How DPRK Drained $28550M from Drift — and Got Into Your Device First

Transcript

All right, I'm here with my co-host Taylor Monahan, security expert, and Luka Nets, dog enjoyer. Um we are uh Yeah, we're we've got some wild stuff uh to talk about today. I think the first thing that we need to jump straight into basically is uh Drift Protocol hack. Um It's sitting at 250 million plus right now. Is that right, Tay? Uh yeah. Yep. It's a lot of money. It's a lot of money. Um so so uh Tay and I were talking about this um before we started um and I was like it's not really a postmortem yet. It's

like a active mortem or like a uh something. So so we don't know um that much, I guess, um about exactly what uh has um has happened here. So uh just probably leading with like there's lots of speculation, um a lot of uncertainty cuz this is like a couple hours old. Um so we will do our best unpack it, but um yeah, again, this is all like somewhat somewhat in flight. Hacks usually this big, the guys just usually just take a 10% white hat fee. I mean, like I don't know how you move 250 million dollars into a bank Well, unfortunately, we we think that this uh probably

I think it's DPRK, right? Tay? Is that where we're at? Ah, it's 2 hours old. I cannot I can't attribute publicly like this. Uh I will say I'll say this. I the second I saw the stuff, I made a lot of calls to get the full set of indicators for recent DPRK stuff to see if we could get more insight. I think especially relevant and like the the thing that's top of mind is obviously the Axios hack happened yesterday. That was DPRK, and that was specifically DPRK who uh is crypto motivated. That entire supply chain attack was the goal is to steal crypto. So the timing feels sus. It feels like that would be very

uh like a That makes sense, but um a lot of times with these things it's it's a bit more complex. Um and just because like you find one easy narrative doesn't mean that that is like the answer. >> What's going on? So sorry, just just to clarify for for you what happened so that so that we're clear about this. Um the reason why the the fact that the Axios hack yesterday So there was a supply chain attack yesterday, um which was uh some DPRK guys who usually are like Zoom focused guys, and they've leveled up a little bit um into

other stuff, which like these guys are not the most sophisticated people um for what it's worth. Like as someone who is has uh you know, has a pen pal um in one of these groups, um they Yeah, like they're not the brightest bulbs in the bulb factory, put it that way. Um and and there's something weird about them being like, "Oh, we now are supply chain attackers." Um so they were able to compromise uh this like huge uh dependency in in like a bunch of stuff, right? Um and we don't yet know how that happened exactly yet.

>> Oh, we it's it's we've talked about it on the show. It's the Zoom calls. Well, now that now I'm more Yeah, now more often it's it's a Teams it's a Microsoft Teams call, but it's exactly the same. So it's the exact same flow that we usually see in crypto um where >> So the scary thing about that >> That's the question is like how the hell >> they get the Axios people on the Zoom >> developers maintainer, yeah. So I mean, the the I think there's two things that are petrifying about that, right? You have to imagine as like an open source maintainer that you are so [snorts] much more susceptible I mean, we we've seen this

uh you know, we saw this with like um Steve Yegge and some of the guys who were building these open source things when crypto people like even just like normal people, not not DPRK hackers, when crypto people turned their attention onto them, they were woefully unprepared for that. Completely unprepared. >> Like they're just not used to the kind of adversarial world where like people are like bashing your door down to try and steal your [ __ ] and like steal your domain names and and handles and all of that stuff, right? So, you know, and these are these are smart dudes who were like completely sideswiped by this, right? So you have to imagine someone who has been like

meticulously maintaining this like core dependency for years is just not used to you know, people trying to break into them. I mean, like of course on some level Of course on some level, you know, these are these are people that understand the um the the kind of I would say immediate security concerns of you are a major dependency of all of this downstream software. So I'm sure they have very good security practices when it comes to deployments and review like all of the like common core things you would have to do. My guess is, maybe I'm wrong, but my guess is they're probably not as

prepared for someone hitting them up on wherever they communicate with each other and pretending to be a VC or something and you know, they've compromised someone's Telegram account or they've compromised someone's email or whatever, and they're like, "Hey, let's have a chat. I love what you're doing." And they're like, "Oh, cool." Yeah. >> Like Zoom calls are fine. It is um it's very similar to crypto in the sense that you have individual people who are actually very smart, very talented, very capable, very computer knowledgeable.

Um they are operating as like sort of loose organizations. These maintainers like they often maybe work for a company, but they also do like, you know, open source software. It's a It's There's a lot of overlaps with crypto. Um and then obviously there's there's there's gaps that are created when you and all your friends and every individual is like very knowledgeable and secure and like tracks the security incidents. Um it mostly happens because they all assume and this happens in crypto, too, but this is even more true in an environment where you're not totally like getting fished all the time. Um you assume like you put in all these these guardrails and all these processes

and all these procedures to ensure that like this has to go here and then this is checked here, and you know, on and on and on. Every time something gets deployed, there's like a whole process. There's a a root assumption though that the person like the the core maintainers, right, which is usually honestly, usually it's one guy, but you know, in in this case there were a few different people that probably had those like the the like the admin rights or had the ability and knowledge to do this. They all assume that their computers, their keys, their everything are are safe.

Just like crypto wallet keys, right? You have keys that exist on your device that give you permission or access or authorization to push to GitHub, to run certain automations, and like build pipelines, and then to deploy. Sometimes these keys are literal keys, like SSH keys, like a private key. More often they're what we call like a session token or short-lived token. It's a It's like a you auth you auth in for 2 weeks or 2 days or 2 hours or whatever.

Either way even if you have like 2FA, like hardware 2FA protecting your authorization into your GitHub account or into your uh NPM account or whatever it is when you authorize, a token is saved to your computer. That token is basically what you use to access these things for however long it is, the next 2 hours, 2 days, 2 weeks. Um if your computer is completely compromised in the way that DPRK compromises computers, that token they take that token and they reuse it. And so now it doesn't matter that you have MFA. It doesn't matter at all. They can just use that to basically literally be you. You won't see attempted logins. You won't

see anything weird happening. Like they'll just go, and they'll they'll do whatever they want. >> so correct me if I'm wrong, right, but like, you know, in crypto we have learned over time that after the fact something weird happens, right? After the fact like we've learned enough to know, "Oh [ __ ] like we should probably lock this stuff down." Is it Is it um Is it possible uh do you have you heard stories of like DPRK guys, the Zoom call guys, Microsoft Teams guys, pulling something like this off where like they have the whole thing, and then the the compromised person doesn't realize that they got owned, or is it like so obvious that like weird [ __ ]

starts happening, or No. So when the when you get off or like you get on the call with them when you get off the call with them, um you sort of just write it off as like the call didn't work. Um and like you experienced difficulties, and like you're busy, and you have another call to go to, and you sort of forget about it. Then they'll sit there for like 2 weeks, 3 weeks, 2 months. They'll come back like 6 months later if you let them. You know You know mean? But people aren't you don't immediately see anything happening. It's not like they're trying to log into your Google and you know, like you're not there's nothing that happens until you literally wake up one morning in the future and like things are just wrecked. And even then the notifications

are other people telling you that you've been compromised. You don't have notifications yourself like any indication that you've been compromised. Can you run malware bites or something to this? Like today like let's say I'm just paranoid and I'm like [ __ ] did I [ __ ] Microsoft? How do I diagnose like my devices with this? So Yeah. After the fact with Axios So basically what they did they they compromised a developer they pushed a malicious version of the code to the Axios package which is a dependency in like a bazillion other packages like all of them.

And so then anyone who installed any of these packages or updated any of these packages or ran like updated or were working on any projects that had these packages [clears throat] in them all those people were compromised. And so one way to think about it is the normal mechanism that they use to compromise people is they get one person on a Zoom call and they make that person run a command and that command then does all this malicious stuff and gives them like full access to the computer. With the supply chain attack when they push that malicious code up the I think it's like a hundred million computers a week download this package, right?

All of those people basically do the same thing but it's automatic it's silent and it's in the background. But it's it's literally the same code that they have you run for the Zoom. It's just now like all over the place. So in response to this like if you're worried about this if you're coding if you have you know if you're doing like NPM run stuff ever you can like Google it you can look at there's like a bazillion blogs on it. There's like a bunch of things that you can check. There's a bunch of different like little indicators. However to more important in my opinion like to prevent this is if you're maintaining software the first thing is like you want to it's called pinning your dependencies. Don't auto update immediately. Right? In the same way that you don't want to like update

like your um you want to like let the your phone do like one version. Right? Get all the bugs out. It's sort of similar to that like you don't want to necessarily [clears throat] pull a dependency and update it the second it's updated. Give it a day. The second thing is um Actually like you can go even further and say we like in in our repo like and this is annoying sometimes cuz you want to push something and and you get blocked. It's like if something's less than seven days old you can't actually have it in there at all.

Yeah. You can literally like say like there's a minimum age that you need for this step for you to even be able to push it in there and like you see it every once in a while like one of my guys is like on slack like I need like I just I need this. Come on this is really important. Give it to me. Yeah. Yeah exactly. Um and then yeah so uh with DPRK malware it's pretty sophisticated they evolve it pretty quickly. As someone who looks at a lot of computers with this malware on it the EBS is not going to detect it. You can run malware bites and stuff. It's very rare that's going to pull it. Um It's terrifying. We've had a few victims

who have SentinelOne which is like an EDR so it's like a more advanced EBS and in the past couple months that hasn't even been detected. So they're in most cases with most malware EBS is like great. You should run your EBS if you're on Windows like Microsoft Defender's great. Mac it's a bit tougher but if you have significant amounts of crypto if you have a company the answer is CrowdStrike. It's EDR it's it's it's going to protect you and they they stay on top of things.

And the way that they sort of like there's two ways to think about protection on devices, right? On endpoints. The first is like let's check a big list of hashes to see if it matches any known malware. Right? But if they change their malware at all it's not going to show up in the hash library and then they're not going to detect it and they're going to be like your computer's clean even though it's not. EDR is let's say like much more fine tuned. And so they don't really they don't sit there and like look at hashes and like stuff like that. They're looking for patterns and activity and behavior that your device is doing that is not normal and should not be done. So things like persistence like some new like persistence showing up randomly.

Open yeah right. Yeah. And like with DPRK they they almost always have what we call a heartbeat ping. It's your device pings out every 60 seconds and asks if there's anything You literally go yo DPRK is there anything you want me to do? And then if they don't get a response it just chills for a minute and then a minute later it wakes back up and is like yo DPRK is there anything you want me to do? It's like open claw for DPRK. >> Literally forever. And then turns out like occasionally DPRK will be like yeah here's a new malicious wallet I'm going to take all your money now.

Bye. That's like literally how it works. So um CrowdStrike and other EDR will protect you here. If you are not in that game my advice for open source developers and for crypto people is always the same. Have a separate device. 100% like like honestly like if you if you're in crypto and you have raised significant money and you do not have a [ __ ] pile of MacBooks sitting around that you are rotating through like literally that. I have that.

I have a couple. Guys this is how you operate guys. Each one of these is for a a different thing that I might need to do at some point.