Hackers Compromise Ethersphere's bee-js and Swarm Desktop to Deliver Wallet-Stealing Malware

Hackers have compromised Ethersphere's release automation to distribute malware through malicious versions of bee-js and Swarm Desktop, tools used in the Swarm decentralized storage network. This attack is significant because it targets the security of digital wallets, potentially allowing attackers to steal wallet keys and passwords, install backdoors, and gain unauthorized access to sensitive data. The incident highlights the vulnerabilities in the software supply chain, where attackers can inject malicious code into legitimate software updates, compromising the integrity and security of the applications.

The compromised versions, bee-js 13.3.0 and Swarm Desktop 0.56.2, were designed to steal wallet keys stored by Swarm Desktop and install a backdoor on Windows, macOS, and Linux systems. These releases were quickly withdrawn, and a clean update for Swarm Desktop was issued. However, the removal of the malicious releases does not eliminate any backdoors already installed or protect any keys that have already been compromised. At the time of writing, no theft of funds has been reported, but the potential for exploitation remains a serious concern for users.

The malicious Swarm Desktop 0.56.2 was available on GitHub for approximately 8.5 hours, while bee-js 13.3.0 was on npm for about 75 minutes. During this time, the affected versions could have been downloaded and installed by users, potentially compromising their systems. The attack utilized the bee-worker account, typically used by Ethersphere for automated releases, to publish these malicious versions without the need for approval or code review. This lack of oversight allowed the attackers to distribute malware with valid provenance, making it appear legitimate.

The malware in both bee-js and Swarm Desktop includes a loader that downloads additional code from a remote server and executes it with user permissions. This code searches for specific files in Swarm Desktop's data folder, which contain encrypted Ethereum keystores and unencrypted passwords. With access to these files, attackers can potentially drain the node wallet of its assets, including xDAI and xBZZ tokens. Additionally, the malware installs a backdoor, allowing remote access and control over the compromised system.

On Linux and macOS, the backdoor is implemented as a Go remote shell called evjawbreaker, which runs as a user service or LaunchAgent, respectively. On Windows, the malware installs a genuine ScreenConnect remote-access client, signed by ConnectWise, to establish a connection with the attackers' server. The attackers can change the control server address at any time, adding another layer of complexity to the threat. This backdoor provides attackers with persistent access to compromised systems, posing an ongoing risk to affected users.

Ethersphere has responded by releasing a clean version of Swarm Desktop, signed with a new Developer ID certificate. The maintainers have also implemented additional security measures, requiring approval from the DevOps team for signing jobs and ensuring that they run only from the main branch. The exact method by which the attackers gained access to the release automation system remains unclear.