OpenSea had a malicious NFT problem, a twitch hack update,
and whatsapp officially adds end to end encrypted backups! All that coming up now on ThreatWire.
Greetings!! I’m Shannon Morse and this is ThreatWire for October 19, 2021! This
is your weekly summary of the threats to our security, privacy and Internet freedom. BTW,
THANK YOU to (we have a bunch of new patrons this week!) Zigi, Timothy, Marius, Julian, Hash Wizard,
Isaac, Kads, Munch byte, and Jason for joining this week on Patreon. Patreon.com/ThreatWire
as always to keep this show ad free. If you want a special signed holiday card from me this year,
sign up anytime in October! These cards are limited and only available for supporters,
so once they’re gone, they’re gone. With that, onto the news!!
Researchers at Check Point Research published an analysis on Wednesday detailing how attackers are
using malicious art files to steal cryptocurrency wallets on the digital goods marketplace called
OpenSea. OpenSea is a marketplace for things like NFTs as well as crypto collectibles. This is where
you could buy digital art, photos, videos, audio files, and create your own unique items. It all
works using blockchain technology for verification and ownership validation. According to reports,
OpenSea had $3.4 billion in transactions in August alone. It’s a big thing right now.
Check Point Research discovered that targeted wallet owners
were being offered free NFT gifts or links to art on OpenSea. Targets were being airdropped
freebies and after interacting with said freebies, they’d find their cryptowallets were empty. They
noted that users needed to connect a third party crypto wallet in order to buy or sell
goods on OpenSea. The wallet communicates with it’s back end crypto network. In Check Points
case, they used the MetaMask wallet which communicates with the Ethereum network.
The researchers made a malicious .svg file as an example, uploaded it using a “simple payload”,
and the SVG would be executed if clicked on or opened in another tab or by opening links on
the page. It executes under the storage.opensea . io domain and at this point, would give them
javascript capabilities. The SVG included an iframe that inserted an Ethereum object
on the page where the SVG was sitting. A pop up window would show up on the targets machine
asking for confirmation for the transaction, and once signed by the target, the target
could then interact with the file, all the while a payload gets executed so the attacker can perform
actions as the target. The target’s wallet could be emptied once the transaction is signed.
OpenSea was notified of this issue and warns users that OpenSea “does not request wallet approval for
viewing or clicking third party links. [That] is suspicious and users should not interact with
wallet approvals that are unrelated to OpenSea specific actions”. In other words, if you’re being
asked to sign using your wallet after clicking on an image from a third party, that’s a red flag.
The full technical write up can be found on Check Point Research’s blog.
Twitch has updated their official statements about the hack they experienced earlier this month.
According to the company, an attacker gained access to data on their servers due to a
faulty configuration change that exposed it to the internet. This data was accessed by
a malicious third party and an investigation was ongoing. They also stated at the time that
credit card numbers were not exposed nor were login creds. Twitch did reset all stream keys.
A few days ago, they made another update, saying that passwords were not exposed and
they were confident login credentials, which are hashed with bcrypt weren’t accessed,
and repeated that cc numbers weren’t exposed, nor was ACH or banking info.
They confirmed that the source code repository and payout data was exposed. According to the leaker,
who posted the data online, that included about 6000 internal Twitch Git repositories.
That included commit history for years, twitch clients source code,
proprietary SDKs, twitch owned properties including a steam competitor that is unreleased,
red team tools and again, creator payouts from 2019 to now. Some creators did post
on social media that the data for their own payouts was indeed accurate.
Twitch’s update does not line up with what some security researchers have detailed.
According to data shared with PrivacySharks and ThreatPost,
personal information of users was breached, using an example showing code that included
an email address and a password in plain text. Details also contained over 1000 chargebacks
that were made from Twitch to a variety of platforms which indicate the amount,
full name, email address and any comments. This portion also includes Twitch employee data.
Whether Twitch user credentials were leaked or not, go in an update your login username
and password, turn on 2FA, reset your keys and keep an eye out for anything sus. This
could be a major blow to twitch given it included source code and we’ll potentially see more leaks
come from this as well. Props to my Alliance member Joel for providing info for this story.
I love it when y’all send me these adorable pictures of your pets so these are a few from
my hush puppy Patreon Alliance members. You can always support this content and
keep it ad free for as little as $2 / month, and get a slew of perks at the same time,
including that holiday card! Each alliance member gets over 10 perks as soon as you
sign up at patreon.com/threatwire. With that, now onto the third story.
I don’t use WhatsApp but I know a lot of folks that do, so hopefully this news will
be useful to y’all! According to a blog post, WhatsApp is starting to roll out their end to
end encrypted backups for you to store on your cloud provider, whether that’s Google Drive or
iCloud. This means that your messages, any media, including voice messages, as well as
video calls and chat backups can all be stored encrypted. Backups aren’t required, and neither
is the encrypted option. You have to manually turn this on yourself in order to use the new feature.
WhatsApp originally shared this info a few months back but it’s now
officially rolling out. In order to implement end to end encrypted backups, you have
two options as a user. Either you can secretly store a copy of your 64 digit key manually
(like you could print it out and store it in a safe or back it up to your password manager,
etc), and you would need to re enter it if you ever need to restore your backup,
OR the key could be stored via WhatsApp’s infrastructure called their Backup Key Vault,
which you could access via a user created password. WhatsApp would also save your key
through multiple data centers to ensure that if one caught fire, you’d still have access to it.
They also mention they’d know the key exists but wouldn’t have access to the key in the vault.
WhatsApp is rolling this out to both iOS and Android. By using encrypted backups, if you
ever need to restore your old messages and data to a new phone, you’d simply need to enter that
security key to gain access to them. Conversations on WhatsApp are end to end encrypted, but since
backups never were before this, that means they were only as secure as your backup provider. So,
for example, if your Google account was accessed by someone who knows your Google password,
they could get your backups from your Google Drive without any encryption. Your Google
account would also need to be better protected, like implementing 2 factor authentication.
To enable E2EE backups, open WhatsApp, click Settings, click Chats, Chat Backup,
End to End Encrypted Backup. Click Continue, and follow the on screen prompts. Hit Done and
wait a bit for the backup to be created. You can disable it by going into the same settings menu.
This week I’ll be covering all the news on the new Google Pixel 6 and 6 Pro and sharing
my studio tour over at youtube.com/ShannonMorse. Check out my channel for that video. Don't forget
to like and subscribe to this channel as well! I'm Shannon Morse, I'll see you on the Internet!