Podcast Detail

SANS Stormcast Thursday, August 6th, 2026: keyv/cachable Worm IR; Apple Private Relay Leak; COLDCARD Phish

If you are not able to play the podcast using the player below: Use this direct link to the audio file: https://traffic.libsyn.com/securitypodcast/10040.mp3

previous
Podcast Logo
keyv/cachable Worm IR; Apple Private Relay Leak; COLDCARD Phish
00:00

My Next Class

Click HERE to learn more about classes Johannes is teaching for SANS

Podcast Transcript

 Hello and welcome to the Thursday, August 6, 2026
 edition of the SANS Internet Storm Center's Stormcast. My
 name is Johannes Ullrich, recording today from
 Jacksonville, Florida. And this episode is brought to you
 by the SANS.edu Undergraduate Certificate Program in Applied
 Cybersecurity. Well, Renato today did a great write-up on
 some of the most recent supply chain vulnerabilities or
 supply chain compromises, and that's the keyv and cacheable
 NPM libraries that were recently compromised by yet
 another worm. These two libraries are extremely
 popular. They are, as Renato puts it, sort of at the bottom
 of the dependency chain for an awful lot of projects because
 they provide basic caching capabilities, and of course a
 lot of software uses that. Now the problem here, and that's
 something that I've seen in some of the recent
 compromises, that after the GitHub keys and such are being
 exfiltrated, the malware will actually keep checking whether
 or not those keys are still valid. And once they become
 invalid, it will then run additional actions. Now in
 this case, it's not that clear what will happen because the
 malware will basically just reach out to the attacker's
 URL and will execute whatever it's being instructed to do,
 maybe exfiltrate the new keys. But in the past, this also has
 often led to the destruction of any files on the system. So
 you definitely want to be a little bit careful here before
 you are revoking any stolen API keys. As Renato points
 out, if you disconnect the system from the network, then
 the code will not run because it actually waits for the 400
 status code to come back from the service. So with nothing
 coming back, with it not being able to connect, it will
 actually not run the additional malicious payload.
 To help you even more, Renato wrote a little tool that will
 help you identify what exactly is going on in your system.
 There are also some tricks the attacker is playing, like for
 example, they're using the usual sort of install hook for
 NPM in order to execute the malware. Well, if you're not
 running the install hook, it also imports these
 configuration files into your repository, which will then
 execute code when you're importing this particular
 library then into your development environment. I
 think yesterday I talked about a similar attack against
 Apple. So what Renato script does, first of all, it does a
 more complete review what exactly happened on your
 system based on this particular malware. And then
 it also basically helps you with the mitigation. Now you
 may say, hey, should I install yet another NPM script here or
 JavaScript script here in order to solve the problem?
 Well, Renato actually thought about that. And this
 particular script does not load any additional
 dependencies. It only uses like built-in libraries that
 come with a node.js, like your URL library and things like
 that. It also does not call out. The only time it will
 establish an outbound network connection is if you're using
 the update option to see if there's an update available
 for the script. And the same researchers who recently
 published about an Apple vulnerability in Apple's
 Gatekeeper service that allowed you to replace
 applications without triggering a Gatekeeper have
 now found an interesting issue in Apple's iCloud Private
 Relay. Talal Haj Bakry and Tommy Mysk did figure out that,
 well, you can actually trick the browser into initiating
 web requests that are then being sent by the operating
 system itself or by other components of the operating
 system. And that's sort of what's the problem here. So
 with Apple iCloud Private Relay, all requests from the
 browser are being sent to Apple's proxy servers and are
 anonymized that way. And that part works rather well. But
 what doesn't work is if you are now accessing a website
 that is actually offering passkey, which is a good
 thing. And I often recommend it, the use of passkey. But
 the problem is this triggers now a request by the operating
 system's authentication services. And that is being
 initiated by the operating system directly. It's not
 going through whatever proxy server is configured for the
 browser. And as a result, may leak your IP address to a
 potential attacker whose website you just visited. So
 this is an interesting kind of vulnerability. It apparently
 also affects other browsers, like, for example, the Tor
 browser on iOS. Because they have the same problem.
 Essentially, all browsers using WebKit, which Chrome and
 Firefox are using, they rely on this operating system-wide
 proxy setting in order to redirect traffic. The real
 solution here is not to rely on a browser-only technology.
 And that's really what Tor browser is. It just instructs
 the browser to use Tor, while other software on your
 operating system may still use a direct connection to the
 Internet. So it's much better to have an operating system
 -wide VPN instead of relying on just the browser, figuring
 out how to send traffic, while the rest of the operating
 system, of course, may still leak your data. So it's not as
 much a vulnerability in Apple's implementation as more
 a problem in only using the VPN for browser traffic and
 not using it for anything else. Well, if you are a user
 of the Coldcard crypto coin wallet, then sadly, well, the
 entire problem with the weak random number generator may
 not be over for you. I talked about this, I think, last
 week, that some Coldcard users saw their crypto coin
 funds trained because of a weak crypto random number
 generator. The new problems are, first of all, that there
 is an updated firmware available for your Coldcard.
 However, some users have reported that the update break
 to their device, essentially rendering their crypto coins
 unaccessible. So definitely make a backup of your wallet
 before you're actually applying this update.
 Secondly, Proofpoint is reporting that there is a
 phishing attack underway. That supposedly links to an audit
 guide that's supposed to help you figuring out whether or
 not you have a problem with your Coldcard wallet. Well,
 that, of course, leads to a malicious site. So definitely
 be careful here. They even came up with a reasonable good
 domain name for this coldcardteamsnews.com or
 coldcardteamnews.com. So definitely watch out for that.
 And I'll probably run a report tomorrow, see how many new
 domain names with coldcard in the name we can find. Well,
 and this is it for today. So thanks for listening. Thanks
 for liking. Thanks for subscribing to this podcast.
 And talk to you again tomorrow. Bye. Bye. Bye. Bye.