Malware-laced Rust packages on Crates.io stealing crypto wallets

[fullfitlarry]

A cyber researcher recently discovered two malicious packages with ~8500 downloads in Rust official crate repository that targets to steal  steal cryptocurrency private keys.


The two crates are:

Code:

faster_log 
async_println

In the explanation, it says that the two crates that mimics the legitimate ‘fast_log’ crate. Even going as far as copying everything, from README file, repository metadata. So that it won't raise any suspicion.

And then the payload is hidden, and once it is executed, it will scanned the victims environment with the following,

• Hex strings that look like Ethereum private keys
• Base58 strings that resemble Solana keys/addresses
• bracketed byte arrays that might hide keys or seeds

https://socket.dev/blog/two-malicious-rust-crates-impersonate-popular-logger-to-steal-wallet-keys

So if you are a developer, just be careful on using packages like Rust Crates or npm for Javascript and any other repositories.

[Yaunfitda]

Just like in many of it's counterpart like NPM as you have mentioned, this kind of package has also been taken advantage of hackers and criminals. So those who put up packages or pull it out has the disadvantage because you really don't know what package it is. Maybe the devs is well known and has the reputation. But this criminals are smart enough to copy everything so that we won't suspect anything. And again, we need to really separate our laptops we used for developing and just buy a hard ware wallet and put our crypto in their so that we will not be compromise with this kind of attacks.

[TravelMug]

That's also the haven for cyber theft, but not sure how this fake packages can get inside without them noticing it.

They should have like a filter or something, before someone can deploy any packages, they should have at least be quarantine and see if it is harmful or not or for whatever purpose it should be before rolling it out in the public.

Just like in this case, it has been downloaded a lot and most likely someone could have fallen from it.

[cSentinentyZ]

People should know that if they want to protect their crypto, they should use a cold wallet. Hackers are still existing because they are seeing people to scam. If people start to us cold wallets, the possible of scammers to scam will reduce.

People should avoid to download anything from unknowing sources, this will also be helpful.

[Rustam Meraj]

Just like in many of it's counterpart like NPM as you have mentioned, this kind of package has also been taken advantage of hackers and criminals. So those who put up packages or pull it out has the disadvantage because you really don't know what package it is. Maybe the devs is well known and has the reputation. But this criminals are smart enough to copy everything so that we won't suspect anything. And again, we need to really separate our laptops we used for developing and just buy a hard ware wallet and put our crypto in their so that we will not be compromise with this kind of attacks.

That is very important security risk which you mentioned hackers using fake software packages to attack people. These criminals are very smart and can make fake packages that look exactly like real ones. This makes it hard to know if program is safe. Your idea of using separate computer for your work is perfect solution. But most important thing is to use hardware wallet. This device keeps your crypto keys offline so even if your computer is hacked criminals can not get to your money. These simple steps are best way to protect your crypto from online attacks.

[tabas]

People should know that if they want to protect their crypto, they should use a cold wallet. Hackers are still existing because they are seeing people to scam. If people start to us cold wallets, the possible of scammers to scam will reduce.

People should avoid to download anything from unknowing sources, this will also be helpful.

Hackers are going to exist whether we like or not, they are there to stay as well. We use cold wallets, hardware wallets, desktop wallets, etc. It's best to protect ourselves by being careful on how we use the internet and what apps, websites that we visit and we grant permission by downloading. While this specific malware is targeting specific users too, the developers that are also in crypto. Technically, they might not notice it but I hope that those who uses this website will see the warnings.

[btc_angela]

People should know that if they want to protect their crypto, they should use a cold wallet. Hackers are still existing because they are seeing people to scam. If people start to us cold wallets, the possible of scammers to scam will reduce.

People should avoid to download anything from unknowing sources, this will also be helpful.

Hackers are going to exist whether we like or not, they are there to stay as well. We use cold wallets, hardware wallets, desktop wallets, etc. It's best to protect ourselves by being careful on how we use the internet and what apps, websites that we visit and we grant permission by downloading. While this specific malware is targeting specific users too, the developers that are also in crypto. Technically, they might not notice it but I hope that those who uses this website will see the warnings.

Exactly, we've seen that they can hack anything even hardware wallet if we are not that careful. The best thing to do is to learn and read how this hackers are attacking and what method and just like here, software packages that are in the public that anyone can download.

So even if the website is trusted, we still need to be very careful not to download anything. Yes, hopefully those sites right now that is under attack should see that they are now in the cross hair of the hackers to they will need to up their game.

[tabas]

People should know that if they want to protect their crypto, they should use a cold wallet. Hackers are still existing because they are seeing people to scam. If people start to us cold wallets, the possible of scammers to scam will reduce.

People should avoid to download anything from unknowing sources, this will also be helpful.

Hackers are going to exist whether we like or not, they are there to stay as well. We use cold wallets, hardware wallets, desktop wallets, etc. It's best to protect ourselves by being careful on how we use the internet and what apps, websites that we visit and we grant permission by downloading. While this specific malware is targeting specific users too, the developers that are also in crypto. Technically, they might not notice it but I hope that those who uses this website will see the warnings.

Exactly, we've seen that they can hack anything even hardware wallet if we are not that careful. The best thing to do is to learn and read how this hackers are attacking and what method and just like here, software packages that are in the public that anyone can download.

So even if the website is trusted, we still need to be very careful not to download anything. Yes, hopefully those sites right now that is under attack should see that they are now in the cross hair of the hackers to they will need to up their game.

Yes, there is a tendency that the official website unknowingly has replaced the package to be downloaded by its users. And so, be vigilant and always verify things. Because it's going to be too late if we find out that we've been a victim already. And we don't want to get into that point. Coming from apps, browser extensions that we use, everything that's executable, check them always.

[tech30338]

if they have downloaded that much meaning the hackers are already in control with those computers, and its only a matter of time before those computers spread the virus, even if they discover that they have downloaded the software its too late, the hacker may have already in control and just waiting for the perfect time, the problem is if the virus is currently not detected since the antivirus don't know the signature, they already dig deeper in the system, and this might compromise a bigger system in the future.

[cSentinentyZ]

Yes, there is a tendency that the official website unknowingly has replaced the package to be downloaded by its users. And so, be vigilant and always verify things. Because it's going to be too late if we find out that we've been a victim already. And we don't want to get into that point. Coming from apps, browser extensions that we use, everything that's executable, check them always.

Most websites does not have PGP signatures that can be used that a file really belongs to the original people that owns the website. I have only noticed just open source wallets that only support bitcoin that have the signatures. If a website does kotnhave the signature, there is no way you can know that the file on the site to download has not been replaced by hackers.

[joniboini]

If a website does kotnhave the signature, there is no way you can know that the file on the site to download has not been replaced by hackers.

True. I wonder if we have a website or database where users submit a hash of a file manually as a way to cross-check download files. I know the responsibility should lie with the company to provide that stuff, especially with the possibility of scammers uploading misleading hash. I'm just curious if someone has built a tool like that. Another option is to use malware scanner to check them I guess (other than making sure you visit the right website, double checking on social media, etc).

[tabas]

Yes, there is a tendency that the official website unknowingly has replaced the package to be downloaded by its users. And so, be vigilant and always verify things. Because it's going to be too late if we find out that we've been a victim already. And we don't want to get into that point. Coming from apps, browser extensions that we use, everything that's executable, check them always.

Most websites does not have PGP signatures that can be used that a file really belongs to the original people that owns the website. I have only noticed just open source wallets that only support bitcoin that have the signatures. If a website does kotnhave the signature, there is no way you can know that the file on the site to download has not been replaced by hackers.

That's right, so it's hard for a user to check it if the downloadable file there is going to be an official one. So, if by any chance there are PGP signatures that can be verified there, much better. But if not, still make sure to check out some updates if there's something wrong or something that has happened to that website recently. But since this malware is specific on crates, always verify and that's the best that we can do about it.

[Taskford]

If a website does kotnhave the signature, there is no way you can know that the file on the site to download has not been replaced by hackers.

True. I wonder if we have a website or database where users submit a hash of a file manually as a way to cross-check download files. I know the responsibility should lie with the company to provide that stuff, especially with the possibility of scammers uploading misleading hash. I'm just curious if someone has built a tool like that. Another option is to use malware scanner to check them I guess (other than making sure you visit the right website, double checking on social media, etc).

I don't know this is working since I never tried to use this site as I have no interest to click any random link or even shortened links for security purposes.

But if people want to check if the link they are downloading maybe they should try to use this sites to check if the files they are trying to download is not contaminated by malwares.

www.virustotal.com

opentip.kaspersky.com

www.hybrid-analysis.com

Proper verification is important since its hard to regret late and experience losses due to this malwares.

[Cookdata]

People should know that if they want to protect their crypto, they should use a cold wallet. Hackers are still existing because they are seeing people to scam. If people start to us cold wallets, the possible of scammers to scam will reduce.

People should avoid to download anything from unknowing sources, this will also be helpful.

Hackers and scammers are not getting their ways because the see people, they are doing it because people refused to learn the basic things and doesn't want to learn. If you are too lazy to protect your asset and your privacy then you risk losing everything you have even with the hardware wallet. If for instance a hardware wallet can protect you from online but online you have a very weak privacy culture, people can get access to your hardware wallet offline.

I have seen countless of reports of hardware wallets complaints on r/hardware wallets, most often it's not about the company but it's how the users keep their wallet. I have seen someone complain about his friend stealing his coins because a friend got access to it because he was able to monitor the encryption pin. Some backup their seed phrase on open place, protect their self offline only to exposed everything to their friends, you see it's not about wallet but it's always about the people.

[btc_angela]

If a website does kotnhave the signature, there is no way you can know that the file on the site to download has not been replaced by hackers.

True. I wonder if we have a website or database where users submit a hash of a file manually as a way to cross-check download files. I know the responsibility should lie with the company to provide that stuff, especially with the possibility of scammers uploading misleading hash. I'm just curious if someone has built a tool like that. Another option is to use malware scanner to check them I guess (other than making sure you visit the right website, double checking on social media, etc).

I don't know this is working since I never tried to use this site as I have no interest to click any random link or even shortened links for security purposes.

But if people want to check if the link they are downloading maybe they should try to use this sites to check if the files they are trying to download is not contaminated by malwares.

www.virustotal.com

opentip.kaspersky.com

www.hybrid-analysis.com

Proper verification is important since its hard to regret late and experience losses due to this malwares.

I don't think that virustotal will work in this kind of attacks though because it will have to go inside the website and maybe it will not be allowed so everything that virustotal will see might be false positive or negative.

But I do agree that certain restrictions should be implemented by this packages websites as now they are prone to this kind of attacks. Even the original developer might not be aware that someone has imitated everything and uses the code to harm people.

So it's a very very risk now to just download anything even if the package sites are the built it trust and reputation already.

[joniboini]

I don't think that virustotal will work in this kind of attacks though because it will have to go inside the website and maybe it will not be allowed so everything that virustotal will see might be false positive or negative.

Isn't it common that open source packages are free to download without a login or something similar? My experience is limited to GitHub, so I can't comment on others. It is possible to download a package from the command line before you install it, although I don't think it's a good practice to download random packages in the first place, especially with no verification. As always, being extra careful won't hurt. CMIIW.

[RockBell]

People should know that if they want to protect their crypto, they should use a cold wallet. Hackers are still existing because they are seeing people to scam. If people start to us cold wallets, the possible of scammers to scam will reduce.

People should avoid to download anything from unknowing sources, this will also be helpful.

And that is one of the main reason why before they invest they should be prepared to know how to avoid anything that will turn anyone into prey and I don't think hackers will stop too because they are still making money and people are still falling victim so they will continue to try there luck. And I think people need to start using wallets with good reputation and know things to avoid.

And when you try to down from an unknown source the phone start giving warning of the download but people just choose to ignore. And this is for the safety of there assets but some people will eventually learn from experience just that being a victim is not going to be a nice experience at all.

[EluguHcman]

People should know that if they want to protect their crypto, they should use a cold wallet. Hackers are still existing because they are seeing people to scam. If people start to us cold wallets, the possible of scammers to scam will reduce.

People should avoid to download anything from unknowing sources, this will also be helpful.

Hackers are going to exist whether we like or not, they are there to stay as well. We use cold wallets, hardware wallets, desktop wallets, etc. It's best to protect ourselves by being careful on how we use the internet and what apps, websites that we visit and we grant permission by downloading. While this specific malware is targeting specific users too, the developers that are also in crypto. Technically, they might not notice it but I hope that those who uses this website will see the warnings.

In other words to what you have said @tabas, the vulnerable for wallets to be hacked depends depends on how users tends to store their seed phrases and private keys, how devices is handled where Privacies does not have to be compromised by third parties who gets reach to your device and lastly is how users navigates the internet using same device with your wallet.

So this is not about using cold or hot wallets. You can still use cold wallet and get your wallet at risk. If not for internet hacking but alternatively of thefts targeting your seed phrase and uses it to have access to your wallet.

[Yaunfitda]

Perhaps there are still a lot of crypto newbies that are developers who didn't look at everything and not verify and so that could be the reason that they will fall for it. And that is that is why it's very dangerous for everyone to simply just click and download and extract and think that everything is fine. The basic tenant is that we should not trust anyone in the world that we live it. Might be better if we have a print out in front of us so that it will remind us that dangers of downloading and using someone's package or any email for that matter. I would recommend that to everyone, that kind of simply practice might save us in the future.

[AVE5]

People should know that if they want to protect their crypto, they should use a cold wallet. Hackers are still existing because they are seeing people to scam. If people start to us cold wallets, the possible of scammers to scam will reduce.

People should avoid to download anything from unknowing sources, this will also be helpful.

It's also important to note that not all chain supply brands are reputable to keep our privacies and funds safe and if we must empathize on cold wallets due to it offline connectivities, we also need to be aware that some of these hardware developers are liable to compromise and disguises to be legitimate.
So I also hope we don't assume the cold wallet is a total free from threats of loosing our funds. Therefore, wallets are regarded best safe guarded dependently according to the users terms.