Medium

Read

/send

<div class="protos">
 <div>
  <div>
   <div>
    <p>Researchers at Guardio Labs have discovered a new attack known as ‘EtherHiding,’ which uses Binance Smart Chain and Bullet-Proof Hosting to serve malicious code within victims’ web browsers.</p>
    <p>Unlike an earlier suite of fake update hacks that exploited WordPress, this variant uses a new tool: <strong>Binance’s blockchain</strong>. Earlier, non-blockchain variants interrupted a webpage visit with a realistic-looking, browser-styled ‘Update’ prompt. A victim’s mouse click installed malware.</p>
    <p>Due to the cheap, fast, and poorly policed programmability of Binance Smart Chain, hackers can serve a devastating payload of code directly from this blockchain.</p>
    <p>To be clear, this is not a MetaMask attack. Hackers simply serve malicious code inside victims’ web browsers that looks like any webpage that the hacker wants to create — hosted and served in an unstoppable manner. Using Binance’s blockchain to serve code, hackers attack victims for various extortion scams. Indeed, <strong>EtherHiding even targets victims with no crypto holdings</strong>.</p>
    <figure class="wp-block-embed is-type-wp-embed is-provider-protos wp-block-embed-protos">
     <div class="wp-block-embed__wrapper">
      <blockquote class="wp-embedded-content" data-secret="c0VzKkotNI">
       Government sites targeted by MetaMask scam
      </blockquote><iframe class="wp-embedded-content" sandbox="allow-scripts" security="restricted" style="position: absolute; clip: rect(1px, 1px, 1px, 1px);" title="“Government sites targeted by MetaMask scam” — Protos" src="https://protos.com/government-sites-targeted-by-metamask-scam/embed/#?secret=NnK18JGxzD#?secret=c0VzKkotNI" data-secret="c0VzKkotNI" width="500" height="282" frameborder="0" marginwidth="0" marginheight="0" scrolling="no"></iframe>
     </div>
    </figure>
    <p><em>Read more: Reuters hints at ‘dark secrets’ surrounding Binance and its reserves</em></p>
    <h2 class="wp-block-heading" id="hijacking-the-browser-to-steal-your-information">Hijacking the browser to steal your information</h2>
    <p>Within the past few months, fake browser updates have proliferated. Unsuspecting internet <a rel="noopener noreferrer nofollow" title="users" href="https://thebittimes.com/tag/users.html">users</a> encounter a believable, secretly compromised website. They see a fraudulent browser update and absentmindedly click ‘Update.’ Immediately, <a rel="noopener noreferrer nofollow" title="Hack" href="https://thebittimes.com/tag/hack.html">Hack</a>ers install malware like RedLine, Amadey, or Lumma. This type of malware, known as an ‘infostealer,’ often hides via Trojan attacks that have the superficial appearance of legitimate software.</p>
    <p>The EtherHiding version of these WordPress-based update attacks <strong>uses a more powerful infostealer, ClearFake</strong>. Using ClearFake, EtherHiding injects JS code into unsuspecting users’ computers.</p>
    <p>In an earlier version of ClearFake, some code relied on CloudFlare servers. CloudFlare detected and eliminated that malicious code, which gutted some of the functionality of the ClearFake attack.</p>
    <p>Unfortunately, the attackers have learned how to evade cybersecurity-minded hosts like CloudFlare. They found a perfect host in Binance.</p>
    <p>The EtherHiding attack notably <strong>redirects its traffic to <a rel="noopener noreferrer nofollow" title="Binance" href="https://thebittimes.com/tag/binance.html">Binance</a> servers</strong>. It uses an obfuscated Base64 code that queries <a rel="noopener noreferrer nofollow" title="Binance" href="https://thebittimes.com/tag/binance.html">Binance</a> Smart Chain (BSC) and initializes a BSC contract with an address controlled by the attackers. It notably calls some software development kits (SDKs) like <a rel="noopener noreferrer nofollow" title="Binance" href="https://thebittimes.com/tag/binance.html">Binance</a>’s eth_call, which simulate contract execution and can be used to call malicious code.&nbsp;</p>
    <p>As Guardio Labs researchers pleaded in their Medium posts, Binance could mitigate this attack by disabling queries to addresses that it has flagged as malicious, or disabling the eth_call SDK.</p>
    <p>For its part, Binance has flagged some ClearFake smart contracts as malicious on BSCScan, the dominant Binance Smart Chain explorer. Here, it warns blockchain explorers that the attacker’s addresses are part of a phishing attack.</p>
    <p>However, it provides little useful information about the attack’s form. Specifically, <strong>BSCScan doesn’t display warnings to the actual victims where the hacks occur</strong>: inside their web browsers.</p>
    <h2 class="wp-block-heading" id="h-web-browser-tips-to-avoid-etherhiding">Web browser tips to avoid EtherHiding</h2>
    <p>WordPress has become notorious for being a target for attackers, with one-quarter of all websites using the platform.</p>
    <ul>
     <li>Unfortunately, approximately one-fifth of WordPress websites have not upgraded to the latest version, which exposes Internet surfers to malware like EtherHiding.</li>
     <li>Site administrators should implement robust security measures such as keeping login credentials safe, removing compromised plugins, securing passwords, and limiting admin access.</li>
     <li>WordPress administrators should upgrade WordPress and its plugins daily, and avoid using plugins with vulnerabilities.</li>
     <li>WordPress administrators should also avoid using ‘admin’ as a username for their WordPress administration accounts.</li>
    </ul>
    <p>Beyond that, the EtherHiding/ClearFake attack is difficult to <a rel="noopener noreferrer nofollow" title="block" href="https://thebittimes.com/tag/block.html">block</a>. Internet <a rel="noopener noreferrer nofollow" title="users" href="https://thebittimes.com/tag/users.html">users</a> should simply be wary of any unexpected ‘Your browser needs updating’ notification, especially when visiting a website that uses WordPress. <strong>Users should only update their browser from the browser’s settings area</strong> — not by clicking a button within a website, no matter how realistic it appears.</p>
    <p><em>Got a tip? Send us an email or ProtonMail. For more informed news, follow us on X, </em><em>Instagram</em><em>, </em><em>Bluesky</em><em>, and </em><em>Google News</em><em>, or subscribe to our </em><em>YouTube</em><em> channel.</em></p>
   </div>
  </div>
 </div>
</div>
<p>Source: <a rel="noopener noreferrer nofollow" target="_blank" href="https://thebittimes.com/etherhiding-hack-uses-binance-blockchain-to-extort-wordpress-users-tbt67920.html">https://thebittimes.com/etherhiding-hack-uses-binance-blockchain-to-extort-wordpress-users-tbt67920.html</a></p>

'EtherHiding’ hack uses Binance blockchain to extort WordPress users

Table of Contents

TheBitTimes

Other articles published on Oct 26, 2023

Inspector General requests that FDIC improve its guidelines and process for assessing crypto risk.

Meta advances its AI system to interpret photos based on brain activity.

9GAG team’s Memecoin with no roadmap raises $11m

A major asset drain occurs on cryptocurrency exchanges due to the spike in Bitcoin prices.

Gate.io Labs Invests in Magic Square, World’s First Crypto App Store

Pro-XRP Lawyer Highlights Two Massive Wins for Crypto

Join our free newsletter for daily crypto updates!