Cyberattackers take aim at blockchain, and put malware to stop removal

Guardio Labs, the security firm, has released a research discovery that cyberattackers are trying to use blockchain technology to host malicious code.

According to Krebs On Security, the finding follows the discovery of the ClearFake scam in August. The ClearFake campaign uses compromised WordPress websites in order to try and catch people out with one of the oldest malware delivery techniques, which is the fake browser update. The ones who take the bite then download a trojan that steals their information.

The researchers from the security firm found that attackers behind an updated version of ClearFake started keeping malicious files as crypto transactions in the Binance Smart Chain (rebranded as BNB Chain in 2022) after Cloudflare tried to block the websites.

Guardio also revealed that hackers created a simple contract app that uses the storage function of the contract. “The method ‘update ()’ saves the input to this storage — byte by byte, and the method ‘get()’ reads the storage and returns its value as a string,” the researchers explained.

It is said that data can be written or updated on the chain by interacting with the contract. The research team also said: “Due to the publicly accessible and unchangeable nature of the blockchain, code can be hosted ‘on-chain’ without the ability for a takedown,”

The attackers were smart enough to upload the necessary Binance Coin to the address they controlled to create and update the contract. What hosting the code on a blockchain means is that it would not be possible for a domain manager to remove the contents. It would also be very difficult to trace the source of the attack.

Guardio also said that it would be challenging for Binance to shut down the operation. “The only thing they can do and currently offer — is the ability of the community and developers to be warned about a contract if identified as malicious or part of an illegal activity,” the company said.