<img src="https://miro.medium.com/v2/resize:fit:700/0*PQlb-E-ZiNNAlyD0" /><h2 id="header-0">Update(2023/09/21):</h2>We double checked our monitoring data, <a href="https://twitter.com/realScamSniffer" rel="noopener noreferrer nofollow">&#64;realScamSniffer</a> ’s monitoring data and Balancer’s description, this is not a certain BGP hijacking. The coincidence of time puzzled us. We look forward to Balancer’s final post-mortem report.<h2 id="header-1">Background</h2>On September 20, 2023, our security team indicated that Balancer.fi fell victim to a BGP (Border Gateway Protocol) Hijacking attack. Users who accessed the platform via the compromised link found their wallets were at risk of phishing attacks.<img src="https://miro.medium.com/v2/resize:fit:700/0*_B_d5RfCvz3cy013" />Upon receiving the alert, we promptly launched an in-depth investigation. According to CloudFlare’s BGP Origin Hijack alert number 17957, the list of affected Autonomous System Numbers (ASNs) includes AS13335, which is associated with Balancer.fi. When the attack was ongoing, access to the phishing site would trigger a phishing security warning issued by CloudFlare.<h2 id="header-2">Detailed Analysis:</h2><ol><li>A query was conducted for the DNS resolution records of the Balancer.fi domain (<a href="https://bgp.tools/dns/balancer.fi" rel="noopener noreferrer nofollow">https://bgp.tools/dns/balancer.fi</a>). The A records indicate IP addresses 104.21.37.47 and 172.67.203.244. Both of these IP addresses are registered under the Autonomous System (AS) number AS13335, which is managed by CloudFlare.</li></ol><img src="https://miro.medium.com/v2/resize:fit:700/0*h1HyWz6PI_2s-yFB" />2. Based on CloudFlare’s official records available at (<a href="https://radar.cloudflare.com/routing/anomalies/hijack-17957" rel="noopener noreferrer nofollow">https://radar.cloudflare.com/routing/anomalies/hijack-17957</a>, AS13335 is identified among the list of Autonomous Systems (AS) compromised by the BGP Origin Hijack attack.<img src="https://miro.medium.com/v2/resize:fit:700/0*uVnZsAnyVId6vGXs" />3. It was revealed that the HTTPS certificate for Balancer.fi had been swapped out for a certificate controlled by the attacker.<img src="https://miro.medium.com/v2/resize:fit:700/0*H1EdLnorFs-2rDF3" />4. The problem has now been fixed, but before it was fixed, attempting to access <a href="https://app.balancer.fi/" rel="noopener noreferrer nofollow">https://app.balancer.fi</a>, would encounter a phishing security warning issued by CloudFlare.<img src="https://miro.medium.com/v2/resize:fit:700/0*5Wyxe98OOHzJt1fV" />5. Upon further analysis, it was revealed that the front end of app.balancer.fi contains malicious JavaScript code, specifically located at <a href="https://app.balancer.fi/js/overchunk.js" rel="noopener noreferrer nofollow">https://app.balancer.fi/js/overchunk.js</a>.<img src="https://miro.medium.com/v2/resize:fit:700/0*KGTq2ctrhlboWkv6" />6. Once users connects their wallets to the app.balancer.fi platform, the rogue script automatically assesses the users’ account balances and initiates a phishing attack.<img src="https://miro.medium.com/v2/resize:fit:700/0*bwNA-zJZHUjjv0me" />7. Upon dissecting the malicious JavaScript file, the following nefarious addresses were identified:0x00006DEAcd9ad19dB3d81F8410EA2B45eA5700000x645710Af050E26bB96e295bdfB75B4a878088d7E0x0000626d6DC72989e3809920C67D01a7fe030000The SlowMist security team would like to inform users that the previously reported BGP attack targeting Balancer has been addressed. However, as a best practice for maintaining your security, we strongly recommend remaining vigilant and cautious when interacting with any platform. Always ensure you are on the legitimate site and double-check any security prompts or alerts you may encounter.<h2 id="header-3">Recommended Solutions:</h2>Implement Custom Monitoring: Develop your own monitoring systems that alert you to any BGP changes within your private network segments.Leverage SlowMist’s MistEye: This comprehensive security monitoring solution offers both on-chain and off-chain surveillance. Its capabilities extend to frontend and backend monitoring, certificate verification, and more. It allows for real-time alerts upon detecting any anomalous changes in web pages, JavaScript, or certificates.Opt for Industry-Leading Solutions like Akamai: Akamai provides a robust global BGP monitoring service backed by big data analytics. This allows clients to closely monitor BGP changes in their designated network ranges, ensuring timely identification and resolution of security issues.<h2 id="header-4">Concluding Remarks:</h2>Following a thorough analysis by our security experts, the incident was conclusively determined to be a targeted BGP Hijacking attack against Balancer.fi. The attackers adeptly orchestrated various tactics including careful timing, certificate forgery, and AS control, executing them seamlessly.A critical takeaway is that while many network operators are well-versed in the risks of BGP Hijacking and have taken adequate countermeasures, the same can’t be said for numerous project teams. Many lack a full understanding, particularly concerning the risks introduced by AS changes leading to altered network paths. Given this, the likelihood of similar attacks occurring in the future remains high.Therefore, SlowMist’s security team strongly advises project managers, internet service providers, and server hosting companies to be fully aware of such risks and to collaborate in creating a robust defense strategy. This proactive approach is essential to preclude the recurrence of such incidents. Should you require expert guidance, SlowMist’s security team is readily available for consultation.Related Links:<a href="https://blog.cloudflare.com/rpki/" rel="noopener noreferrer nofollow">https://blog.cloudflare.com/rpki/</a><a href="https://medium.com/&#64;slowmist/truth-behind-the-celer-network-cbridge-cross-chain-bridge-incident-bgp-hijacking-52556227e940" rel="noopener noreferrer nofollow">https://medium.com/&#64;slowmist/truth-behind-the-celer-network-cbridge-cross-chain-bridge-incident-bgp-hijacking-52556227e940</a><h3 id="about-slowmist">About SlowMist</h3>SlowMist is a blockchain security firm established in January 2018. The firm was started by a team with over ten years of network security experience to become a global force. Our goal is to make the blockchain ecosystem as secure as possible for everyone. We are now a renowned international blockchain security firm that has worked on various well-known projects such as Huobi, OKX, Binance, imToken, Crypto.com, Amber Group, Klaytn, EOS, 1inch, PancakeSwap, TUSD, Alpaca Finance, MultiChain, Cheers UP, etc.SlowMist offers a variety of services that include by are not limited to security audits, threat information, defense deployment, security consultants, and other security-related services. We also offer AML (Anti-money laundering) software, Vulpush (Vulnerability monitoring) , SlowMist Hacked (Crypto hack archives), FireWall.x (Smart contract firewall) , Safe Staking and other SaaS products. We have partnerships with domestic and international firms such as Akamai, BitDefender, FireEye, RC², TianJi Partners, IPIP, etc.By delivering a comprehensive security solution customized to individual projects, we can identify risks and prevent them from occurring. Our team was able to find and publish several high-risk blockchain security flaws. By doing so, we could spread awareness and raise the security standards in the blockchain ecosystem.Website&#xff1a;<a href="https://www.slowmist.com/" rel="noopener noreferrer nofollow">https://www.slowmist.com</a>Twitter&#xff1a;<a href="https://twitter.com/SlowMist_Team" rel="noopener noreferrer nofollow">https://twitter.com/SlowMist_Team</a>Github&#xff1a;<a href="https://github.com/slowmist/" rel="noopener noreferrer nofollow">https://github.com/slowmist/</a>

Analysis of Balancer BGP Hijacking Incident

Table of Contents

SlowMist

Other articles published on Sep 21, 2023

Authors Guild v. OpenAI copyright infringement lawsuit takes a new turn

HLN Stock Price: Bears Gave up After the Reinforcement of 50 EMA

Will TON’s Deepening Roots in Telegram, Help In Surging Upwards ?

🗒 Daily Newsletter | Thursday, September 21, 2023

Ex-Banker Pleads Guilty to Cryptocurrency Fraud

Crypto prices barely stir as Fed leaves interest rates unchanged

Join our free newsletter for daily crypto updates!