Evan Sultanik

The Pennsylvania Supreme Court recently ruled that police can access someone's Google searches without a traditional warrant, finding no reasonable expectation of privacy in unprotected search queries. On this week's episode of the Shared Security Podcast, we discuss what a reverse keyword search warrant is and why this ruling could change our expectations for privacy with the technology we use! What do you think about this recent ruling? Let me know in the comments below!

31

6 Comments

The Axios Supply Chain Attack While everyone was distracted by the Claude Code source leak on March 31st, a far more dangerous attack was unfolding in the same ecosystem. Two malicious versions of Axios npm packages were released, connecting to a known malicious C2 domain to retrieve a second-stage remote access trojan . Axios has 100M+ weekly downloads one of the most depended-upon packages in all of JavaScript. Google Threat Intelligence attributed the compromise to UNC1069, a North Korean state actor . The attack chain was surgical: → Compromised the lead maintainer’s npm account → Published backdoored [email protected] and [email protected] → Injected a phantom dependency (plain-crypto-js) that was never imported by axios code → Its sole purpose was to execute a postinstall script that drops a cross-platform RAT targeting macOS, Windows, and Linux → The RAT established persistence, exfiltrated credentials, and accepted remote commands. The attacker tagged both the latest and legacy channels, maximizing the blast radius . Anyone who ran npm install during the 3-hour window got owned silently. If you’re affected, check NOW: grep -r "1.14.1\|0.30.4\|plain-crypto-js" package-lock.json If found treat the machine as fully compromised. Rotate every secret. Clean reinstall. Key prevention measures: → Pin exact dependency versions, don’t use ^ or ~ ranges → Require SLSA provenance for critical packages → Run npm install --ignore-scripts and audit postinstall hooks → Generate SBOMs on every build → Use short-lived, scoped npm tokens, never long-lived access tokens Two incidents. Same day. Same ecosystem. The Claude Code leak exposed how fragile build pipelines are. The axios attack proved that nation-state actors are actively weaponizing that fragility. Your dependency chain is an attack surface. Treat it like one. #CyberSecurity #SupplyChainAttack #Axios #npm #DevSecOps #Malware #RAT #NorthKorea #SapphireSleet #ThreatIntelligence #InfoSec #ApplicationSecurity #SBOM #SLSA #SoftwareSupplyChain #IncidentResponse #BlueTeam #RedTeam #PurpleTeam #PenetrationTesting #SecOps #CyberThreat

1

Some of ya'll may know that FUNNULL CDN and their Chinese Triad Nexus partners is my research white whale. Over the last few weeks there has been some extremely important research released about FUNNULL that I want to make sure folks understand (links in the comments). But before I get into that, I’m very excited to announce I’ll be presenting on FUNNULL at RSA this year in a talk, “Chinese CDN FUNNULL's Post-Treasury Sanctions Efforts and Ongoing Attacks.” This presentation wouldn’t be possible without the support from the amazing team at Silent Push who continue to conduct cutting edge research into FUNNULL and a wide variety of the most serious threat actors and who have allowed me to present this research at RSA, along with my new team at Infoblox who have also been immensely supportive. Stopping FUNNULL is absolutely a team sport. When FUNNULL was sanctioned by the U.S. Treasury in May of last year, we learned that U.S. victims have lost more than $200 million on the investment scam websites hosted on FUNNULL and they are linked to the *majority* of virtual currency investment scam websites reported to the FBI… Today's news is from a jaw dropping piece released by the team at Hudson Rock titled, “How One Infostealer Infection Solved a Global Supply Chain Mystery and Unmasked DPRK Spies in U.S. Crypto.” Their team was able to investigate a compromised device clearly owned by a DPRK hacker associated with their fake IT worker schemes. The compromise exposed thousands of browser logs, user credentials, browser autofill data, and thousands of Google Translate queries. This breach data proved that shockingly, a DPRK threat actor was working closely with the FUNNULL threat actors on the 2024 Polyfill supply chain attack. The breached logs also prove that FUNNULL and these DPRK threat actors had/have an exploit for GoEdge CDN servers and they were taking careful steps to try and hide their exploit code from the public and from victims. The rest of their fabulous research also includes details about the companies this DPRK threat actor compromised, so you get a front-row seat at what sensitive attacks are being undertaken when a serious organization accidentally hires a DPRK hacker. The other massive research piece was from the team at Qianxin Xlab titled, “Funnull Resurfaces: Exposing RingH23 Arsenal and MacCMS Supply Chain Attacks” which highlights a potential new front company you may hear about at my RSA presentation ;D and more importantly it includes a wide range of details about how FUNNULL has used their GoEdge exploit to conduct massively underreported supply chain attacks (they poisoned a Github project with 2,700+ stars!), along with details about some malware they have been using. At this point, there’s basically more FUNNULL research than any one person can keep up with, so I look forward to any future collaborations with folks on this important topic, and appreciate everyone’s time who attends my upcoming RSA presentation. 🖖

52

3 Comments