NPM Package Compromises, Sen. Wyden's Ransomware Letter, and Apple's Memory Safety Advance

But it was it was a phishing e-mail asking folks to update their two FA factors because, you know, they hadn't been updated in X amount of time It. Was pretty like. I felt like it was targeted mostly towards MPM developers, yeah. So definitely and I, this maintainer happened to click on it went through the whole process and his account ended up being compromised in that's how the malicious packages were were published.

And it it happened to a few other maintainers over the course of the week as well. And the fear was when this first happened that these extremely popular packages, this could be a really disastrous incident because the popularity of these packages and how many, you know, other downstream dependencies there might be, this could have this really long tail. And the malware itself was, as you might expect, looking to hijack traffic and steal cryptocurrency credentials and that kind of thing. I mean, I feel like this is 2013, but this is still happening.

Luckily, it didn't really turn out to be a huge thing. It was, it was, you know, embarrassing and it and it was a problem for these maintainers. Sure, they were able to get their accounts back and they were able to, you know, take down the malicious packages with the help of MPM and republish clean versions. But I think I saw, I think it was yesterday, Wednesday, that I saw an estimate that the the attackers had gotten something like 600 total dollars like from this crypto jacking campaign, which, you know, warms my heart that they weren't able to actually get anything.

But it was for a while there, you know, about 24 to 36 hours. Folks were really, really concerned about the potential consequences for this. And I think it's one of those things that just highlights the kind of interconnected and interdependent nature of the ecosystems that we all depend on for, you know, just everyday work. Yeah, the IT was interesting like the threat surface, threat attack surface part of this was incident was like very different from the actual impact and like what happened afterwards.

So like I think those the, the initial fears when reports of this were coming out were completely valid, like given the number of users that you know, and you know, the dependencies kind of downstream users there. But you know, it is like interesting, I think was it like what was the, the reaction after this had happened? I think they took it down like, or they noticed the issue within 4 hours and like quickly kind of cleaned it up afterwards. So no.

And, and the other thing too is looking at what the threat actors decided to do in this situation. I mean, they were pretty like it seemed like it was pretty noisy like it was. You know. This wasn't something where they were trying to hide at all. No, Yeah, yeah, there were. There were a few things that were sort of fortunate. One, the developer noticed it quickly and was able to remediate the problem and start working on getting things fixed relatively quickly.

And so were the other ones, you know, later in the week, those were cleaned up even even more quickly. But also, yeah, the attackers. I saw a bunch of security researchers and friends of ours saying you had access as an attacker to all of these machines and you just tried to steal cryptocurrency. Like, do you understand what a wasted opportunity this was? And I mean, you hate to give advice to bad guys, but like, it was kind of, you know, I was having a text conversation with one of our friends and it just kind of mind blown of like, I can't even process like what a massive blunder this was by these, you know, if it was one person or a group of people, I don't know.

But if you're targeting a developer who has billions of weekly downloads and you happen to get lucky and get that access and you steal $600.00 worth of Ethereum, like, I don't know, seems like a missed opportunity. But I do feel like we, you know, everyone got a little lucky in this case. I think so, yeah. And I was seeing like initial reports were even like $5, like $20.00.

So at least they got 600 from I guess. For their effort, yeah. But I hope that, yeah, I mean, like hopefully that they didn't learn anything with red actors. And this was really, it was an interesting case, though. Just like to see it play out for sure. The phishing aspect of it is what is one of the things that caught my attention as well. You know, we tend to look at some of these attacks and think, OK, well, they must have gotten in with some really clever, you know, scattered spider type thing where they did a bunch of reconnaissance and there was all the this effort involved and, and all this kind of background work. And in a lot of cases, as we know and a lot of the professionals in this industry know, that's not usually how it works.

Usually this is the way it works. There's a very plausible phishing e-mail that shows up. It's got a plausible domain name. The text itself is completely legit. I saw in one of the descriptions of the victimized maintainers they said when they clicked on the phishing link itself it took him to what they described as a pixel perfect representation of what the NPM 2FA enrollment screen actually looks like. So it was, you know, if you're not looking at the domain itself and if you've already gotten that far, there were no red flags. You know, when these are people that do this for a living, you know, they may not be specifically security people, but they are in this world and understand how these things work and understand how phishing attacks work. I would think, you know, I've seen plenty of phishing emails in my life that I would look at and be like, that would have gotten me.

I mean, they're, this is not, you know, 2010 when this stuff was like in broken English and very obviously, you know, malicious domains that were registered 1/2 an hour ago. These are professional groups that know what they're doing in a lot of cases. I don't, I don't know who was behind this. I haven't really seen any attribution on it. But some of these emails now and other, you know, text phishing attempts, the voice phishing attempts, that kind of stuff is extremely polished. And you know, it's only going to get better.

Attacks always get better. I know. Yeah, it is like, it's funny, like a lot of people even within the cybersecurity realm, like I think it was just a few months ago, Troy Hunt came out and said that he had clicked on a phishing message. And, you know, so it's just, you know, it's, it's something that that works. And I think it's not going to go away because, you know, threat actors are continuing to find success with it. So why? Why move on from it if it's something that is continuing to help them in in their attacks?

Yeah, the path of least resistance is usually the one that people are going to take, you know, whether it's in their other lives or in things like this. If you can get in with a phishing e-mail, why would you bother with something more complex and more time consuming? You're just not going to do that. You know, I know there's like a sentiment that some people have in cybersecurity, which I think is a really interesting one, which is like if attacks become more successful, that means that protections and security measures are are working and doing their job. Because it's forcing threat actors to become, you know, to have to step up their game and move away from phishing emails, which I always thought that was an interesting perspective that some people have talked about.

I think that's true. There's a lot of, there's a lot to be said for that. You know, hopefully we've gotten better over the last 25 years, but they're still, you know, if you make a basic mistake like clicking on a phishing e-mail, it can have a really horrendous cascading effect. You know, forget about, you know, a developer who run or maintains a bunch of really popular packages.

If you if your main e-mail account as a consumer gets compromised and you have everything tied to that account, you know, one simple mistake can really, really throw a wrench in your entire life, you know? And if there's not a lot of, yeah, there might be security defenses along the way that that made life more difficult for the attacker. But if you make that mistake, they can still win.

You know, it. It doesn't have to be dramatic. Yeah, I actually think that's a really interesting and good segue into this other story I wanted to talk about because it's the one of the things I wrote about this week was basically Ron Wyden, who's a senator who is, you know, gets up in arms about a lot of cybersecurity related. Things. God bless him. Yes, but he essentially wrote a letter to the FTC urging them to investigate Microsoft's role in the Ascension ransomware attack.

And the reason why that, you know, our conversation makes me think of this is that, you know, that there were like a couple of different steps in that ransomware attack that happened. And what Wyden is arguing, and I'll get into the background in a second, but like is that the technology and the products that were used in the default settings should be held to blame just as much as like kind of the other steps and processes that led to the attack. So essentially, if you remember the last year this ransomware attack was on Ascension, which is this, it's this, you know, healthcare provider.

And I think it led to, I think it was like 5, yeah, 5.6 million patients data being compromised. And they were all kind of the ugly fallouts that you see from ransomware attacks, especially in healthcare critical infrastructure type of organization. But yeah, so essentially, Wyden was urging the FTC to look at Microsoft's role in particular because his argument was was that the Ascension hack started when a contractor clicked on a malicious link through a Web search from Microsoft's Bing search engine.

And then after the contractor's laptop was infected with malware because of some of the default settings that Microsoft has, threat actors were able to easily, you know, more easily get access to privileged accounts on the AD server and kind of move from there. So his like, you know, we're talking about kind of clicking on that initial access point of like clicking on phishing links or like maybe clicking on infected link that you might come across online.

And then what, what I think is interesting here is Wyden is like moving the needle and looking at, you know, the actual like default settings that were part of this the system that was involved in this attack. It's it's really interesting. And I know we, you know, there's been a lot of discussion about kind of moving that needle over the past year or so, maybe 2 years with like, you know, every, the conversations about Secure by Design. And you know, you could think about that as you, you know, want to think about it.

But like, I think there is like a little bit of a, a narrative right now around trying to make sure that like it's not just the end user who's responsible. It's not only just the the impacted company as well, but also the products that they're using. This is something that is pretty fascinating to me because it's been going on in one form or another for quite a long time. You know, it's kind of what was behind the original Trustworthy Computing initiative at Microsoft in a lot of ways. They were getting a lot of pushback from customers and specifically government customers about the security issues with Windows and at that time Internet Explorer and the default settings and how difficult it was for users to use this software safely, safely. And it's all coming back around in in a different form, it sounds like.

But in almost every case, what happens is the software provider just points to the end user license agreement that you clicked on when you installed their software and says you agree to this. This is the product that you bought or downloaded or whatever. And if you don't know how to use it safely, that's not our fault. And that's almost always how it winds up, you know, getting resolved or pushed to the side, 'cause this stuff is sold or provided as is, you know, this is, this is what you get.

Don't, don't hurt yourself with our software. And that's that's been an argument for as long as there's been software, unfortunately. But, you know, Wyden is nobody's fool and he understands all of that. So it's interesting to me that he's still deciding to take this tack. And, you know, we should say he's a senator from Oregon and Microsoft is right up the road from him in Washington. It's not very far away. And he has been on Capitol Hill for a very long time and understands how technology works and also understands how Washington works and how, you know, these kind of situations work. So he's not doing this just for fun and games and to like rattle somebody's cage.

You know, he does his stuff because he believes in it. I think, you know, you, there's some politicians you could just dismiss out of hand and be like, well, that's a publicity stunt or that guy's running for re election or you can see where this is coming from. But I he I think has good intentions, but I I'm not sure how far these this kind of thing will go. I know. Yeah, it, it is funny. I was looking at like some of the other, like, you know, 'cause Microsoft in particular has come under the spotlight over the past few years, especially with some of the the thing like the Cyber Safety Review Board, which, you know, I, I miss.

But you remember that big report they did and about the Exchange Online intrusion, those types of things. So I think, you know, this is, this is kind of just the, the latest, you know, call out that we're seeing. But to your point, like, yeah, Wyden is on a tear and I love it. Like he has also done, I think it was like 2 weeks ago, he, he wrote something about a, the hack of the federal court's case management system, which was earlier this summer. And basically, you know, trying to ask for an independent review of kind of the, the attacks and how the US judiciary system carries out security measures and it's different practices. So like, I think he, you know, it's, it's heartwarming to see someone in the government who understands technology and cybersecurity specifically to

this level and depth. And you know, who is kind of using that understanding to try to, you know, call out people. And, you know, I, I don't know, like where, where a lot of these letters go. Like if I know sometimes he's asked for responses and sometimes he's actually gotten responses. So that's interesting from, you know, public disclosure perspective to see that. But, you know, I'm happy if there's someone out there in the government, you know, needling on these more, you know, in depth things. Yeah, I feel the same way.

And the question of where these letters go and if anybody ever pays attention to them or if they just move on to something else, you know, two days later is a good one. And I think in a lot of cases, unless there's some, you know, regulatory authority or something along those lines that the letter writer has, you know, aside from just being like, I'm a senator and I wish you would do better at this. A lot, in a lot of cases, they're like, thank you for your interest. We're going to go about our business, you know, and that's kind of where it ends, unfortunately, Yeah. Just like polite dismissal.

Yeah, Or even just complete, you know, complete indifference and ignoring it. But, you know, in some cases they do respond and say, you know, here are the things we're working on and here's what we can do. But it all kind of comes down to the fact that if you're using computers and software, you're, you know, you're doing so at your own risk. You know, it's like getting on a on a Ferris wheel. You, you know what you're in for. You could get stuck at the top. Yeah. I know that's a great analogy, yeah. And that kind of brings you into the, the last thing I wanted to talk about was Apple this week as part of I guess their, their fall roll out for their new iPhones released what is a pretty rare document for them.

They, they have this blog that our friend Ryan is always joking about. Like they update it once a year, every 18 months, or which that might even be more often than they do. But they put out this very long blog post about a new memory safety technology that's included in the the new iPhones, the new version of iOS that's going to be coming out. And I read it and I would like to say that I understood it. I can't say that I understood the basic principle behind it. I understand what Apple is trying to do. They're essentially introduced a new way to kind of break memory corruption exploit chains, which is the main way that specifically mercenary spyware vendors are able to get access to iOS devices.

It's one of the ways that, you know, these intrusion vendors have to get into what are essentially the most secure computing devices that you can buy. If you update your iPhone and you know, to a great extent your Android device on a regular basis, Those things are about as secure as you can hope for at this point. But there are well funded spyware vendors out there who sell their stuff to, you know, law enforcement, whoever else that are spending millions and millions of dollars to develop exploit chains that work against these devices.

And Apple is trying to break that entire class of exploits with this new technology. I would encourage people who are interested to go and read Apple's blog post, which we'll link to. It's really interesting from a technical point of view, but also from like a bigger picture point of view, that Apple is expanding a lot of engineering resources to develop something that has no real outward marketability or is likely not going to sell them any more phones. You know, like people in our community are very excited about it.

I saw a lot of our friends who are engineers being really impressed with this work. And Google has something similar on Android. But, you know, Apple is a marketing company that happens to sell hardware and they're really good at marketing. This is not going to help them sell anything. It's just something that they're doing behind the scenes that will hopefully make these devices a lot more, a lot safer for typical people that shouldn't have to worry about, you know, memory safety exploits to use, you know, and it's, I think it's encouraging.

Yeah, I love the strategy of just like completely overhauling and going out and saying we're just going to try to disrupt the entire class of this instead of, you know, 1 by 1 going and patching every single thing that comes up or like trying to deal with every issue or every spy spyware instance. So I, you know, I, I know we've seen a couple of instances of companies doing that over the years, but like, it's, it's really cool to see and get that behind the scenes.

Look at it, especially with Apple. Yeah. They, they're, as everybody knows, not very public about any of this stuff, especially their security stuff. They're very tiny people we know very well who have worked on Apple security. Men are no longer there, still won't talk about it. They're, you know, they're like retired CIA officers. They're just, they don't talk about that stuff and for good reason. But I do like the approach that Apple is taking here where it's like we can't stop these spyware vendors from doing what they do because they're going to make money from it. It's a business.

But maybe we can make life much more difficult for them by disrupting this one exploit chain that we know that they rely on. And it does remind me in some ways of the way that, you know, our government and other federal governments around the world are trying to approach the ransomware problem from the financial end of it. You know, you're not going to stop criminals from doing crime.

Like that's what they do. There's money involved. There's money in it for them. And in the case of ransomware, there's a ton of money in it. And what they try to do is break the financial ecosystem behind it and prevent them from actually getting the money that they're supposedly being paid, or if they actually are paid it, try and retrieve it after the fact. They're doing it in various ways and they're having some success, but they're, you know, obviously a lot of work to do. But when there's a difficult problem like that, sometimes you have to come at it from a a different point of view to try and solve it.

Yeah, I agree, especially, yeah, for the ransomware, all the different tactics that law enforcement has been trying, whether it is like arrests, like just the, and you know, indictments, charges, sanctions, like putting up rewards for, for people that are affiliated or associated with ransomware. They're just trying, they're just trying to see kind of what sticks and what works, it seems like. But there's so many different ways to kind of go about it. And yeah, it's. Interesting.

I mean, with ransomware specifically, when there's, there's so much money involved there that like deterrence is not going to work, especially if you're a threat actor who happens to live in a country that, you know, the US doesn't necessarily have good diplomatic relations with. You probably feel pretty safe. You know, as long as you're not attacking your own citizens and you're attacking folks in, you know, say the US or other Western countries.

We haven't, we've seen some successes against those folks, but not, not a ton. You know, I'd like to be optimistic and think there's more coming, but you, you just don't know. There's so much money involved that it, even if we, you know, take down 1 ransomware crew, there's fifty lining up behind them to, to step into their shoes, you know, give me the yacht, give me the Lamborghini, give me the private jet, you know? All the Lamborghinis, yeah. So many Lamborghinis, Yeah.

That's Yeah, I, I was actually thinking about that when I I wrote up about the Justice Department this week indicting A Ukrainian national who was tied to several different ransomware attacks like Locker Goga and Mega Cortex and all these ones where I was like, this is a throwback to like 2019 or whenever those came out. But the IT was just interesting when I was writing it up because I was like, OK, the indictment is out. We've seen so many of these indictments and charges and you know, a lot of these people, to your point, are residing in safe harbor countries.

So they're, you know, so like it's just, it's just interesting to see kind of obviously this puts pressure on, you know, this the, the alleged individual. But, and I know too that they did put up like, I think it was like a like, was it $5,000,000 or like a very large amount of money to try to get information related to, to this guy. But it's just kind of like what's next? Like is this, you know, at at face value, like it's, it's, I'm curious like what happens behind the scenes to actually, once an indictment has been made, like to go like put pressure on those types of things.

And what was interesting too is the Justice Department had this like in its release, it had a little tidbit which it said that it had secured the conviction of over 180 cyber criminals since 2020, which I thought was interesting. I hadn't seen a stat like that before. And it was, I don't know like where that falls kind of in terms of if it's. High or is that good? Is that I don't know. But I was like, huh?

And also, I mean, you could have like you could have like the cyber criminals encompasses a lot too as well. I mean, you could have someone who's a scammer, you could have someone who's a ransomware attack, like someone doing ransomware attacks on hospitals. So, but I thought that when when they posted that stat, I was like, huh, that's I hadn't seen anything like that. So. No, I've never seen that before. But you're right, it could be like 50 romance scammers and like 3, you know, ransomware operators or something. I have no idea.

We're just like a money launderer, like, right? Just like a meeting man, Like not even. Yeah. Somebody doing like the iTunes gift cards from Stop and Shop, like, OK, we got them. Yeah. But who knows? Yeah. All right. Well, thanks, Linds, as always. Great to see you. And we'll be back next week when more things will be happening. Thanks everybody. Thanks. See ya.