原文始发于The Phylum Research Team：Phylum Discovers Revived Crypto Wallet Address Replacement Attack
UPDATE: This campaign is still unfolding. Currently, the actor appears to have typosquatted several major packages in PyPI. We will continue to update this blog post as new details emerge.
In November of 2022, Phylum discovered and published an article about an attack on PyPI in which threat actors attempted to replace cryptocurrency addresses in developer clipboards with their own wallet addresses by using Python to write a malicious JavaScript extension that loads anytime a browser is opened on the machine.
At around 17:49 UTC on 9 February 2023, Phylum’s automated risk detection platform began alerting us to a long series of suspicious publications which appear to be a revived attempt to deliver the same crypto wallet clipboard replacing malware. This time, however, the attacker changed the obfuscation technique and radically increased the volume of attacks.
Typosquatting Again
As before, the initial vector is typosquatting. Last time they published just over 2 dozen packages but this time we saw twenty times as many – over 451 unique packages. These targeted some very popular packages, many of them in the crypto/finance and web development space:
bitcoinlibccxtcryptocomparecryptofeedfreqtradeseleniumsolanavyperwebsocketsyfinancepandasmatplotlibaiohttpbeautifulsouptensorflowseleniumscrapycoloramascikit-learnpytorchpygamepyinstaller
The attacker increased the number of packages from their last attack by trying to register the same code in every possible simple typo of a package name. For example, in the case of , the user zolotaya.sofiya registered 13 packages, nearly simultaneously.vyper
- Deletion of a single character
- yper
- vper
- vyer
- vype
- Duplication of a single character
- vvyper
- vyyper
- vypper
- vypeer
- vyperr
- Transposition of two characters
- yvper
- vpyer
- vyepr
- vypre
This technique is trivially easy to automate with a script (we leave this as an exercise for the reader), and as the length of the name of the legitimate package increases, so do the possible typosquats. For example, our system detected 38 typosquats of the package published nearly simultaneously by the user named .cryptocomparepinigin.9494
The Obfuscation Technique
The obfuscation technique in these packages is significantly different from the packages we looked at in November. Here’s a screenshot of yfinacne
Initially, this appears formidable. The first thing that we noticed is that the function and variable identifiers appear to be random 16-long combinations from the following table of Chinese Ideographs:
| Unicode code point | Ideograph | Definition |
|---|---|---|
| 0x4eba | 人 | man; people; mankind; someone else |
| 0x5200 | 刀 | knife; old coin; measure |
| 0x53e3 | 口 | mouth; open end; entrance, gate |
| 0x5973 | 女 | woman, girl; feminine |
| 0x5b50 | 子 | child; fruit, seed of |
| 0x5c71 | 山 | mountain, hill, peak |
| 0x65e5 | 日 | sun; day; daytime |
| 0x6708 | 月 | moon; month |
| 0x6728 | 木 | tree; wood, lumber; wooden |
| 0x6c34 | 水 | water, liquid, lotion, juice |
| 0x76ee | 目 | eye; look, see; division, topic |
| 0x99ac | 馬 | horse; surname |
| 0x9a6c | 马 | horse; surname |
| 0x9ce5 | 鳥 | bird |
| 0x9e1f | 鸟 | bird |
Next, on line 5 we see the following:
We can see a series of these kinds of calls . The evaluates to and evaluates to the string . Using Python’s index operator on a string with a will grab the 3rd character from the end of the string, in this case will evaluate to . Continuing with this on the other 2 here gives us and simply evaluating the complex bitwise arithmetic tacked on to the end leaves us with:oct.__str__()[-3 << 0][-3 << 0][-3]oct.__str__()'<built-in function oct>'[]-3'<built-in function oct>'[-3]'c''c' + 'h' + 'r'
The just gives us the builtin function and then it maps to the list of ints and then joins it all together into a string ultimately giving us . This technique is continued throughout the entirety of the code.getattr(__builtins__, 'c' + 'h' + 'r')chrchr[119, 105, 110, 51, 50]'win32'
So while this obfuscation is interesting and builds up extremely complex and highly obfuscated looking code (especially when combined with the use of Chinese characters in the variables names), from a dynamic standpoint this is trivial. Python is an interpreted language, and the code must run. We simply have to evaluate these instances and it reveals exactly what the code is doing.
The Maliciousness
Ultimately, this code is attempting to do exactly what we discovered in November’s blog post and that is quietly replace any crypto wallet address copied to the user’s clipboard with the attacker’s controlled wallet addresses. It does that by creating a browser extension and then writes the following JavaScript to that extension:
It then tries to establish persistence by getting the machine’s browser(s) to load this extension anytime a browser is opened. See the previous post for more details about this.
Conclusions
What can we takeaway from all of this?
- This attacker significantly increased their footprint in through automation. Flooding the ecosystem with packages like this will continue.
pypi - The use of Chinese characters, or any other Unicode plane for that matter, is an easy misdirection to detect and to dismiss.
- Indexing into a Python string by calling the method is clever. The vast array of Python strings available like this can be used to build up nearly any other string of code that can be used for malicious intent. However, the code must run, and all of these kinds of obfuscation techniques are ultimately hopeless.
__str__()
Nevertheless, in light of all these things, the attacker doesn’t have to be right for very long to be successful.
Malicious Package List
aaiohttpaihottpaiohhttpaiohtptaiohttaiohttppaioohttpaiothtpaiottpamtplotlibaohttpapndasatplotlibbautifulsoup4bbitcoinlibbeaautifulsoup4beatuifulsoup4beautiffulsoup4beautiflsoup4beautiflusoup4beautifullsoup4beautifulosup4beautifuloup4beautifulsooup4beautifulsop4beautifulsou4beautifulsoup44beautifulsoupp4beautifulsouup4beautifulssoup4beautifulsuop4beautifusloup4beautifuulsoup4beautiifulsoup4beautiulsoup4beauttifulsoup4beauutifulsoup4beeautifulsoup4beuatifulsoup4beutifulsoup4bicoinlibbictoinlibbiitcoinlibbitccoinlibbitcinlibbitcionlibbitcoiinlibbitcoilibbitcoilnibbitcoinlbbitcoinlbibitcoinlibitcoinlibbbitcoinliibbitcoinnlibbitconilibbitconlibbitcooinlibbitocinlibbitoinlibbittcoinlibbtcoinlibbticoinlibcccxtccoloramaccryptocompareccryptofeedccxccxttccxxtcikit-learncloramacolloramacoloamacoloarmacolooramacoloraacoloramaacolorammacolorramacoolramacooramacrptocomparecrptofeedcrpytocomparecrpytofeedcrryptocomparecrryptofeedcrypocomparecrypofeedcrypotcomparecrypotfeedcrypptocomparecrypptofeedcryptcomparecryptcoomparecryptfeedcryptfoeedcryptoccomparecryptocmoparecryptocmparecryptocomaprecryptocomarecryptocommparecryptocompaarecryptocompaecryptocompaercryptocomparcryptocompareecryptocomparrecryptocompparecryptocompraecryptocomprecryptocoomparecryptocoparecryptocopmarecryptoeedcryptoefedcryptofedcryptofedecryptofeecryptofeeddcryptofeeedcryptoocmparecryptoocomparecryptoofeedcryptoomparecrypttocomparecrypttofeedcrytocomparecrytofeedcrytpocomparecrytpofeedcryyptocomparecryyptofeedcsikit-learncsrapycxctcxtcyptocomparecyptofeedcyrptocomparecyrptofeedebautifulsoup4ebsocketsensorflowerquestsesleniumetnsorflowfeqtradeferqtradeffreqtradefreeqtradefreqqtradefreqradefreqrtadefreqtadefreqtardefreqtraadefreqtradfreqtraddefreqtradeefreqtraefreqtraedfreqtrdaefreqtrdefreqtrradefreqttradefretqradefretradefrqetradefrqtradefrreqtradefyinancehomeworktehomeworkteehomeworkteeehomeworkteeeehomeworktesthomeworktestthomeworktesttthomeworkworkiaohttpibtcoinlibitcoinlibmaatplotlibmaplotlibmatlotlibmatlpotlibmatpllotlibmatplolibmatploltibmatplootlibmatplotlbmatplotlibbmatplotliibmatplottlibmatpltlibmatpltolibmatpoltlibmatpplotlibmattplotlibmmatplotlibmtaplotlibmtplotlibocloramaolanaoloramaoslanapanadspanaspandaaspandsapgamepinstallerpiynstallerpnadaspndasppandasppygameppyinstallerppython-binanceppytorchpthon-binanceptorchptyhon-binanceptyorchpyagmepygaamepygaepygameepygammepyggamepygmaepyhon-binancepyhton-binancepyiinstallerpyinnstallerpyinsallerpyinsstallerpyinstaallerpyinstalelrpyinstallepyinstalleerpyinstallerrpyinstalllerpyinstallrpyinstallrepyinstlalerpyinsttallerpyintallerpyintsallerpyisntallerpynistallerpythhon-binancepythn-binancepythno-binancepytho-binancepython-bbinancepython-biancepython-bianncepython-biinancepython-binaancepython-binacepython-binacnepython-binancpython-binanccepython-binanceepython-binanepython-binanecpython-binanncepython-binnacepython-binnancepython-binncepython-bnancepython-bniancepython-ibnancepython-inancepythonn-binancepythoon-binancepytochpytocrhpytohn-binancepyton-binancepytoorchpytorcchpytorchhpytorhpytorrchpytrchpytthon-binancepyttorchpyygamepyyinstallerpyython-binancepyytorchrcyptocomparercyptofeedreqtraderfeqtraderyptocompareryptofeedscarpysccikit-learnsccrapysciikit-learnsciikt-learnsciit-learnsciki-learnscikiit-learnscikit-earnscikit-elarnscikit-laernscikit-larnscikit-leaarnscikit-leanscikit-leanrscikit-learscikit-learnnscikit-learrnscikit-leearnscikit-leranscikit-lernscikit-llearnscikitt-learnscikkit-learnscikt-learnscikti-learnsckiit-learnscraapyscrapyyscrayscrpayscrrapyseeleniumseelniumseleeniumseleinumseleiumseleniiumseleniuseleniummseleniuumselenniumselenumselleniumselneiumselniumsickit-learnsikit-learnslanasleeniumsloanasoalnasoanasolaasolaansolaanasolanaasolannasollanasolnasolnaasoolanasrcapysscikit-learnsscrapysseleniumssolanateensorflowtennsorflowtenorflowtenosrflowtensofrlowtensoorflowtensorfflowtensorfllowtensorflotensorfloowtensorflowwtensorflwtensorflwotensorlfowtensorlowtensorrflowtensroflowtenssorflowtesnorflowtesorflowtnesorflowtnsorflowvpervpyervvypervyeprvyervypevypeervyperrvyppervyprevyyperwbesocketswebbsocketswebocketsweboscketswebscketswebscoketswebsoccketswebsocetswebsockeetswebsockeswebsockestwebsocketsswebsockettswebsockketswebsockteswebsocktswebsokcetswebsoketswebsoocketswebssocketsweebsocketswesbocketswesocketswwebsocketsyffinanceyfianceyfiannceyfiinanceyfinaanceyfinaceyfinacneyfinancceyfinanceeyfinaneyfinanecyfinannceyfinnaceyfinnanceyfinnceyfnanceyfnianceygameyperypinstallerypthon-binanceython-binanceytorchyvperyyfinance
版权声明：admin 发表于 2023年2月13日 下午5:42。
转载请注明：Phylum Discovers Revived Crypto Wallet Address Replacement Attack | CTF导航
转载请注明：Phylum Discovers Revived Crypto Wallet Address Replacement Attack | CTF导航
相关文章
暂无评论...
