Jenn Gile 0:00

Hello, it is Thursday, October 8th. Um we have a couple topics on the agenda, but before we dive in, what's up, Paul? What's new?

Paul McCarty 0:13

Good question. What is new? Um just, you know, enjoying being home for a few months. I think that's um nice. You're you're taking one for the team and you're going to the Sands thing. So thank you for doing that. Although I really, really, really wanted to go to the show.

Jenn Gile 0:34

Why am I doing this again? But I'm excited for the the things that I have coming up.

Paul McCarty 0:40

Yeah, you got a couple really, really cool things coming up. And I forgot you were going to Lascon. So that's that's super dope.

Jenn Gile 0:46

Yeah. So uh for anybody who's going to the Sands uh summit next week in Virginia slash Washington, DC, come say hi. I'm going to be giving a talk on um Pollenwriter. And then uh at the end of the month, I'll be in Austin at Lascon giving a talk on malicious AI skills. Uh, I really like LasCon. I was um looking at their webpage, website, uh, you know, kind of writing up my post to say, hey, you know, I'm gonna be there. And their website says they get about 400 people a year. And honestly, it's one of those conferences that, like, if you had told me 400, I wouldn't have believed it. It either would be more or less, but like it's just, I don't know, they have a ton of cracks. Um, people from all over the country travel to it. Like it's just a really unique conference. So uh if you haven't gotten your ticket yet, they are still available. They're a little pricey if um you're paying out of pocket last minute, but if you can get your employer to pay for it, you should because the content's great, the networking's great. Uh, they put on a really nice conference.

Paul McCarty 1:55

The show from uh I'm sorry, the shirt, the swag. The shirt from the 20, I guess it would have been 2024 when they did the upside down. Um yeah.

Jenn Gile 2:05

The strange I didn't get that shirt, but I know which one you're talking about.

Paul McCarty 2:08

I I wore it a couple days ago. It's just such a great shirt. Great swag.

SPEAKER_01 2:12

Oh, I have the challenge coin right here. There you go, there you go, there you go, there you go.

Paul McCarty 2:17

Uh oh, very nice, and then the upside down bowl because they always have the bull. And I did ride the bull.

Jenn Gile 2:26

Yeah, uh, I enjoy going and watching who does ride the bull. That's the best part about the happy hours to see who who decides to bull ride.

Paul McCarty 2:36

I definitely bull rode and watching the video back, I'm just so embarrassed. It's like painful to watch it. Like it's so slow, and at one point my tummy pops out because you're you're like this. I just the whole thing is so cringe.

Jenn Gile 2:53

Pretty cringe. I don't know. I feel like uh that might be part of growing up. Somebody, you know, you gotta at some point if you have an opportunity to ride the bull. I probably did it in my 20s at some point. Uh I'm not gonna do it now because I will hurt myself. Okay, anyway.

Paul McCarty 3:08

So yesterday so many jokes, so many jokes in there that we're just not gonna like we're not gonna we're we're we're gonna roll on.

Jenn Gile 3:16

We're gonna talk about Tensor Lake. Um, yeah, as I was uh winding down last night, um, we saw Tensor Lake get compromised. Tensorlake uh it's is their SDK, is what was compromised. So it is uh used for building and operating AI agents. And um there's a couple things to know about this. Uh first, it is a pretty widely used package. So if you're a TensorLake user, um definitely uh, you know, make sure you're not using the compromise version. It was taken down relatively quickly within a couple of hours, I think. Uh, but this was uh the second time, I think second or third time we've seen an attack that leveraged the open sourced mini Shy Hulued worm from earlier this year. Um it's very similar to the attack that happened in August that targeted Jared Ray's projects. So that was um a pretty substantial one. It you know, hit 400 or so packages because he maintains a lot of things and it had a little bit of success on the worm-like behavior. Uh, I'm not seeing any success on this iterations worm. Have you seen heard anything?

Paul McCarty 4:41

No, I mean, I've seen it described. The only thing I've seen really is I've seen it described as not having any real impact. So um yeah.

Jenn Gile 4:51

So that's good news. Um I'm gonna go ahead and drop our threat report on it in the chat. Then sorry.

Paul McCarty 5:03

Sorry to continue. I was just gonna say, uh, you know, I was just going through the list of stuff that it exfils, the specific um it's real similar to what we've seen from the previous iterations.

Jenn Gile 5:17

Um, I'm sharing our blog that we published in August about the cacheable kev um compromise that was the bigger version of this because it's it's not identical, but it's very similar.

Paul McCarty 5:31

I don't know if the um I'm looking at it's also it also specifically looked for the bitrise underscore IO variable, which um I don't know if that was anything. That might be new. That might be new. There's always, yeah, I mean, whenever you look at these, there's always one or two things that are added. But I mean, I think what we're driving at here at some level, Jen, is the fact that this, you know, this is kind of I don't want to say it's a nothing burger because it's not. I mean, it's it's real, but uh it looks and feels like the last several versions of this, right? And I think that people have, you know, over the course of the Namiasma and the many Shy Halud iterations, you know, have worked on some form of excuse me, um, you know, way to deal with this. And so I think shields are up. I I guess that's what I'm trying to say. Bringing back a term from 2024. Shields are up, and um, and it appears those shields were, you know, I think mostly successful.

Jenn Gile 6:30

Yeah, I think it's probably a combination of better defense, and um, I'm gonna go out on a limb and make some uh uh I would say assumptions here, not proven. Um, I don't think we're dealing with a very sophisticated threat actor. Uh, this reads like they used the open sourced form as a template, probably had access to some LLMs and some automation, and uh somehow managed to get access to the GitHub repository for this uh TensorLake project. Um, I think it took them a little bit of time to detect it, but it's not clear how they got uh in, much in the way that it's not clear how the attackers got in uh back in August. So there's probably some combination going on here of using AI to find a reasonably popular open source project that has a vulnerability in it somewhere, um combined with you know a little DIY malware template, but I think just based on the you know lack of panic, which is a good thing. I don't think we're dealing with somebody very sophisticated here.

Paul McCarty 7:53

Yeah, I think all signs point to low sophistication for this one. Um and uh you know they did use a custom um you know domain. So uh it's following the form and function of some of those, you know, April to June um patterns. Uh but I want to take this opportunity. Wait, I want to look right down the hey GitHub, npm.

SPEAKER_01 8:24

I thought you guys are scanning npm packages. What's going on, homies?

Jenn Gile 8:29

Yeah, I guess what I'll say there is this is definitely following a really clear playbook. Um, the malicious version contained two files uh in addition to the regular uh content that you would expect in the package. That included a setup.mjs, which fires through a pre-install hook. Oh, isn't that one of the things we all know to look for at this point? That's what any scanning, proactive scanning should have caught. And then uh so that pre-install hook uh launches the payload using bun again, fairly um well-known pattern at this stage. And then we have a math underscore symbol.js file, which again, similar to what we saw in August, slightly different names, uh, that contains a credential stealer and self-propagating worm. So yeah, there's some pretty clear signals with this that proactive scanning likely should have caught.

Paul McCarty 9:28

Yeah, I'm I I will go a step further and proactive scanning likely doesn't exist.

Jenn Gile 9:35

Yes.

Paul McCarty 9:37

That would be what follows. As a functioning thing, as a functioning function. You know, it's interesting because oh sorry, I was gonna I was gonna go off topic today because we're YOLOing it right a bit. Is that okay?

Jenn Gile 9:51

Sure. I was gonna move on to the Ruby Gem topic, but if you have something that's uh worth talking about now, let's start there.

Paul McCarty 9:57

I want to do both, obviously, but um I think in anticipation of the NPM V12 you know changes, we we saw bad guys even before that came out. We saw bad guys like you know pivoting and and coming up with really unique ways, and and that continues, that trend continues. I'm seeing every day, I'm seeing kind of unique attempts. So something that I saw yesterday, I haven't even had a chance to write this up, but yesterday, excuse me, what we saw is we saw a contagious interview style attack, which is a combination of a GitHub repo and an NPM package. Um, and if I'm not mistaken, the GitHub repo required the npm package. But here's what happened is if you looked at, and this wasn't a public npm package, if you looked in its package.json manifest, it called out to this package that wasn't in the public uh uh registry. And so here's what happened the GitHub repo that you downloaded and you cloned beforehand is part of this interview process. And there's no yet I've seen Jen, just to be clear, I have yet to see data saying this is genuinely a DPRK contagious interview thing. It just it looks and feels like a like an interview process. Well, it is, it's following the kind of GitHub.

Jenn Gile 11:09

It's following the playbook, whether it's DPRK or not, is not attributed. Yeah.

Paul McCarty 11:13

I'll I'll do more and I'll circle back next week and I'll have an answer there. But in the meantime, what happened is because you cloned the GitHub repo earlier, what it did is it did this really sneaky thing where it dropped an NPMRC, a custom npmrc, into the to the repository. And then when you when later on it did the npm install and it got to that line, which if you don't have the npmrc, if you're just talking to registry.npmjs.com, that file doesn't exist. You think, oh, it must be an internal, you know, a private um package. Turns out that npmrc token they dropped in there, then points you at a different registry where it does resolve, right? And it was one of the Chinese, by the way, like all this work that I did last year on the Chinese mirrors is still coming to fruition because that's exactly what this was. This is pointing at one of the Chinese NPM mirrors, npm mirror.com, and very subtly named, um, does what it says on the tin. But I just thought it was a really unique way of doing it, right? Like, especially if you know that you're gonna own the whole workflow. And I think that's the important thing here is that a lot of people, when they look at an npm package, they think about it, and like all the security scanning companies do this, they kind of oversimplify what's happening behind the scenes. They think somebody going there, what's gonna happen? The problem is a lot of these npm installs, or the equivalent in in Pip and other places, happen as part of a constructed workflow. Contagious interview is a really good example of that, but there's others versions of this. So other things happen beforehand that are the dependencies and the foundation that then that can and we're seeing this in other places too. A really good example, and Akito and all the other scanners will see this too as well. We're seeing a lot of packages right now that don't have a malicious payload, and we talked about this a little bit in last week's episode, where you have to combine two or three npm packages that and they all call each other in dependency structure, and then the three of those will combine to give you that payload. Um, and those are just some really kind of simplistic ways. So, first, npm GitHub, you're not doing a very good job scanning based on the really simple pattern matching that we already know about, like these, you know, these existing mini shy halud patterns, and you don't even have anything for this other stuff, which is actually much more you know productive. And scanners aren't finding these things, like the software supply chain firewall scanners aren't finding these, and um a lot of times the scanning companies aren't labeling these things as malicious because guess what? There's no malicious by itself, it's not malicious. Yeah, you gotta combine it. It's like the the the Voltron, right?

Jenn Gile 13:52

I know I'm envisioning like Power Rangers or something.

Paul McCarty 13:56

I almost said that and I said I cannot say that word, those two words together. Um, I've always been wanting to give Ken shit because he's got a bunch of Power Rangers um helmets behind him in his in his office. Want to find out the story there.

Jenn Gile 14:10

Yeah, okay, let's talk about Ruby.

Paul McCarty 14:12

Um love you, mate.

Jenn Gile 14:15

You discovered, well, not you, but kind of you, our automatic uh watchers that take a look at Ruby Gems, flagged some concerning behavior a couple days ago. Um, 40-something, I think 42 malicious packages uh were published in a burst to RubyGems, all from one user by the name of Ghost Dev. Very clever.

Paul McCarty 14:39

Ghost Dev.

Jenn Gile 14:40

I don't know, you had to think real hard on that one. Um and they are targeting crypto and web 3 developers through a combination of typosquatting, brand jacking, plausible utility names. Um with uh essentially it's a cryptocurrency theft kit included in it. Um, I think it also has an info stealer, remind me. I know there's a couple versions of this.

Paul McCarty 15:11

Yeah, there, yeah. So it definitely has the the crypto stealer, and um uh I don't know if there's like a kind of generic info stealer component. I'm looking right now. Um I don't think they're I don't think there is yeah, sorry, I don't remember.

Jenn Gile 15:25

It's been a couple days since I uh soaked in this one. But basically the attack flow here is um like what we saw with the Gemstuffer campaign a month ago or so. Uh gem install runs uh a file called extconf.rb x. Um and so that's a native extension build script. Kind of works in the same way as a pre-install script. Uh it checks the environment for the little bits and bobs that it needs to run. And then I like how you said, and then it takes a nap. So it takes a nap for somewhere from 20 to 40 minutes. Uh, presumably, this is uh an evasion, you know, detection evasion technique of like, you know, it doesn't look scary if it's asleep. And uh then from there it has two variants. Uh variant one opens a reverse shell, gives the attacker remote control. That's what I was thinking of. I knew there was something else. So there's a rat component essentially.

SPEAKER_01 16:31

Yeah.

Jenn Gile 16:31

And then variant two is the theft kit, which um is posing as a tool called wallet guard. Uh again, gotta love the threat actor that pretends something is a good thing when in fact it is doing the opposite of the thing that it's telling you that it's doing.

Paul McCarty 16:49

There is so much of this right now. If you download an AI skill npm or pipie package that ostensibly is about security, be careful. There's a pretty good chance it's the the antithesis of security. It's it's actually malware.

Jenn Gile 17:05

Oh womp. Um let's see. What else is interesting to share about this one?

Paul McCarty 17:12

I mean, this thing had everything, right? I really, really enjoyed this. Um, one of my favorite things about it was that you know it was it was Ruby, right? It was uh Ruby code, but the um the C2 uh once it downloaded the second stage. So, like Jen said, there was like two versions of it. There was the reverse shell version of it, which was pretty simplistic, and then there was the other version of it that had the rat component. Um, and rat-ish. It really wasn't a rat. Yeah, I had a whole I had a whole conversation back and forth with Codex about does this qualify as a rat? And in Codex and I were kind of like debating each other back and forth. Well, anyhow, um, it's not really a rat. Uh it we we landed on the language gen. Uh a backdoor, what do we say? Uh uh a malicious backdoor or something like that. But um uh it and the code was actually in Python. So the Ruby, the second stage of the Ruby was Python. And we're seeing this a lot.

Jenn Gile 18:08

Something that we've been seeing, right? You know, the 100% front door, so to speak, is Ruby, and then it includes code in there that's not Ruby related.

Paul McCarty 18:18

Because you have to think about these attack chains, and this is another thing that people do is that they only look at what the first they look at the npm package and look at what it does, and they just they don't realize that there's like five other stages after that that you got to pull and deconstruct and uh sorry, deobfuscate and reconstruct and whatnot. But in this case, that that Python payload was probably probably came from something else, right? And they're just using it like a portable second stage, third stage.

Jenn Gile 18:43

So um, let me ask, because I'm certainly not a Ruby expert, would this be one of those things that should be tipping you off that there's a problem if you download a Ruby package that's written in Python, or would that be like uh could happen benignly?

Paul McCarty 19:00

I mean, I think there are a lot of like NPM, like a lot of NPM packages pull all kinds of other stuff, you know, so binaries and other code. I think it's a signal. I wouldn't say it's a high quality signal. I think it's a signal you're gonna look at with other things. But in this particular case, there's a lot more high-quality signals that you saw before that, in the sense that you know, that first stage, that second stage, when it's calling out to these additional things and it's pulling files, that is a very, very clear signal. You know, yar, even simplistic yar rules will be able to find this stuff for you really quickly, looking for these fetches and the axios calls and what have you, or the equivalent. Sorry, the equivalent. This is Ruby, so the equivalent. Um, so you know, then you combine that high-quality signal with then the fact that it is in another language, you know, those things together they start to add up.

Jenn Gile 19:50

Well, in addition to what we've talked about, it does uh clipboard hijacking. So, you know, of concern when a cryptocurrency address is detected on the clipboard, they exfiltrate it and they actually replace it with a corresponding operator wallet. Um it also is uh wallet vault and secret harvesting, so reading off the uh ecosystems it's looking for here. Uh Tron Link, MetaMask, Phantom, Binance, Coinbase, Trust Wallis, Wallet, uh, Exodus, Electrum. So pretty broad range of um uh crypto ecosystems that could get hit by this.

Paul McCarty 20:36

Yeah, I mean, it was hitting all the big ones, um, you know, BitGet among them, who is you know having a hard couple of weeks, but um yeah, it's it's it's pretty typical. When we um when we were tracking the DPR case stuff, you know, they initially were looking at something like I don't know, six or seven um uh different companies and exchange. They were looking for the Chrome extensions, and there's all this kind of like infrastructure that you could tell that they're looking for this stuff. And it went from like seven to like 16 to 28 to 35, and you know, so they just kept looking for more and more and more and more is more of these uh extensions and and um you know the way that people interact with their with their crypto assets as more of those became popular, you know, DPRK and other threat reactors just kept swallowing them up, swallowing them up.

Jenn Gile 21:24

Yep.

unknown 21:24

Yeah.

Jenn Gile 21:25

Yeah, and just looking at the uh malicious gems here, the typos squats definitely are not sophisticated and remind me a lot of some of the other Ruby attacks we've seen over the summer. However, the brand jacking generic utility names, these resonate a little bit more as efforts to uh, you know, name something in a smart way that somebody might actually choose on purpose rather than relying on the you know keyboard fat finger. You know, we've got things for Ethereum. Uh Bitcoin, and you know, we've got a crypto key utils, like there's there's these look more legitimate. So I see a bit more maturity with the way this threat actor decided to approach this campaign. Um something I haven't dug into yet in our data, and maybe I'll do that after we're uh done today. But I know it's not my imagination. I think Ruby is seeing perhaps the highest um velocity compared to previous months and years of malware. Uh, it does seem like attackers are starting to not necessarily shift focus because we certainly still see it in NPM, but uh nobody was talking about Ruby malware before the summer.

Paul McCarty 22:51

Right. Yeah. And you know, I you and I have quite the relationship now with the RubyGems people because we keep disclosing things. I mean, like I like I the speed dial. Hey guys, you got another one. Um but um you're right, and it's not like there's a corresponding drop in npm or pipy volume, it's just now there's an increased volume in RubyGems, and we're seeing that everywhere. Same thing with VS Code and all these other places, as but bad guys realized. I mean, part of it is what we're talking about, the portability. They're like, oh shit, you know, I've got this, I've got this stager over here and this this rat uh in Python, I'll just load it in npm. Oh, you know what? Actually, I'll do the same thing in RubyGems, why not? And these dependency confusion attacks like are again, if we just look at it like nobody's gonna be stupid enough to take, you know, uh gems install, you know, bitcoin spelled with O in the I backwards. No, it's like you know, you grab something, you cut and paste something from somewhere else, or it's in some automation, or the AI misspells it, or whatever. You know, a lot of it is AI, you can blame it on AI ultimately, right? Um, one thing I noticed though is that red actors don't know how to use linters because like they just always leave their comments in there, and the comments are so they're all always in English, or almost always in English. Occasionally you'll see Chinese comments, or you know, I've seen Vietnamese and Chinese and Thai and stuff, but other than that, they're almost always in English, and they just explicitly say, here's the payload right here. Make sure that you know it's just like so the signposts are very clear. We're gonna start seeing like linters and tools coming out from people, um uh you know, like bad guys, right? Which I think is great because we can then we can use those things as watering holes.

Jenn Gile 24:40

But um well, you said something that I think is worth bringing up with this particular campaign. So the previous uh Ruby campaign we talked about with Gemstuffer, we found it in Ruby first. It turned out it also hit NPM at the same time. Uh, haven't necessarily seen evidence that this one made an effort to be cross-ecosystem, but to your point that I don't know if you were explicitly making or not, it's possible that they've tried this previously in a different ecosystem, like PiPi, perhaps had mixed results, decided to give it a go over in Ruby.

Paul McCarty 25:17

Yeah, exactly. I wouldn't be surprised. I don't actually know that.

Jenn Gile 25:21

No, but that's this is a pure hypothesis here, but given the behavior we've seen, wouldn't surprise me.

Paul McCarty 25:28

Yeah, and and looking at the fact that they're two different languages and they're totally distinct things, right? Like it's not, it doesn't take a genius to say, you know, that PyPy stuff is probably pre-existing, they probably used it over in PyPy, you know.

Jenn Gile 25:41

Well, and you know, I saw something interesting the other day, and I can't even remember the source, so I'm sorry, maybe you will recognize this, but that there is uh an increase in AI tools getting confused about which ecosystem something exists in. And this kind of relates to the sloping stuff. You know, there's a legitimate npm package, it makes an assumption that it's available over in Ruby. Who knows? Maybe all these package names exist legitimately in another ecosystem, and this is uh an effort at slop squatting.

Paul McCarty 26:16

Yeah, that was the podcast with Josh Pressers and uh that's right. That was open source security.

Jenn Gile 26:20

I wasn't making it up.

Paul McCarty 26:22

No, you were not. Um I can't remember what I had for dinner last night, but I can remember every podcast that I've ever freaking listened to and all the content they're in. Um, but yeah, I mean, I think that um uh oh my gosh, what was the what was the point that he was trying to make that you brought up there?

Jenn Gile 26:40

I'm oh it was the either slop squatting is perhaps getting more uh effective as a strategy because AI tools are making assumptions about things existing in other ecosystems. And that's that's uh like it makes total sense when you say it out loud. It's not something I've given a lot of thought to when we talk about slopping, but uh I I buy it.

Paul McCarty 27:05

Yeah, in particular, he mentioned um he mentioned the the requests, right? Which is the famous Python library. Um and the fact that you're seeing, you know, instead of Axios, you're seeing rat you know, requests over in the JavaScript world and you're seeing fetch. So basically, slop squatting absolutely is encouraging this kind of cross-ecosystem naming kind of confusion that we're seeing. Um which is which is very I mean, the thing is that the people generating code now don't really know the code like they did five years ago or 10 years ago because it's being vibe coded for us, right? And so because of that, a lot of this stuff is lost to the person that's actually sitting in front of the keyboard. Uh, the distinction there is lost on the human. Um, so the AI doesn't know. It's like, let me just go and look for it. Oh, hey, look, it exists. Oh, look, it looks like it does right what I want it to do. Sweet as happy days, let's install it.

Jenn Gile 28:01

Yep. Bad times bad times all around. All right. Well, I think that reaches the end of our list. Um, anything you want to add before we wrap up? I think next week we may be recording at a different time. Uh, we'll see you and I have to work that out with my travel schedule, but uh we'll be around the next couple of weeks for sure.

Paul McCarty 28:22

Yeah, cool. Yeah, I mean, I'm I'm chilling until RuCon, which I'm looking forward to in um Google RuCon in November. So I'm just chilling here and uh you're gonna be busy. So happy days.

Jenn Gile 28:34

Well, I mean, I would love an excuse to get down to Australia. Google, if you want to buy me a ticket, happy to have to come.

Paul McCarty 28:42

I feel like they can probably afford it.

Jenn Gile 28:44

I think they could. Um, we have a Google Workspace account, right? That seems like it should be.

Paul McCarty 28:49

We do. I've got a bunch. I got a collection.

Jenn Gile 28:54

On that note.

Paul McCarty 28:55

On that note. Not looking for handouts.

Jenn Gile 28:57

Thank you. Have a good luck.

Paul McCarty 28:58

See everybody. Hey, we'll take handouts. We'll take handouts.

Jenn Gile 29:01

Yeah, yeah, yeah. Let's not let's not be crazy here. We'll totally take them. All right, bye.

Paul McCarty 29:06

Bye, everybody. See ya.