BLOG

The OpenSourceMalware Show #27

Brotli vulnerability reaches far beyond Node, LiteLLM breached via unrevoked key, and AGENTS.md file tries to install a MALFEX package

By cb482791-4ef1-4762-96ad-b0ca4bdd538e ·

The OpenSourceMalware Show #27

The OpenSourceMalware Show is available on YouTube, LinkedIn, and as a podcast.

This week we talked about:

  • Brotli vulnerability: The Brotli decoder bug behind Node2Shell reaches far beyond Node, and it's been overshadowed by the hype around PHP2Shell. Google's Brotli C code is usually vendored into projects like Python, Rust and PHP instead of pulled in as a dependency, so it won't show up in your package manifests. You have to hunt for copies yourself, and finding them all could take as long as Log4j did. We cover how to check for vulnerable copies.

  • LiteLLM postmortem: LiteLLM's second compromise this year started with an admin key that was committed to a public repo in May and never revoked. In October, attackers used it to push malicious version 1.107.0, helped by a release control the team had relaxed so they could ship faster. It's a clear case for threat modeling any time you trade security for speed.

  • MALFEX campaign: A malicious AGENTS.md file in a developer's Downloads folder tried to get their AI coding agent to install a package from MALFEX, an npm campaign that has been running since 2023. MALFEX packages are tiny, have no install script, and hide their payload in a file with a PNG header. DPRK's move to TTF and OTF fake fonts shows the same lesson: filtering by file extension misses payloads.

Resources

[00:00:00] Jenn Gile: Hello. It is Wednesday, October 28th. Uh, my name is Jenn Gile. I have Paul McCarty here with me. We’re the co-founders of OpenSourceMalware, and this is the OpenSourceMalware Show, where we talk about the week’s, uh, malware news, trends, et cetera. Uh, this week on the agenda, we’re gonna be talking about the postmortem that LiteLLM put out.

[00:00:25] Jenn Gile: Uh, they shared how they ended up getting compromised a second time. We’re gonna talk about a little campaign, uh, well, maybe a little is the wrong word, but a campaign called MALFEX. But first, uh, we’re gonna kinda break our norm because the last, what, seven to 10 days, Paul, have been a little rough for people working in cybersecurity.

Brotli bug reaches far beyond Node

[00:00:49] Jenn Gile: Um, the, you know, Call it a Vuln apocalypse, you know, between PHP and Brotli, um, there’s just been a whole world of hurt for, um, security teams having to go in and figure out if they’re affected by recent vulnerabilities. Um, normally, we wouldn’t talk about vulnerabilities because, uh, by definition, they’re not malware.

[00:01:13] Jenn Gile: However, uh, we are kind of suspending that for today to talk about Brotli

[00:01:22] Paul McCarty: We have an embargo. Yeah. We’re gonna, we’re gonna talk about, we’re gonna talk about vulnerabilities today.

[00:01:26] Jenn Gile: Yeah. Uh, but yeah, first things first, like, hearts go out to everyone who’s been dealing with this. Yeah. I’ve been in a couple different conferences over the last couple weeks, and a lot of stress going around, um, whether these are exploitable or not, or, you know, exploitable in your environment.

[00:01:44] Jenn Gile: Kind of, at the end of the day, doesn’t matter. For a lot of people, they still have to deal with, you know, identifying where it is and fixing it.

[00:01:51] Paul McCarty: Yeah.

[00:01:51] Jenn Gile: And that just, that stinks.

[00:01:53] Paul McCarty: Well, and, and dropping everything that you’re doing right now, all your n- normal kind of keeps the lights on kind of stuff and project work, and having to go into incident response mode.

[00:02:02] Paul McCarty: I think this is a great way to start to talk about this whole last couple of weeks. You know, the, it, it really, you know, the vulnpocalypse, we’ve been talking about it for ages. The, the PHP2Shell thing kind of really started this n- latest wave. And I wanna talk about PHP2Shell, not because I give any beeps about it, but the, because it, it’s part of the kind of mindset that is, that we need to talk about, which is, you know, there’s just a lot of, um, hype about this.

[00:02:33] Paul McCarty: Uh, s- there’s two, um, two, now three, uh, CVEs vulnerabilities. I mean, the NSA, the NSA came out and made a tweet saying, you know, “If you’ve got PHP apps, you should probably take them offline.” There was just like the hyperbole and the hype behind this. We’ve never seen

[00:02:51] Jenn Gile: anything- Yeah, the whole turn everything off guidance is unusual.

[00:02:55] Jenn Gile: Um- Yeah … that’s, that’s a big step. Um, there’s definitely- Mm-hmm … a lot of people talking about I, you know, kind of the, the world that we’re in right now where these are AI-discovered vulnerabilities and, you know, it’s able to find things that have been around for a long time that nobody human could find before.

[00:03:19] Jenn Gile: Um, our friend Josh over at the Open Source Security podcast- Josh, right? … uh, published a really nice op-ed, um, about responsible disclosure. I’ll share that in the chat 'cause I think the future of responsible disclosure, uh, certainly probably does need to change. Um, there have been some moves to, you know, for certain ecosystems to say we’re no longer going to require confidential reporting for, uh, what is it, low and medium grade vulnerabilities because the volume is just too high.

[00:03:58] Jenn Gile: Um, the responsible disclosure process is heavy and bureaucratic, and getting it right is really hard. And so certain ecosystems organizations have decided to reserve that process for only the, the worst of the worst. But I will share that article, and then Paul, why don’t you talk about why you went deep on Brotli specifically?

[00:04:27] Paul McCarty: Yeah, that’s a good question. I, I… Before I do that, I just wanna finish this thought, this high-level thought about the vuln-pocalypse. And so we had all these people telling us to turn off these PHP apps and, you know, just everybody was talking about it. It was in the mainstream media. And what happened is there were no exploits initially.

[00:04:46] Paul McCarty: Like, basically, we were just watching all these failed attempts, and just there was millions of non-effective, uh, POCs, proof of concepts, and exploit code. And I actually talked to a friend of mine, this is a true story, I talked to a friend of mine here in Australia who spent a whole day trying to build a detection based on a set of exploits that he found in GitHub.

[00:05:07] Paul McCarty: Turned out those exploits were junk. They didn’t actually do what they were supposed to do, and so he wasted a whole day, did not have at the end of it a detection for PHP. Now, you know, so for multiple days, there was no actual exploits happening, and all these people telling us that we’re not seeing any exploits.

[00:05:22] Paul McCarty: And what happened is, I think the, the, the zeitgeist is now, “Oh, listen, we over- we overreacted, and we turned stuff off, and look, it’s a, it’s a nothing burger.” So meanwhile, and here’s where this is all going, meanwhile, uh, shortly off- after, you know, the PHP2Shell, um, exploits, or sorry, vulnerabilities were announced, another set of vulnerabilities were announced, um, where- which actually go back, have their, have their roots years, years back.

[00:05:52] Paul McCarty: Um, Imperva and somebody else announced this set of vulnerability, or this one vulnerability in the Brotli decoder, but only in Node, and they named it Node2Shell. And that was… L- Like, this is not me, you know- S- slinging arrows, but it was just a bad name because it implied that this only affected Node.

[00:06:14] Paul McCarty: And it turns out bug wasn’t actually in Node. Well, it was, but it was in Brotli, and you know, Node, you know, 20, 22, and 24 bundled in Brotli. So anyhow, there’s, there’s a C decoder called Brotli. I’ve used it before. I was familiar with it. It’s owned by Google. It’s an open source project managed by Google and, um, it’s everywhere.

[00:06:35] Paul McCarty: And because it’s C code and because it’s tight and it does its job, it’s a lossless compression algorithm. It basically uses keywords. So basically instead of having to use these big long pieces of text, it uses these like these keys that replace that text that are much shorter, and then you just add a bunch of those together based on the, uh, the, the chance that certain strings will be in text.

[00:06:56] Paul McCarty: It’s a very, very effective compression algorithm. Anyhow, encoder and decoder. The bug was actually in the decoder process, not in the, the compression part of the algorithm. This C code is vendored into everything. I found it in Rust, I found it in PHP, I found it in Python, I found it in everywhere. So nobody was…

[00:07:15] Paul McCarty: Everybody was just sleeping on it, and that’s why I jumped in. So like, I hate doing… I do disclosure all the time. I hate it because people treat me like crap. Um, I really get frustrated, um, and I get pissy because people are not treating me well, but I had to do it for all kinds of different stuff. So Microsoft, ClickHouse, um, uh, Rust, Python, I made, I don’t know, about 15, somewhere between 15 and 20 disclosures.

[00:07:40] Jenn Gile: Cloudflare, Bazel.

[00:07:42] Paul McCarty: Ugh. Yeah, yeah. Oh, yeah, that was the Bazel registry. That was heaps of fun. Uh, in a future, in a future talk we’ll talk about h- why all these projects are telling you when you disclose things to them, use our bug bounty process. The problem there is the bug bounty triagers think that you’re a bug bounty researcher, and they, they apply the same kind of process to you.

[00:08:02] Paul McCarty: And all you’re trying to tell them is like, “Hey, you’re using an old version of Brotli inside of this package on Bazel or Cloudflare workerd,” or whatever the case may be, and they’re, they just, they don’t know how to ch- to, to modify their workflow, and so they just close these tickets. And then, so then Bazel just didn’t do anything about it, right?

[00:08:21] Paul McCarty: So anyhow, that’s why I got involved. Sorry, that was a, that was a stream of consciousness. I apologize, audience. But that’s, that’s why I got involved, because nobody was. People were sleeping on it, and I just saw this stuff everywhere. I was familiar with the library, so I just jumped in. Um, I got a- at least one CVE out of it which is interesting 'cause it’s my, it’s my first Microsoft CVE in, uh, 20 years or something.

[00:08:46] Paul McCarty: But, um, uh-

[00:08:47] Jenn Gile: Well, what do you want people to know about what’s going on with Brotli? 'Cause it doesn’t seem like it’s necessarily getting the same level of awareness as the PHP one, which I think perhaps is the point that you were making earlier, that, you know, there’s so much attention on this PHP one, it turned out to be a little bit of a nothing burger.

[00:09:09] Jenn Gile: Perhaps that has overshadowed what’s going on with Brotli.

[00:09:14] Paul McCarty: Yeah, that’s exactly it. That… Thank you for condensing that into a cogent, uh, couple of sentences, um, versus my stream of consciousness. That’s exactly the point I was trying to make, was that people are sleeping on this. Um, and this bug is in more places, um, and it’s in more stuff.

[00:09:34] Paul McCarty: And I’m not discounting the PHP2Shell. There are now, we are now seeing genuine in the wild bad guys exploiting PHP2Shell, but it took a while t- for it to happen, and it’s hyper complex. Meanwhile, Brotli’s everywhere. And because Brotli is ven- I think there’s a really important thing, for our listeners that aren’t software engineers, I, I wanna make this really important distinction.

[00:09:55] Paul McCarty: When I have a, a piece of software that calls a package and that package has a vulnerability in it, it’s relatively easy me- for me to find it and track it because I can just look in the package manifest and find it. Well, here’s the thing. This C code is what’s called vendored. In other words, people just grab, you know, these, uh, 1,100 lines of code and they just drop it into their code base.

[00:10:17] Paul McCarty: So they’re not calling a package. They’re not… A lot of times they don’t even mention Brotli. They just grab the C code and they put it in, and then they call the C code, you know, from their, from their project. And because of that you have to like hunt for the presence of these

[00:10:31] Jenn Gile: specific components. Well, and this is what makes C particularly challenging for SCA, for example, because you just don’t know what your dependencies really are.

How to check for vulnerable Brotli copies

[00:10:40] Jenn Gile: Um, but you wrote a little how to discover if you’re vulnerable set of, um, steps. So first off, you’re gonna search for those bundled copies. Since you can’t just search your dependencies, you can grep, um, for the vendored code, um- you know, look in container images. There’s a whole bunch of places. Uh, manually upgrade what you’re able to.

[00:11:05] Jenn Gile: So Brotli has, you know, patched it. You can directly consume that. Uh, if you’re consuming it through a product that hasn’t patched it yet, which it’s been a week, so I would really hope that it’s all patched, but I think things are still rolling in. Um- Yeah … there are some things that you can do which are covered in the bro- blog, um Yeah.

[00:11:27] Jenn Gile: Anything else that you wanna kinda encourage people to take a look at as they’re figuring out if they’re affected?

[00:11:34] Paul McCarty: We’re-- This is gonna be Log4j- this is gonna be like Log4j. I’ve said this multiple times now. Like, we’re gonna be finding this stuff for months. I mean, the, the long tail of this is gonna be long.

[00:11:44] Paul McCarty: Um, so, uh, I, I will, you know, encourage people to take a look at, at our blog post, which, which Jenn just mentioned. I need to add a few more things to it, um, but basically what you’re looking for is you’re looking for the presence of the, of the decode.c and .h files, which are the C files. And then, uh, the easiest detection is to find out, does this file exist and is there this particular string in it, which is actually the fixed copy.

[00:12:08] Paul McCarty: Now, if you find that you’ve got a decode.c and you don’t have that string, well, there’s a pretty good chance that you’re running an older version of Brotli that has the decoder, um, problem. So it’s an unusual one to, to, um, to find, but it… You can find it. I found hundred-- uh, not hundred, sorry, tens of thousands of examples of it in, in GitHub.

[00:12:29] Paul McCarty: Um, so I’ll make a promise to, to strengthen some of those kind of search sections inside the blog post. But what’s there right now is a really, really good place to start.

[00:12:38] Jenn Gile: Great. Why don’t we, uh, move on and talk about malware?

[00:12:43] Paul McCarty: Let’s do it. Vulnerability gone. Let’s do it. I’m gonna go back to, like, there’s two types of software risk, and we’re not gonna talk about vulnerabilities, right?

LiteLLM breached via unrevoked key

[00:12:50] Jenn Gile: We’re, we’re done with that. So, uh, let’s talk about LiteLLM. There’s a couple of links that I’ll share shortly. Um, they put out a retrospective, uh, last week, early this week, time is funny, um, about the most recent compromise, um, 'cause this is the second time they’ve been compromised this year. We did talk about it last week on the pod.

[00:13:14] Jenn Gile: Um, this compromise was a malicious version that came out in 1.107.0. It was related to a credential that leaked way back in May, I think it was. Yeah. And, um, yeah, I definitely was interested to see the retrospective because the way that they got breached the first time was related to the TeamPCP compromise that started with Trivy and, you know, cascaded like a true supply chain attack.

[00:13:47] Jenn Gile: Anybody who used Trivy was susceptible. As far as we understand, that’s how LiteLLM was compromised back in March. Um, this recent compromise is in no way related to that. So as we kind of, um- Speculated last week, uh, this is not TeamPCP behind this. At least it doesn’t appear to be anyone who is affiliated with them.

[00:14:10] Jenn Gile: It’s not affiliated with that original compromise. Uh, but what they said was back in May, they committed a configuration file to a public repo, and it accidentally contained an admin key to an internal deployment of their platform. So they, they leaked a secret. Um, they said that they identified it quickly, um, deleted the file, uh, noted that the keys required revocation, but, uh, through some error, they said human error, the original commit actually stayed in the repo’s public history until October 22nd.

[00:14:48] Jenn Gile: Um, and so two problems happened here. Number one, that commit should not have been in the public history. It contained a leaked secret. And number two, uh, nobody followed through and revoked the admin key. So it was still valid when the threat actors, um, came around to use it. So fast-forward to October. On the 10th, the threat actor used that leaked key to gain control of their, uh, deployment.

[00:15:20] Jenn Gile: That’s how they were able to push through a malicious version

[00:15:25] Paul McCarty: Yeah, I think there, there’s a really interesting, um, uh, paragraph in the Hacker News article, and I’m gonna read it verbatim here. They’re talking about how the threat actor was able to use, get access to, and use the, the token. "The restriction was relaxed earlier this week to accommodate the temporary push for more frequent releases and bug fix back ports, allowing any two engineers to trigger and approve a release.

[00:15:52] Paul McCarty: As such, the threat actor used one of the tokens to trigger the release after having re-pointed the deploy- deployer to their m- malicious repository and another to approve it." So I think that’s a really important distinction. Basically, after the, the, um, TeamPCP hack, they put a bunch… And we were talking to the team, like, uh, kudos to this team.

[00:16:11] Paul McCarty: They actually, their maturity is overall pretty good, and I, they’re very-

[00:16:16] Jenn Gile: I think they learned a lot from March, and this was just one of those, like, “Ah, that sucks.” Like-

[00:16:21] Paul McCarty: I remember being impressed

[00:16:23] Jenn Gile: with their- It could happen to the best of us

[00:16:24] Paul McCarty: 100%. Like, I remember their response in March being really mature.

[00:16:28] Paul McCarty: It was quite good,

[00:16:29] Jenn Gile: yeah.

[00:16:30] Paul McCarty: And I was surprised, because a lot of other teams much more, like Checkmarx, a really good example, just to pick on them, you know, their, their response to their particular compromise was they just ignored it. They just, you know, just ghosted response. Whereas LiteLLM took it on the chin, said, "Hey, listen, we weren’t doing some things right.

[00:16:47] Paul McCarty: We’re gonna do things better," which I thought was awesome. And again, the same kind of thing here. They’re being very transparent. But the important thing in reading that paragraph is to stay, to say, you know, developers wanna be able to push changes, and so what they did is they relaxed one of these controls that they had in place, you know, since March and, uh, when they were originally a- attacked, and that allowed the attacker to then be able to use the token and, and, you know, onwards from there.

[00:17:13] Paul McCarty: So, you know, you just gotta constantly be vigilant, man, and just say, "I need to weigh every deployment and, and integration decision that I make in these complicated CI/CD pipelines that I’ve got against the i- the fact that there’s a security concern here, and we’re not necessarily gonna understand there’s n- we’re not gonna have visibility.

[00:17:35] Paul McCarty: The team’s not necessarily gonna have visibility on what that threat potentially is." So it’s constantly kind of weighing the two together, so I guess-

[00:17:40] Jenn Gile: Yeah, it’s a bit of a, um- Uh, uh, what word am I looking for? A use case to demonstrate why threat modeling is a useful exercise. Um, we actually-- we had the CEO reach out to us on LinkedIn, and we haven’t had time to follow up yet, asking for some advice.

[00:18:01] Jenn Gile: And so let’s, like, YOLO a little bit, Paul. Um, you know, if you were sitting down with the team right now, not knowing more than what they’ve published publicly, you know, outside of doing some threat modeling and being a little bit more cautious about, uh, when they relax some of these controls, you know, given this was a pretty different compromise example from the March one, you know, the, the improvements that I’m sure they implemented in March maybe wouldn’t have prevented this.

[00:18:34] Jenn Gile: Uh, what would be your advice?

[00:18:36] Paul McCarty: Well, I mean, I’m cognizant of not giving a lot of advice right now because I don’t understand the exact chronology of, and exactly what they had enabled and what they didn’t, and how many users had access to what and stuff. So I’m gonna give general advice, which is, you know, to your point about threat modeling, we have to have this hat on.

[00:18:56] Paul McCarty: And software engineers, like, our job is to deliver features as quickly as possible and as robustly as possible, right? But the reality of speed is always, literally always, the enemy of secure. And so every time you’re, like, you’re making a change based on the fact that you wanna go faster, you know, if you wanna push your-- the USS Enterprise to go even faster, you have to understand that, you know, it might start, things might start flying off a-- out off a…

[00:19:24] Paul McCarty: I don’t know, that’s a terrible metaphor. But you have to be conscious of those, you know, what you’re, what you’re giving up when you make those changes to go faster. So, um, I know that’s doesn’t equate to technical, um, uh, things. I think that some of the things that GitHub has implemented recently, for example, like the, the GitHub, um, CLI token refresh thing now, I think that could have been a very helpful thing here.

[00:19:52] Jenn Gile: Yeah. There’s something about, you know, uh, more fine-grained scopes, shorter durations, things like that. Like, this is kind of nothing new. Uh, I’m gonna share a resource, uh, for threat modeling. It’s funny, I just saw this in the wild last week while I was in Barcelona. Um, Adam Shostack’s pretty well known for threat modeling.

[00:20:14] Jenn Gile: His four questions, um, is sort of like deceptively simple and yet very effective. So for anyone who needs to do some threat modeling to look at how you might, uh, prevent this kind of thing from happening, I would suggest starting with that.

[00:20:30] Paul McCarty: I, the other thing too is that, in particular with the LiteLLM team, they opened up the ability to okay, um, uh, these changes to a group of people, and you just have to be…

[00:20:41] Paul McCarty: When you do that, you have to make sure that each one of those people individually, you have a conversation with them face-to-face, whether it’s over a video conference or in person, saying, "There’s a responsibility that comes with this now, right? We wanna go faster, but each one of you holds the key to allowing us to be able to push these things.

[00:20:57] Paul McCarty: Understand that comes with consequences, and take the time to look…" And I’m not saying those people didn’t do that, I’m just saying that’s what we have to do, right? Yeah. You know, once you think- When you’ve been

[00:21:06] Jenn Gile: given that- Oh, go ahead.

[00:21:07] Paul McCarty: I was just saying, when you’ve been given that responsibility, it’s a responsibility, right?

[00:21:11] Paul McCarty: It comes with, you know, trade-offs

[00:21:14] Jenn Gile: Uh, no, I, as somebody who was on an airplane today, it reminds me of the talk that you get from the flight attendants if you’re sitting in the exit row. You know- Right. Do you understand? Are you prepared to do this? You know, everyone has to answer in the affirmative before that plane takes off.

[00:21:30] Jenn Gile: I mean, it’s kind of oversimplified, but same concept, right?

[00:21:34] Paul McCarty: Yeah, agreed. Okay.

[00:21:36] Jenn Gile: It’s a

[00:21:36] Paul McCarty: responsibility.

AGENTS.md file tries to install a MALFEX package

[00:21:38] Jenn Gile: Last topic that we have is, um, related to… Hold on, I’m getting my notes. They’re here. They’re here. They’re here. Um, so there was, uh, a resurgence in the MALFEX campaign, oh, early in October that we documented at the time.

[00:21:57] Jenn Gile: It’s in our, um, threat reports, but, uh, didn’t really give it a whole lot of extra thought. Um, this is a campaign that’s been going on since, uh, twenty twenty-three. Uh, it’s assessed to likely be the work of a lone threat actor. Um, there’s some indication that they’re a Portuguese speaker. Um, it is, uh, it contains Windows malware where it’s gonna, um, use, uh…

[00:22:27] Jenn Gile: Sorry, it’s gonna have Overlord, which is a RAT written in Go. Uh, always like it when I see the mixed, uh, language ecosystem- Right … malware 'cause this is an NPM package or a collection of NPM packages. So it’s gonna start with this Go, um, RAT that uses Solana transactions to extract the C2 address. Um, it includes, uh, an install, uh, of a whole bunch of stuff that targets, uh, Discord browsers, Telegram, crypto wallets, and it has a downloader.

[00:23:00] Jenn Gile: Um, the reason that this caught my attention is there was actually an article published a couple days ago that’s related to this. So, um, a security vendor found in one of their dev, um, customers, uh, within the developers downloads folder, they found a malicious instruction file. It’s a, um, AGENTS.md file that was trying to get, uh, the agents to execute a set of steps that, you know, were not Uh, from the developer.

[00:23:35] Jenn Gile: So we’re seeing kind of an interesting evolution here with this campaign, right? Um, I think the natural language, uh, AI prompt injection stuff hasn’t taken off perhaps as quickly as we thought that it would, or perhaps we’re just not as good at catching it. That’s totally possible also. But, um, Paul, you and I were talking about this one beforehand.

[00:23:58] Jenn Gile: One of the things that makes it really unique is a malicious image file.

[00:24:04] Paul McCarty: Yep. Yeah, we’ve seen a resurgence of these kind of malicious image files across a number of threat actor groups. Um, and, you know, before… I was, I was hurriedly be- before the call today, you know, before the show today, I was trying to figure out, trying to, trying to collect who they all are, are, and I didn’t have time to do that.

[00:24:21] Paul McCarty: But, um, yeah, I’m… When I’m looking at one of them right now, um, cdn-img-fetch, um, which was downloaded about 1,000 times it sounds like. Um, a lot of these out there, I think that this group that’s mentioned in this latest MALFEX campaign is actually a subset of… I mean, they, they say it’s been going on for a while, so o- obviously it is a subset, but I’ve seen a larger number of these recently.

[00:24:45] Paul McCarty: But basically, they’re deceptively tiny and, and simple. So basically, they’ve got three files. They’ve got a- Yeah, it’s not

[00:24:51] Jenn Gile: the typical, like, look for a really big file that, like, is sketchy.

[00:24:55] Paul McCarty: No obfuscation, like, no filler. It’s three files. It’s a README, and the… Funnily enough, the README is lowercase readme.md, which, um-

[00:25:05] Jenn Gile: Oh, yeah.

[00:25:06] Jenn Gile: That is unusual, huh?

[00:25:07] Paul McCarty: Yeah. I’m pretty sure that the, the NPM package, um, when you go to publish, I think it requires that it be a capital README, but maybe I’m wrong. Anyhow, um, man, I’m… Like, honestly, basically there is no install script, um, so this is gonna work on import. Um, it basically calls main, the entry point is main from the package.json, which is, like, 10 lines.

[00:25:30] Paul McCarty: It’s super simple. And all it really does is it just pulls this malicious payload, um, and then extracts it, and there’s like a… There’s malicious blob inside of, of the payload. But the reality is that when you look at this file, it’s a legit, um, PNG file, regardless of what the, the file extension is. The ones I’ve looked at have all been, uh, PNG format.

[00:25:52] Paul McCarty: But it hides a payload. And now to your point, then this threat actor, what’s actually in the payload has been evolving very, very quickly. And, and so I’m not necessarily across all those changes, you know, over the last month or so, but… And we’re seeing this from lots of threat actors where they’re experimenting, right?

[00:26:10] Paul McCarty: We saw it with GhostAction. GhostAction is a perfect example of somebody that’s experimenting with additional kind of payload styles and, you know, initial acc- or s- secondary access. And, um, so they’re all, they’re all innovating and, um, that’s what this, this threat actor is doing. But yeah, finding it- It’s tiny and it’s, you know, looks relatively benign.

[00:26:33] Jenn Gile: Yeah, I think it’s, it’s unique because a lot of it looks somewhat normal from the outside. You know, we’ve seen the Contagious Interview campaign use, um, what’s labeled as SVG, so that’s an image, uh, file. But then when you open it, there’s no image, it’s just obfuscated JavaScript. But in this case, it actually is a legitimate image.

[00:26:58] Jenn Gile: So, you know, as we’re talking about the kind of things that would help you detect these, you know, you’re not looking at, uh, a file that contains something that it’s not supposed to necessarily, or, uh, you know, a file that’s, excuse me, really big because it contains a downloader. Like, they, they’ve optimized this nicely.

[00:27:20] Jenn Gile: Good job, I guess.

[00:27:21] Paul McCarty: Yeah. I, I, I just wanna make one, I don’t know, correction is not the right word, but, uh, update- Mm-hmm … to that. What, like, when you look at it, it definitely has the header, right, and the, the file header for, uh, a PNG file, but it’s not actually an image, right? It’s, it’s, um, it’s just sitting there as a, as a envelope to hold a payload.

[00:27:41] Paul McCarty: But, um, the, you know, I- it just goes to show you that, you know, things that seem innocuous, like file images, um, and you know, we were talking about this before we started recording, DPRK has used lots of the- these file extensions to hide. It’s just JavaScript with a dot extension on it. So let’s, let’s not trust what these file extensions, you know, uh, these suffixes say they are.

[00:28:06] Paul McCarty: Um, it’s a whole new world, and with vibe coding, anybody can use, you know, any s- type of file format to do anything they want to. So, um, there’s a lot of people that, that for example, when they’re downloading, uh, malware, malicious components, just exclude, uh, image files because they just don’t wanna

[00:28:24] Paul McCarty: Because of the size, they’re just trying to make them as thin as possible. You don’t wanna do that in this case, because you’re gonna be missing the actual payload itself.

DPRK fake fonts move to TTF and OTF

[00:28:32] Jenn Gile: Yeah. And speaking of DPRK and their fake font, I’ve documented two more variations. Uh, they’ve started to hide it in, um, TTF files and OTF files.

[00:28:44] Jenn Gile: So those are both legitimate font types, but you know, what I’m seeing is they’re often force pushing over an existing infection. And you can see all of the, you know, legacy- Right … WOFF, WOFF2 files that they had in there from the first time. And then you’ll see like a mix in of these other ones. So they’re still iterating really quickly.

[00:29:08] Jenn Gile: Um, it goes to show that searching based on file type, opting in, opting out based on file type is not necessarily the way you wanna go. You wanna be looking more at the signals that are in the content of the payload.

[00:29:25] Paul McCarty: And to that last point, when you go to GitHub and you see all the security researchers creating their, their threat detection stuff, you see them, you know, looking for asterisk.woff2, and you’re like, “Well, okay, so the threat actors can see that,” right?

[00:29:38] Paul McCarty: They can see that- Yeah … everybody’s, like, look- looking for woff2 files. Guess what they’re gonna do? They’re just gonna use some other, like, file extension, right? That’s meaningless. Again, back to my point that the file extension itself is, is meaningless 'cause it’s all JavaScript. In this case, it’s all JavaScript inside of it.

[00:29:53] Paul McCarty: By the way, I just wanna say, I think it’s hilarious that Jenn has become our primary DPRK, um,

[00:29:59] Jenn Gile: You’re not the only one. Uh, uh, he’s not making fun of me, to be clear.

[00:30:05] Paul McCarty: I’m not, I’m not. She’s like- I know you’re not … Jenn is like, “I have… I’ve been, I’ve been focusing on other stuff lately,” and Jenn has been finding all kinds of new- And I’ll be like, "What’s this

[00:30:12] Jenn Gile: thing over here?"

[00:30:13] Paul McCarty: Yeah. This is… She sends me a fricking thousand, uh, uh, repos, and I’m like, “How quickly our roles have changed.” Um,

[00:30:21] Jenn Gile: it’s a good- Yes. Well, thank you, Claude, my, my best friend.

[00:30:25] Paul McCarty: We gotta pay that guy. Uh-

[00:30:27] Jenn Gile: Oh, he gets paid. He’s fine.

[00:30:29] Paul McCarty: He, he does get paid. Um, he gets paid quite well, actually. Um, yeah. Anyhow, good, good job.

[00:30:35] Paul McCarty: Yeah. I guess- Thanks … I guess that was my way of, of, of giving you kudos in

[00:30:39] Jenn Gile: my classic- Thank you. I appreciate it. It means a lot. Um, all right. Well, I think we’re, uh, we’ve exhausted our topics. You and I are both- Yeah … fighting cold, so we might be veering into the l- the delirious stage of this podcast, so, uh, it’s time to wrap it up.

[00:30:53] Jenn Gile: We’ll see you all next week in the month of November. Stay safe out there. Yeah, thanks everyone

[00:30:58] Paul McCarty: for listening. Appreciate it.

[00:30:59] Jenn Gile: Bye.