CCN is expanding. Are you our next full-time journalist from the West Coast USA? Send us your CV and examples .
A Node.js module called event-stream is used in millions of web applications, including BitPay’s open-source bitcoin wallet — Copay — and this module was thanks to what can objectively referred to as social engineering, laziness, and incompetence.
A user with very little coding activity on GitHub requested publishing rights to the event-stream library from its previous maintainer, Dominic Tarr, who that he had not maintained the repository in years and gave control to the new user, called .
The library event-stream is used in many Node.js applications. According to a complainant on GitHub, the new maintainer right9ctrl either pulled a sneaky move to inject malware or unknowingly had the same effect as if he had, that effect being that it would leak private keys from applications that relied on both the event-stream and copay-dash modules.
Ayrton Sparling :
“He added flatmap-stream which is entirely (1 commit to the repo but has 3 versions, the latest one removes the injection, unmaintained, created 3 months ago) an injection targeting ps-tree. After he adds it at almost the exact same time the injection is added to flatmap-stream, he bumps the version and publishes. Literally the second commit (3 days later) after that he removes the injection and bumps a major version so he can clear the repo of having flatmap-stream but still have everyone (millions of weekly installs) using 3.x affected.”
Basically, the developer updated the module with malware and then patched the problem to avoid detection, but the numerous people who had already installed it remain affected. — whose open-source code is itself used by many crypto applications — would be just one of many that use the library, but it happens to be built and maintained by a multi-million dollar bitcoin payment processing company — — which raises questions on its own.
Why Does BitPay Use Upstream Libraries?
We know now: it targeted copay-dash, a bitcoin wallet, and steals the wallet files.
— Sven Slootweg (@joepie91)
Those outside of open source development may have the misconception that it is all done for free due to ideals or hobbyism, but this is far from the case. The majority of major and important open source development, such as work on bitcoin Core or work on the Linux Kernel, for instance, is done by developers who are employed by companies with a stake in the development of such software.
You do know how many products and services do this? This is a much bigger issue than just BitPay.
— Brian Hoffman 🎧 (@brianchoffman)
Companies like Red Hat contribute code to the Linux Kernel and companies like employ bitcoin Core developers. The reason is obvious: while they could simply wait on releases and rely on the work of others, these companies understandably have aims to achieve in development and also, most importantly, have a lot of money at stake in kernel development.
This is one of the major issues with JavaScript-based cryptocurrency wallets with heavy up-stream dependencies coming from NPM. essentially trusted all the up-stream developers to never inject malicious code into their wallet. also let the attacker in, sadly
— Jackson Palmer (@ummjackson)
This model works for major software development, and this author believes that there is no reason it shouldn’t be applicable here. Rightfully, BitPay should arguably not be using software on a trust basis. Millions upon millions of dollars in client wallets are being entrusted to them, not upstream developers. If BitPay is not interested in actively developing libraries like event-stream, then they should use forked versions, verifying that each update is safe. Instead, as many industry stakeholders have alleged, they’ve demonstrated incompetence.
CCN has reached out to BitPay for comment and will update this article upon receiving a reply.
Featured Image from Shutterstock
Get Exclusive Crypto Analysis by Professional Traders and Investors on Hacked.com. Sign up now and get the first month for free.
Published at Mon, 26 Nov 2018 20:37:26 +0000
