SlowMist: “Bait and Switch” in Monero Wallets (Released in 2019)
The Monero cryptocurrency faced security concerns yesterday as the SlowMist security team discovered issue warnings on both the official Monero community and GitHub. Users reported that the CLI binary wallet file downloaded from the Monero website getmonero.org did not match the normal hash, raising suspicions that it was replaced with a malicious version. To add to the problem, users had their Monero coins stolen, totaling an estimated value of $7,000 USD.
Without delay, the SlowMist security team released an alert and proceeded to conduct a thorough security analysis and traceability investigation.
The Feedback address on Reddit:
https://www.reddit.com/r/Monero/comments/dyfozs/security_warning_cli_binaries_available_on/
The Discussion address on GitHub:
https://github.com/monero-project/monero/issues/6151
Linux binary file:
User nikitasius provided information on a retrievable malicious binary file:
https://www.reddit.com/r/Monero/comments/dyfozs/security_warning_cli_binaries_available_on/
This binary file is an ELF file with the following properties:
When comparing the legitimate file with this ELF file, we found differences in file size, as well as the addition of new functional code, such as:
After opening or creating a new wallet, this function is immediately called, performing the operations shown in the following image:
The private key will be sent to: node.hashmonero.com
This function will send data to a CC or C2 (command and control) server, thereby stealing a user’s assets.
By sending an HTTP POST request to the C2 server, the following malicious C2 is used to send sensitive information related to funds:
Based on the analysis, it seems that the malware does not create any additional files or directories. Its sole purpose is to steal the private key and attempt to pilfer assets from the wallet.
Windows binary file:
The C2 server 45.9.148.65 also has the following attributes:
The Windows version actually has the same functionality as the Linux version: stealing the private key and wallet assets.
The only difference is the function names, such as
_ZN10cryptonote13simple_wallet9send_seedERKN4epee15wipeable_stringE.
If you have a firewall or proxy (hardware or software), please verify if there is network traffic connecting to the following domains or IP addresses:
Delete all binary files listed in this article;
Verify the hash value of the Monero installer or installation file.
For beginners: https://src.getmonero.org/resources/user-guides/verification-windows-beginner.html
Advanced usage: https://src.getmonero.org/resources/user-guides/verification-allos-advanced.html
Note: Hash list is located at: https://web.getmonero.org/downloads/hashes.txt
What is a hash? A hash is a unique identifier. This can be a file, a word, etc. It is best to use SHA256 hash for file verification.
You can also use the following Yara rules to detect malicious or infected binary files:
Monero_Compromise.yar
Download Yara (and documentation): https://github.com/VirusTotal/yara
Recommendations:
Install antivirus software and use a firewall (free or paid) as much as possible;
If you are already using antivirus software: when using Monero (or other miners), it is best not to exclude specific folders in the antivirus software. If necessary, use them only after verifying the hash value.
Reset your seed or account;
How to reset account: https://web.getmonero.org/resources/user-guides/restore_account.html
Recovering wallet using mnemonic seed: https://monero.stackexchange.com/questions/10/how-can-i-recover-a-wallet-using-the-mnemonic-seed
Monitor your account/wallet to ensure that there are no malicious transactions. If there are, contact the Monero team for support at any time.
Please delete and download the latest version at: https://web.getmonero.org/downloads/
Official statement from the Monero team:
Warning: The binaries of the CLI wallet were compromised for a short time：
https://web.getmonero.org/2019/11/19/warning-compromised-binaries.html
Reminder from the SlowMist team:
Regarding supply chain attacks, due to insufficient awareness of security among developers and operators, the SlowMist security team foresaw the possibility of such attacks a long time ago. Monero is not the first cryptocurrency or wallet to be attacked, nor will it be the last.
Therefore, we urge official personnel to pay attention to the security of their own accounts, use strong passwords, and always use MFA (or 2FA) whenever possible to maintain security awareness. When there are available new versions for various applications, please pay attention to verifying the hash value.
If you have any questions, please contact the SlowMist security team by email at team@slowmist.com.
Attached:
Thanks to:
Sample provided by nikitasius
binaryFate from:
https://www.reddit.com/r/Monero/comments/dyfozs/security_warning_cli_binaries_available_on/
bartblaze from:
https://bartblaze.blogspot.com/2019/11/monero-project-compromised.html
About SlowMist
SlowMist is a blockchain security firm established in January 2018. The firm was started by a team with over ten years of network security experience to become a global force. Our goal is to make the blockchain ecosystem as secure as possible for everyone. We are now a renowned international blockchain security firm that has worked on various well-known projects such as Huobi, OKX, Binance, imToken, Crypto.com, Amber Group, Klaytn, EOS, 1inch, PancakeSwap, TUSD, Alpaca Finance, MultiChain, O3Swap, etc.
Website：
https://www.slowmist.com
Twitter：
https://twitter.com/SlowMist_Team
Github：
https://github.com/slowmist/
