ESLint compromised, may have stolen your credentials

Re:ESLint compromised, may have stolen your credentials by Vinnl on Thursday July 12, 2018 @10:30AM (#17514956)

Given that it's making calls to histats.com and statcounter.com, I wouldn't be surprised if this is someone trying to make a point. Let's hope so, at least :) I would be interested in a blog post detailing how many credentials they were able to obtain, how many people they managed to infect and how many packages they could potentially compromise.

If npm (and I'm guessing they will) have to invalidate all publish tokens for all users, that is going to be painful.

Edit: I should point out that this is just speculating - there are definitely still ways this could be abused, so don't assume you're safe.

[ Parent | on HN ]

Re:ESLint compromised, may have stolen your credentials by wwwv on Thursday July 12, 2018 @10:46AM (#17515115)

They are linked as HTTP referrer, so they can get the tokens out of the stats page later on.

It's using a popular and well known domain to evade detection.

[ Parent | on HN ]

Re:ESLint compromised, may have stolen your credentials by Vinnl on Thursday July 12, 2018 @10:48AM (#17515143)

That's true, but doesn't it also place their fate in the hands of the owners of StatCounter and HiStats?

(Of course I am just speculating - there's definitely still ways this could be abused. I'll update my comment.)

[ Parent | on HN ]

Re:ESLint compromised, may have stolen your credentials by sdf43543t345 on Thursday July 12, 2018 @11:42AM (#17515681)

Doesn't matter. Google Analytics was used to steal ethereum seeds too (as the 'referer' also I believe). Its common to use analytics as exfiltration services -- the traffic is not as suspicious and usually https.

[ Parent | on HN ]

Re:ESLint compromised, may have stolen your credentials by wwwv on Thursday July 12, 2018 @12:29PM (#17516175)

Critically, it also doesn't leave a trail by running a server anywhere.

[ Parent | on HN ]

Re:ESLint compromised, may have stolen your credentials by meowface on Thursday July 12, 2018 @01:52PM (#17517002)

There's always a trail. What IP and email were used to register the accounts for the stat tracking sites? What IP was used to register the email account? What are all the IPs that ever logged into those accounts? If the email or account registration or login IPs are VPNs, what IP was behind that VPN (if the provider keeps that information)?

A server doesn't necessarily leave any more of a trail if you purchase one with a good VPN, throwaway email, and some kind of cryptocurrency.

OPSEC is a bit easier when abusing a legitimate service, but I think one of the main reasons to use these stat tracking sites is because it blends in with regular traffic very well. If your organization doesn't have SSL interception, it would be very difficult to find the .npmrc exfiltration in logs or PCAPs. This wouldn't be the case if they purchased a server or registered a domain just for this purpose, even if they used SSL, since traffic to the IP/domain alone would likely be sufficient to confirm compromise.

[ Parent | on HN ]

Re:ESLint compromised, may have stolen your credentials by wwwv on Thursday July 12, 2018 @12:26PM (#17516136)

That's why they're using two different stats engines.

[ Parent | on HN ]

Re:ESLint compromised, may have stolen your credentials by supermatt on Thursday July 12, 2018 @10:47AM (#17515123)

more likely a simple anonymous email signup that will receive the payload and present the data in an anonymous and easily accessible way. in this case, it just present the keys as the list of referrers (albeit formatted as urls).

[ Parent | on HN ]