Welcome to the Decipher podcast. This is a quick podcast that
we're doing on Tuesday morning or Tuesday afternoon.
I guess it's been a long day for both of us.
I think Lindsay and we're going to be talking about this Axios
MPM supply chain compromise that I guess happened Sunday night
into Monday morning, but came to light today.
And it's a really, it's a very simple story, but also like it
complex at the same time, if that makes any sense.
Like a lot of supply chain stories are.
And we've seen a lot of supply chain compromises in the last
like 10 days. It's something like that.
And this one does not seem to be at the moment connected to the
chain of them that we've seen from is it team PCP, Am I
getting accurate? OK, going off memory here.
Yeah, it doesn't seem to be connected to those right now.
This seems to be a standalone incident, but this is I I woke
up this morning and unfortunately looked at Twitter
like an idiot and saw all of this like detonating and it's
the. The facts of the thing are very
simple. Sometime in there was about a
somewhere between A2 and a three hour window where an attacker
was able to gain access to the GitHub and MPM accounts of one
of the maintainers of this axios package and inserted A
trojanized package that became a dependency and for two different
versions. We'll we'll get to that.
There were two malicious version versions and this is one of
probably. I don't know how to quantify
this, but this is one of the more popular MPM or JavaScript
libraries anywhere. It has more than 100 million
weekly downloads, which is massive.
Obviously it's a huge part of a lot of JavaScript applications
and programs. So anybody that had, you know,
their apps set to auto update and download new versions of
this library every time there's one available might have gotten
hit with this in that two to three hour exposure window.
And once the package was installed, it ends up installing
a payload. And it was cross-platform.
There was a, a Unix payload, a Mac OS payload and a Windows
payload, all of which were rats, remote access Trojans with
various capabilities, you know, system reconnaissance, data
exfiltration, all that kind of fun stuff.
And this very quickly, like spread across, you know,
Infosec, Twitter and everywhere else and is turned into a pretty
big deal. And I think not, you know,
there's two factors. One, it's a very popular
library. And two, there was, there's just
been this string of supply chain attacks in the last 10 days that
I think have everybody on edge. You know, this is just kind of
the the cherry on top of a a crap sundae that we've been
dealing with for a while. Yeah, it's funny cuz we covered
the team PCP kind of slew of supply chain attacks last week.
And they had, you know, if, if our viewers recall, they had
kind of targeted a bunch of different, you know, things like
trivia and then some of these other ones and had jumped from
one to the other. And so seeing this, I think a
lot of people were like, is this team PCP?
But no, it seems like this is different.
And I think I've seen Mandiant, Google Mandiant came out and
Elastic and they had attributed it to the DPRK.
I'm not sure where that, you know, where the direct
attribution kind of clues are coming from there, but it, it
has been really something that is keeping people on edge, as
you said. And you know, supply chain
attacks, you know, not new at all.
But it, it's such a big kind of punch in terms of how it impacts
people and the downstream trickle, downstream trickle
effects. And even on this one you
mentioned this has like 100 million weekly downloads, which
is just the scale of that is insane.
So even if it was, the exposure window was like 3 hours.
Like it's still such a big kind of blast radius there.
Yeah, it is. I'm not great at math, but in
that three hours that could be, you know, hundreds of thousands
or millions of downloads potentially.
And I know your colleague at Huntress, John Hammond did a I'm
convinced that John doesn't sleep.
I, I assume that like at some point he does, but I've, I have
no evidence of it. He, I know he did a live stream
at some point last night when this was all happening and then
recorded something that that's up now.
You can go find it on John's YouTube channel.
But he was talking about one of the interesting factors of this
is that the maintainer's account that got compromised had MFA
enabled on it. So the the question that
everyone is asking is like, how did, how did the attacker bypass
that? And John said in his his video,
and I'm not, I don't have the message in front of me, but the
maintainer at some point on GitHub said it looks like the
attacker somehow got access to my backup codes and used one of
my MFA backup codes to bypass, you know, the on device 2
factor. I I'm struggling to figure out
how that might have happened remotely.
And unless those things are he had them stored somewhere that
was then somehow accessible. I I don't know well.
I could have thought of as well. Yeah, yeah.
Unless they were stored in an e-mail or something connected to
a compromised e-mail account or something along those lines.
But you know, it, it sort of goes to show that this was not a
simple operation. I mean, there are various ways
to bypass MFA. That's not a common one.
Usually it takes some version of the victim doing something like,
you know, like push notification bombing where you're just like,
OK, fine. Eventually you get tired of it
and you and you say yes to the to the push or something like
that, or somebody calls you on the phone or some nonsense like
that. This kind of MFA bypass is much
less common. Right.
Yeah. I'll be curious to see kind of
what we learn more about that as as this progresses.
And then also just the sheer like numbers of impact.
And I know you mentioned before, you know how that might all roll
out. But like what kind of, you know,
how many organizations are going to come out and have their own
kind of issues and data exfiltrated and what kind of
data breach notifications we're going to see because of this?
And I, you know, I don't think we'll see that information come
out for, you know, we'll continue to see that come out
and rolling over the next like, you know, days, weeks, whatever.
But I'm very curious to see kind of the long term impact of this.
I think this is going to be one of the ones that has a long tail
because the this library is so popular and the way that it's
used, like it's used in a lot of CI and CD pipelines and, and
those sorts of things. So it's in a lot of cases
probably auto updating. And I think there's going to be
a lot of developers and probably organizations that have no idea
that they were hit with this and they may not find out for quite
a while. It could be hours to days to
weeks before they actually figure this out because not
everybody is paying, you know, close attention to security news
like this every single moment of their lives like we are.
You know, there's people actually building apps that will
find out about this a few days from now when, you know, they
read a Reddit post or something. And then it, you know, they kind
of unwind things and figure out, oh, God, this, this got us or
something like that. Yeah.
I think it's going to be one of those where we're going to see a
whole bunch of, you know, stuff spread out over a long timeline.
Yeah, definitely it is. And you know it is funny like
the in terms of the malware and you mentioned this a little bit
in the article that you wrote, but it's cross-platform as well.
So you know as you as you said, it's Windows, Mac OS, Linux,
like it does not discriminate. So that's another kind of aspect
of the proliferation I guess of this type of attack, so.
Yeah, which is that also shows that this was not something done
on a whim. You know, this is, this is a
team or an individual that knows what they're doing and has some
resources at their disposal. You know, if they can develop a
RAT that's cross-platform like that for Mac, Windows and Linux.
I think I said Unix earlier. I don't know where my brain is,
but the, that does lend itself to, you know, kind of the
professional team aspect of this.
And you mentioned that Mandy and I think you said Elastic are
sort of pointing the figure at North Korea.
I, I saw that too. And I think John might have
mentioned it in his, his video as well.
And I the one indicator that I saw is somebody mentioned that
the, there was some kind of malware artifact that was
similar to something that some North Korean actor had used in
the past. But I also feel like, you know,
North Korea has just become kind of the go to.
Like if you don't have a better idea, like it's like the bad kid
in your neighborhood. Like if somebody, you know,
knocked your trash can over, you're like, I was, it was that
kid. You know, you just kind of like,
because like, nobody's ever going to argue with you.
Nobody's going to North Korea is not going to come out and say
no, that wasn't us. That's not our style, You know,
we do that so. Yeah, it says I'm looking up
right now. The they it looks like some
researchers said the Mac OS binary that was delivered by the
specific post install hook that they had tracked has an overlap
with like a back door that yeah and linked to that specific DPRK
actor. So, but yes, I think you know,
given kind of the like details of certain amount of
sophistication that we're seeing with the initial access and
other types of things, you know, I guess it does make sense that
this would be like, you know, at least a, a group that is
somewhat more like categorized or like fully formed than just,
you know, people that are doing this kind of offhanded so.
Yeah, yeah, for sure. And the, the timeline on this is
really interesting. It's in the the blog blog post
that that you guys have up on Huntress that John wrote that
has like a timeline of both the intrusion itself as well as like
the pre attack staging and all of that.
So that the trojanized package was something that didn't even
exist before this whole episode. It's sort of a typo squatted
version of a legitimate package, but it it just depends a name to
the front of it. It's called plain crypto JS, I
believe. And you know that this was
created like 18 hours before the intrusion.
And then, you know, researchers started sort of noticing this
thing showing up. And then once the the package
was published and put into the Axios versions that, you know,
consumed it and then went live, Huntress saw like infections
within seconds after that, which is bananas.
Like that shows you like that auto update, you know, hamster
wheel that that can really turn into a a whole, you know, pile
of trouble in these. Cases, yeah, absolutely.
And that's probably what the attackers knew that was going to
happen and kind of what they were going for, because it seems
like it is like a quick hit and just kind of cast that wide net
and try to get those initial infections and as.
And that's that's usually the nature of supply chain attacks
anyways, instead of them being a little more targeted.
And in fact, that's really kind of what we saw last week with
what Team PCP was doing as well, which was just trying to get AS
big and broad of a scale of attack and victims as they could
and. Then.
Kind of crunching in and not going for stealth really, but
going for like trying to get, just trying to get in and get
out. Yeah, that's kind of the the
beauty and the horror of supply chain attacks is they can, they
can have these like massive long range effects and these huge
blast radiuses, as you said, Linds, and they can go on.
You know, even though this was the malicious packages in this
case were taken down after a couple of hours, the damage was
already done. And, you know, this attack was
obviously planned in advance and they knew what they were doing
to a certain extent. And I don't know what their
ultimate goal was. You know, they might have had,
you know, some specific organization or app in mind or
something like that and just decided this was like the the
way to go. But supply chain attacks can,
you know, have really, really long, you know, tails and
tremendously broad downstream effects.
And, you know, they can be a a huge bang for your buck if
you're the threat actor on the other side of it.
We've seen that like there's still effects from solar winds
happening now. You know, you'll, if you, if
you're bored on a weekend, go look up SEC filings.
You'll still see like people reporting damage from the solar
winds attack like in the past fiscal year.
And that was what 2021 or two like that, that is still
happening, you know, and some of the other supply chain attacks
that have happened in the in the last few years.
So, you know, I guess we can log for J fits into that.
You know, it's a different type of supply chain attack.
But you know, that thing was that was one of those where it
was a utility that a lot of people didn't even know that
they had in their environments or forgot that they had or had
never heard of and some developer was using or things
like that. And it turned into a giant can
of worms. Yeah, there's, we've seen all
these types of attacks in all different forms over the past
over, you know, well, we've seen them, I mean, at least since
like for, for decades. But Oh yeah, no doubt.
It's definitely seemed like it's been like a wider scale
recently. Sorry, it's.
OK, it's the beauty of live podcasting.
Yeah, right. Delete.
But yeah, anyways, we've seen these types of attacks like, you
know, happen a lot over the past decade, but it does seem like
the ones we've seen over the past like 5-6 years have just
been much higher in scale, as you mentioned, like solar winds,
like, you know, some of these other ones and so.
Yeah. Yeah.
And the other thing too is that when you think about these types
of attacks, like historically there was kind of the the
intention was just crypto mining with a lot of these types of
things. And I think that now it's has
now shifted to much more insidious types of animals like,
you know, like data exfiltration, like kind of
honing in on those passwords and then using them to like launch
further attacks and things like that.
And so I think that also it kind of makes it a lot more of a
dangerous type of impact that we're going to see.
God, the crypto mining error was such a like we were, we were it
was so nice like compared to this like yes, I know honestly,
such a gentler time in the in the security landscape.
We're just going to use some of your resources to try and mine
these stupid coins that, you know, for the most part of
worthless. But yeah, I kind of do too,
honestly. It was yeah.
What a what a time that was that in the NFT era.
But yeah, yeah, I'll, yeah. It'll be really interesting to
see how this sort of continues to shake out the next few days
and weeks. And, you know, whether whether
we find out more about who was behind it and the motivations
and, or kind of the the what was taken, that will sometimes give
you, you know, some insight into the, you know, the ultimate
motivations of the hackers. But you know, in some, in some
ways the motivations don't really matter.
Like they were, it seems like they were just trying to get
access to a whole bunch of systems.
And then, you know, maybe we'll see some ransomware fall out
from it. Maybe we'll see a bunch of, you
know, data breaches like you said.
I'm, I'm sure that's the most immediate thing we'll see and
maybe some follow on ransomware. But you know, there, there,
there will definitely be a whole bunch of like things stacked on
each other over the next few months.
Yeah, definitely. And then the the other thing too
is like that, you know, as you mentioned companies not being
aware of this and that it's happened to them.
So I think just getting the word out right now is really
important. And then also like helping
people understand the specific mitigations that they can take
to kind of deal with this and the guidance for defenders as
well. So I think that's kind of
immediate term what we need to do here.
Yeah, no doubt. And you know what's interesting
to me, I looked this morning and I looked again this afternoon
and I, I don't see it unless it's somewhere that I'm missing.
I don't see a word from SISA about this.
Like not, not a thing. And, you know, we've talked
about the things that have happened at SISA in the last few
months, but I struggle to think that if this was a year ago, we
wouldn't have seen a whole lot of communication about this.
You know, even if it was just a, a broad, a broad alert that this
has got, that this has happened, you know, and to check your logs
or that sort of thing. I haven't seen a single single
peep about it. Yeah, I remember, I think it was
the XE backdoor, the one with the geaton, like what was that
like 3 years ago or something. But they had a pretty big part
in trying to put port the advisory and, you know, make
sure that Debs knew what was going.
On SO. Yeah, it is that.
I hadn't even thought about that until you said it, but that is
such a interesting point. Yeah, it's, it's a little
depressing. And I promise you that this is
going to affect some government agencies too.
There's no way it doesn't. It would be impossible for.
Sure. You know, not just federal, but
plenty of state and local and tribal government agencies, I'm
sure that do not have their own cybersecurity people or IR staff
or anything resembling that to help them.
And you know, this, this is another thing that like just
reinforces to me how much the Internet ecosystem is held up by
like 12 pieces of open source software and you know, like 4
companies. And if one of those gets kicked
out from under the table, the whole thing just starts to tilt.
You know, it's like every time one of these happens, somebody
posts that that XKCD cartoon of like, you know, the, the little
pillar holding up this giant like mousetrap.
And it's like open source software right here.
And it's it's funny 'cause it's true and.
It's and then yeah, it happens over and over again.
Something about yeah, how things are going into threat landscape
right now. Right.
And I mean, it's super easy in these cases always to point your
finger to maintainer or something like that.
But again, doesn't seem to me that the these maintainers did
anything wrong from what we know at this point.
And these people are not being paid for what they're they just
wrote some software and you decided to use it.
You know, that's a whole other. Discussion.
Whole other discussion, yeah. And not one that we can do in a
short podcast, but yeah, it's been it's been quite a couple
weeks for the supply chain world.
Yeah, definitely. It is weird that you know this
is coming right on the heels of the other attacks that you know,
everyone's kind of been covering last.
Week so I. Don't know but.
It's funny because I not funny, ha ha.
But I ran into somebody from Socket, one of the, you know,
teams that really focuses on this stuff.
And at RSA last week, right when all that that stuff was
happening and I said, how's it going?
He was, he just shook his head, didn't even say anything.
He was just like, in a long week.
Yeah, yeah. A tough one.
Like Tufts of hair coming. Out.
Razzled. Yeah, yeah.
And that was like Wednesday afternoon, though it's, it's
been almost a week since then. So yeah.
Tough times. I know.
Wow. Yeah.
I, I have a lot of empathy for those folks.
It's not, you know, not super easy.
So the resources for folks that are that are trying to learn
about this and trying to figure out what to do, mention the the
Huntress post that you guys have up, the video that John did.
Socket has a great analysis, Elastic has a good analysis, and
so does Whiz. I think there's probably others.
You mentioned that Mandiant has something or was that just like
a tweet or something? Yeah, it was just, it was a
statement like an. Official.
From them but but yeah it is and we we'll post all those in the
show notes but like I will say it has been like heartwarming I
guess in a weird way like to see just everyone come together and
like you know, trade, you know intelligence and and try to get
the word out so. I agree it is.
That's one of the benefit is not the right word, but one of the
like side effects of things when these things happen is you do
see that community spirit that's still there.
It's hard to see sometimes because we this community loves
to, you know, eat its young in some cases, but you do see it
when things like this happen and everybody kind of pulls together
and is like, well I saw this, we saw that, you know, let's try
and pull our resources and see how we can help people, which is
very nice. Right.
Yeah, for sure. Yeah.
All right. Well, thanks Linz.
It's great to have you back and I'm sorry you got dumped into
the deep end your first few days back coming.
Back with a bang, yeah. Oh, yeah, no rest for the
wicked. All right, talk to you soon.
See ya. Thanks.
Bye.