EtherHiding: Hackers create novel way to hide malicious code in blockchains

cointelegraph.com:

Cybercriminals have discovered a new way to spread malware to unsuspecting users, this time, by manipulating BNB Smart Chain (BSC) smart contracts to hide malware and disseminate malicious code.

A breakdown of the technique known as ‘EtherHiding’ — was shared by security researchers at Guardio Labs in an Oct. 15 report — explaining that the attack involves compromising WordPress websites by injecting code that retrieves partial payloads from the blockchain contracts.

The attackers hide the payloads in Binance smart contracts, essentially serving as anonymous free hosting platforms for them.

Guardio Labs exposes "EtherHiding" - a new threat hiding in Binance's Smart Chain, a technique that evades detection, targeting compromised WordPress sites. Read about this game-changing method! @BNBCHAIN #BNBChain #CyberSecurity https://t.co/alNI5KqKUO

The hackers can update the code and change the attack methods at will. The most recent attacks have come in the form of fake browser updates — where victims are prompted to update their browsers using a fake landing page and link.

The payload contains JavaScript that fetches additional code from the attacker’s domains. This eventually leads to full site defacement with fake browser update notices that distribute malware.

This approach allows the threat actors to modify the attack chain by simply swapping out malicious code with each new blockchain transaction. This makes it challenging to mitigate, according to the head of Guardio Labs for cybersecurity, Nati Tal, and fellow security researcher Oleg Zaytsev.

Once the infected smart contracts are deployed, they operate autonomously. All Binance can do is rely on its developer community to flag malicious code in contracts upon discovery.

Guard