening now. You know, you'll, if you, if you're bored on a weekend, go look up SEC filings. You'll still see like people reporting damage from the solar winds attack like in the past fiscal year. And that was what 2021 or two like that, that is still happening, you know, and some of the other supply chain attacks that have happened in the in the last few years.

So, you know, I guess we can log for J fits into that. You know, it's a different type of supply chain attack. But you know, that thing was that was one of those where it was a utility that a lot of people didn't even know that they had in their environments or forgot that they had or had never heard of and some developer was using or things like that. And it turned into a giant can of worms. Yeah, there's, we've seen all these types of attacks in all different forms over the past over, you know, well, we've seen them, I mean, at least since like for, for decades. But Oh yeah, no doubt.

It's definitely seemed like it's been like a wider scale recently. Sorry, it's. OK, it's the beauty of live podcasting. Yeah, right. Delete. But yeah, anyways, we've seen these types of attacks like, you know, happen a lot over the past decade, but it does seem like the ones we've seen over the past like 5-6 years have just been much higher in scale, as you mentioned, like solar winds, like, you know, some of these other ones and so.

Yeah. Yeah. And the other thing too is that when you think about these types of attacks, like historically there was kind of the the intention was just crypto mining with a lot of these types of things. And I think that now it's has now shifted to much more insidious types of animals like, you know, like data exfiltration, like kind of honing in on those passwords and then using them to like launch further attacks and things like that.

And so I think that also it kind of makes it a lot more of a dangerous type of impact that we're going to see. God, the crypto mining error was such a like we were, we were it was so nice like compared to this like yes, I know honestly, such a gentler time in the in the security landscape. We're just going to use some of your resources to try and mine these stupid coins that, you know, for the most part of worthless. But yeah, I kind of do too, honestly. It was yeah.

What a what a time that was that in the NFT era. But yeah, yeah, I'll, yeah. It'll be really interesting to see how this sort of continues to shake out the next few days and weeks. And, you know, whether whether we find out more about who was behind it and the motivations and, or kind of the the what was taken, that will sometimes give you, you know, some insight into the, you know, the ultimate motivations of the hackers. But you know, in some, in some ways the motivations don't really matter.

Like they were, it seems like they were just trying to get access to a whole bunch of systems. And then, you know, maybe we'll see some ransomware fall out from it. Maybe we'll see a bunch of, you know, data breaches like you said. I'm, I'm sure that's the most immediate thing we'll see and maybe some follow on ransomware. But you know, there, there, there will definitely be a whole bunch of like things stacked on each other over the next few months. Yeah, definitely. And then the the other thing too is like that, you know, as you mentioned companies not being aware of this and that it's happened to them.

So I think just getting the word out right now is really important. And then also like helping people understand the specific mitigations that they can take to kind of deal with this and the guidance for defenders as well. So I think that's kind of immediate term what we need to do here. Yeah, no doubt. And you know what's interesting to me, I looked this morning and I looked again this afternoon and I, I don't see it unless it's somewhere that I'm missing. I don't see a word from SISA about this.

Like not, not a thing. And, you know, we've talked about the things that have happened at SISA in the last few months, but I struggle to think that if this was a year ago, we wouldn't have seen a whole lot of communication about this. You know, even if it was just a, a broad, a broad alert that this has got, that this has happened, you know, and to check your logs or that sort of thing. I haven't seen a single single peep about it. Yeah, I remember, I think it was the XE backdoor, the one with the geaton, like what was that like 3 years ago or something. But they had a pretty big part in trying to put port the advisory and, you know, make sure that Debs knew what was going.

On SO. Yeah, it is that. I hadn't even thought about that until you said it, but that is such a interesting point. Yeah, it's, it's a little depressing. And I promise you that this is going to affect some government agencies too. There's no way it doesn't. It would be impossible for. Sure. You know, not just federal, but plenty of state and local and tribal government agencies, I'm sure that do not have their own cybersecurity people or IR staff or anything resembling that to help them.

And you know, this, this is another thing that like just reinforces to me how much the Internet ecosystem is held up by like 12 pieces of open source software and you know, like 4 companies. And if one of those gets kicked out from under the table, the whole thing just starts to tilt. You know, it's like every time one of these happens, somebody posts that that XKCD cartoon of like, you know, the, the little pillar holding up this giant like mousetrap.

And it's like open source software right here. And it's it's funny 'cause it's true and. It's and then yeah, it happens over and over again. Something about yeah, how things are going into threat landscape right now. Right. And I mean, it's super easy in these cases always to point your finger to maintainer or something like that. But again, doesn't seem to me that the these maintainers did anything wrong from what we know at this point. And these people are not being paid for what they're they just wrote some software and you decided to use it.

You know, that's a whole other. Discussion. Whole other discussion, yeah. And not one that we can do in a short podcast, but yeah, it's been it's been quite a couple weeks for the supply chain world. Yeah, definitely. It is weird that you know this is coming right on the heels of the other attacks that you know, everyone's kind of been covering last. Week so I. Don't know but. It's funny because I not funny, ha ha. But I ran into somebody from Socket, one of the, you know, teams that really focuses on this stuff.

And at RSA last week, right when all that that stuff was happening and I said, how's it going? He was, he just shook his head, didn't even say anything. He was just like, in a long week. Yeah, yeah. A tough one. Like Tufts of hair coming. Out. Razzled. Yeah, yeah. And that was like Wednesday afternoon, though it's, it's been almost a week since then. So yeah. Tough times. I know. Wow. Yeah.

I, I have a lot of empathy for those folks. It's not, you know, not super easy. So the resources for folks that are that are trying to learn about this and trying to figure out what to do, mention the the Huntress post that you guys have up, the video that John did. Socket has a great analysis, Elastic has a good analysis, and so does Whiz. I think there's probably others. You mentioned that Mandiant has something or was that just like a tweet or something? Yeah, it was just, it was a statement like an. Official.

From them but but yeah it is and we we'll post all those in the show notes but like I will say it has been like heartwarming I guess in a weird way like to see just everyone come together and like you know, trade, you know intelligence and and try to get the word out so. I agree it is. That's one of the benefit is not the right word, but one of the like side effects of things when these things happen is you do see that community spirit that's still there.

It's hard to see sometimes because we this community loves to, you know, eat its young in some cases, but you do see it when things like this happen and everybody kind of pulls together and is like, well I saw this, we saw that, you know, let's try and pull our resources and see how we can help people, which is very nice. Right. Yeah, for sure. Yeah. All right. Well, thanks Linz. It's great to have you back and I'm sorry you got dumped into the deep end your first few days back coming.

Back with a bang, yeah. Oh, yeah, no rest for the wicked. All right, talk to you soon. See ya. Thanks. Bye.