BLOCKCHAIN.COM

DESCRIPTION OF EVENTS

"I recently discovered an airdrop site for Huobi that used a different MyEtherWallet phishing kit to what I am used to finding." "I came across an ERC20 token that was advertising a website that was airdropped to ~20,000 Ethereum addresses."

"[T]he [airdropper] has [c]reated 18 contracts between block 6,708,041 and 7,249,374. All but 1 contract address advertises huobiairdrop.com — the other is just a test. 62,132 addresses were sent a token that advertises huobiairdrop.com."

When viewing the site "I saw a legitimate looking Google Alert view that had me confused — I didn’t know Google detected Cryptojacking like this…" "I decided to view the source and saw that it was linking me to a Google Chrome Browser Extension." "NoCoin — Block Coin Miners"

"From the start, it looked like it did what it should — it was detect[ing] various CryptoJacking scripts (CoinHive, MinerAlt, WebminerPool) and there was a nice UI to let me know it was doing its job." "[T]he browser extension does what it was advertised to do, so it could [easily] go unnoticed to the non-paranoid user for some time."

The only problem is the script also "injects malicious scripts into MyEtherWallet.com and Blockchain.com by hijacking the CSP headers and network requests."

"It monitors/hijacks all web requests by attaching an EventListener to onBeforeRequest and onHeadersReceived[.] Depending on the network activity, it would [redirect traffic to] a domain on the .top TLD." "[I]t overwrites the [Content Security Policy] so it can “safely” inject code from untrusted sources…"

"Since the code is looking for [a] master or chunk substring in the resource, the main target is the vintage.myetherwallet.com domain to overwrite the etherwallet-master.js file." "We can see that it’s trying to load malicious versions of; manifest.1550618679966.js, vendor.b18ffdf080.js, app.46d4854459.js within the [Blockchain.com] login logic." "[T]he main JS is being replaced by the malicious browser extension [for both sites]." "[O]ur private key [gets] sent to the bad actors."

"We have to be careful on what we do. The duty is on you to ensure your maximum safety and security. Timeo Danaos et dona ferentes. Never install a browser extension that has the ability to modify the DOM that you/trusted source has not audited. Don’t blindly trust legitimate looking warnings to get you to install software (MetaMask warnings will always have their browser extension in the URL bar (like the phishing warning)). Never enter your secrets online — always use an offline signing mechanism (i.e: Ledger Wallet, TREZOR, or Parity Signer)."

A clever phishing campaign appears as a warning from Google against a detected cryptojacking script running on a webpage. The warning recommends the user to download a functioning extension which detects and removes known cryptojacking scripts - with the only slight caveat that it will also steal private keys from common web-based wallet software like Blockchain.info and MyEtherWallet. Information is sent off to the fraudster and used to steal funds from victims. There was no information found on how much was lost or whether any recovery or justice has been attempted in this case.

HOW COULD THIS HAVE BEEN PREVENTED?

Care should be taken to minimize the number of installed applications or extensions on any computer which is used to handle funds. It would be recommended to avoid using web-based wallets, given the high number of instances where they have been compromised. Instead, private keys should be stored on dedicated hardware such as a hardware wallet. Funds should also be kept fully offline until they are actually needed. More advanced users may consider a multi-signature setup.

Check Our Framework For Safe Secure Exchange Platforms

Discovering Fake Browser Extensions That Target Users Of Ledger Trezor Mew Metamask And More (Aug 22)
Hunting Huobi Scams (Dec 27)
CSP modification - YouTube (Dec 27)
yw2ZhEtBwn - YouTube (Dec 27)

More case studies

Bitcoin Fat
Finger Large Fee

Mercatox
EOS Breach