{"id":512268,"date":"2023-10-24T07:57:25","date_gmt":"2023-10-24T05:57:25","guid":{"rendered":"https:\/\/mybroadband.co.za\/news\/?p=512268"},"modified":"2023-10-24T08:01:22","modified_gmt":"2023-10-24T06:01:22","slug":"cyberattackers-put-malware-on-blockchain-to-stop-removal","status":"publish","type":"post","link":"https:\/\/mybroadband.co.za\/news\/security\/512268-cyberattackers-put-malware-on-blockchain-to-stop-removal.html","title":{"rendered":"Cyberattackers put malware on blockchain to stop removal"},"content":{"rendered":"

Research at security firm Guardio Labs has discovered that cyberattackers are trying to use blockchain technology to host malicious code, Krebs On Security reports<\/strong><\/a>.<\/p>\n

The finding comes after the discovery of the ClearFake scam in August.<\/p>\n

The ClearFake campaign uses compromised WordPress websites to try and catch people out with one of the oldest malware delivery techniques \u2014 the fake browser update.<\/p>\n

Those who fall for the trick will download a trojan that steals their information.<\/p>\n

Guardio researchers found that attackers behind an updated version of ClearFake began storing their malicious files as crypto transactions in the Binance Smart Chain (rebranded as BNB Chain in 2022) after Cloudflare tried to block the websites.<\/p>\n

BNB Chain is Binance’s Ethereum-compatible blockchain rival and is designed to run decentralised apps and smart contracts.<\/p>\n

Guardio said the attackers had built a simple contract app that uses the storage function of the contract.<\/p>\n

“The method ‘update ()’ saves the input to this storage \u2014 byte by byte, and the method ‘get()’ reads the storage and returns its value as a string,” the researchers explained.<\/p>\n

Data can be written or updated on the chain by interacting with the contract.<\/p>\n

“Due to the publicly accessible and unchangeable nature of the blockchain, code can be hosted ‘on-chain’ without the ability for a takedown,” Guardio’s research team said.<\/p>\n

The attackers uploaded just enough Binance Coin to the address they controlled to create and update the contract.<\/p>\n

Removal and tracing a major challenge<\/h2>\n

By hosting the code on a blockchain, it would not be possible for a domain manager to remove the contents.<\/p>\n

It would also be very difficult to trace the source of the attack.<\/p>\n

In addition, Guardio said it would be challenging for Binance to shut down the operation.<\/p>\n

“The only thing they can do and currently offer \u2014 is the ability of the community and developers to be warned about a contract if identified as malicious or part of an illegal activity,” Guardio said.<\/p>\n

This can be done by searching the address used to deliver the malicious code in the BscScan service.<\/p>\n

However, this is insufficient, as visitors to hacked WordPress websites would have no idea what code was under its hood.<\/p>\n

“This contract, tagged as Fake Malicious or whatnot, is still online and delivers the malicious payload \u2014 apparently, as of today, there is no way to stop it,” said Guardio.<\/p>\n

BNB Chain subsequently told KrebsOnSecurity that it was aware of the problem and was actively addressing it.<\/p>\n

All addresses associated with the spread of the malware were blacklisted, and BNB Chain technicians developed a model to detect other smart contracts using similar techniques to host malicious scripts.<\/p>\n

“This model is designed to proactively identify and mitigate potential threats before they can cause harm,” BSC told the publication.<\/p>\n

It also said it was working on linking the identified addresses to centralised KYC [Know Your Customer] information, which could potentially reveal the people behind the attacks.<\/p>\n

\n

Now read: SARS official allegedly hacks e-filing for tax fraud syndicate<\/a><\/h3>\n","protected":false},"excerpt":{"rendered":"

Researchers at security firm Guardio Labs discovered that cyberattackers are trying to use blockchain technology to host malicious code.<\/p>\n","protected":false},"author":341042,"featured_media":512330,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_sma_x_autopost_status":"idle","_sma_x_autopost_error":"","_sma_x_post_id":"","_sma_facebook_post_id":"","_sma_instagram_post_id":"","_sma_threads_post_id":"","_sma_x_attempts":0,"footnotes":""},"categories":[44696,27],"tags":[49375,90228,38499,80633,84907,801,9647],"class_list":["post-512268","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cryptocurrency","category-security","tag-binance","tag-binance-smart-chain-bcs","tag-blockchain","tag-bnb-chain","tag-guardio-labs","tag-malware","tag-wordpress"],"_links":{"self":[{"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/posts\/512268"}],"collection":[{"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/users\/341042"}],"replies":[{"embeddable":true,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/comments?post=512268"}],"version-history":[{"count":1,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/posts\/512268\/revisions"}],"predecessor-version":[{"id":512390,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/posts\/512268\/revisions\/512390"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/media\/512330"}],"wp:attachment":[{"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/media?parent=512268"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/categories?post=512268"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/tags?post=512268"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}