Lucid Chess Game - Blockchain Implementation Project - Apply if You've Previously Bid on Similar Project
Budget: $250 – $750 USD
If you've previously bid on a similar project by (henry804) and ran the game (Lucid Chess), your computer may be infected.
I've managed to reverse engineer it and gained access to the attacker's server.
The attackers are targeting freelancers with blockchain knowledge, hoping to find wallets or cryptocurrencies on their workstations. Luckily, this one fell into my honeypot.
## How to check?
You can check if your computer is compromised by seeing if your computer's hostname appears in any of the attached screenshots.
**Note: Though the attack is ongoing since ~2 weeks, server contained files of last week**
## If you're one of the 75 victims on the list:
You likely ran the game using "npm start," which downloads attacker payloads and runs them on your computer while you are inspecting the program/game. The attacker then initiates FTP connections to steal your files. They're specifically targeting cryptocurrency wallets, passwords, server passwords, and solidity contracts, although they try to download pretty wide range of file extensions (ie.: PDF / DOC / XLSX / .ENV / TS / JS / ZIP, JPG.....) and sort it out later.
## Removal steps:
To remove the vulnerability, search for a running python process from a well-hidden folder (in my case, "/home/{USER}/.n2"). Note that the process opens a sub-process, so make sure to kill the sub-process first, then kill the main process, remove the hidden venom file "pay" (inside the .n2 folder), and finally, remove the game folder. Check for suspicious startup processes, although no evidence suggests automatic execution on boot.
## Mitigation:
● Secure Accounts: Change all passwords immediately
● Halt Transactions: Stop ongoing transactions to prevent financial losses (incase of blockchain / ICO / contracts).
● Protect Funds: Transfer assets to secure locations, like offline wallets or trusted exchanges.
● Notify Platform: Inform service providers (your clients) and stakeholders, such as ICO investors, about the incident.
● Enhance Security: Strengthen security measures, including multi-factor authentication and regular audits.
● Obligation to Inform End-Users: As part of your responsibility, inform any end-users or customers affected by the incident. Provide them with relevant details and guidance on protecting their accounts and assets.
● Report to Authorities Cyber OPS Authorities (FBI / CISA / BfDI / AP / ICO / CNIL) : Cooperate with law enforcement and regulatory agencies.
I'm available if you need help in mitigation, some cases could be quite complicated (especially in case of blockchain-related private keys).
## What about my stolen files?
Attacker no longer need to worry about diskspace as I've deleted all your files on their server (attached server IP addresses). However, it's unknown if the attacker made a backup of these files (i doubt).
I also kept a log of each deleted file (arranged by workstation name), if you are interested to know what files were exposed.
## Advice for Future:
If you must check out & run the project files, it's best to do it in an isolated virtual machine. You can set up a virtual machine within your OS to provide a sandboxed environment for testing projects safely. Additionally, always exercise caution when downloading and executing files from unknown or untrusted sources (Project owners fall into this category).
## My Efforts <}
You can thank me by changing your bid content to a thank-you message :) After all, it was an exciting "project" yet wasted precious working hours.
Also, report user henry804
I'm available if you need help in mitigation, some cases could be quite complicated (especially in case of blockchain-related private keys).
## For Freelancer staff
Please don't delete this project. There's clear public interest in warning the victims. And please block the user and save their personal data for legal purposes, as they've violated the terms of use. Once I dox their identity, it might be essential for legal action.
I've managed to reverse engineer it and gained access to the attacker's server.
The attackers are targeting freelancers with blockchain knowledge, hoping to find wallets or cryptocurrencies on their workstations. Luckily, this one fell into my honeypot.
## How to check?
You can check if your computer is compromised by seeing if your computer's hostname appears in any of the attached screenshots.
**Note: Though the attack is ongoing since ~2 weeks, server contained files of last week**
## If you're one of the 75 victims on the list:
You likely ran the game using "npm start," which downloads attacker payloads and runs them on your computer while you are inspecting the program/game. The attacker then initiates FTP connections to steal your files. They're specifically targeting cryptocurrency wallets, passwords, server passwords, and solidity contracts, although they try to download pretty wide range of file extensions (ie.: PDF / DOC / XLSX / .ENV / TS / JS / ZIP, JPG.....) and sort it out later.
## Removal steps:
To remove the vulnerability, search for a running python process from a well-hidden folder (in my case, "/home/{USER}/.n2"). Note that the process opens a sub-process, so make sure to kill the sub-process first, then kill the main process, remove the hidden venom file "pay" (inside the .n2 folder), and finally, remove the game folder. Check for suspicious startup processes, although no evidence suggests automatic execution on boot.
## Mitigation:
● Secure Accounts: Change all passwords immediately
● Halt Transactions: Stop ongoing transactions to prevent financial losses (incase of blockchain / ICO / contracts).
● Protect Funds: Transfer assets to secure locations, like offline wallets or trusted exchanges.
● Notify Platform: Inform service providers (your clients) and stakeholders, such as ICO investors, about the incident.
● Enhance Security: Strengthen security measures, including multi-factor authentication and regular audits.
● Obligation to Inform End-Users: As part of your responsibility, inform any end-users or customers affected by the incident. Provide them with relevant details and guidance on protecting their accounts and assets.
● Report to Authorities Cyber OPS Authorities (FBI / CISA / BfDI / AP / ICO / CNIL) : Cooperate with law enforcement and regulatory agencies.
I'm available if you need help in mitigation, some cases could be quite complicated (especially in case of blockchain-related private keys).
## What about my stolen files?
Attacker no longer need to worry about diskspace as I've deleted all your files on their server (attached server IP addresses). However, it's unknown if the attacker made a backup of these files (i doubt).
I also kept a log of each deleted file (arranged by workstation name), if you are interested to know what files were exposed.
## Advice for Future:
If you must check out & run the project files, it's best to do it in an isolated virtual machine. You can set up a virtual machine within your OS to provide a sandboxed environment for testing projects safely. Additionally, always exercise caution when downloading and executing files from unknown or untrusted sources (Project owners fall into this category).
## My Efforts <}
You can thank me by changing your bid content to a thank-you message :) After all, it was an exciting "project" yet wasted precious working hours.
Also, report user henry804
I'm available if you need help in mitigation, some cases could be quite complicated (especially in case of blockchain-related private keys).
## For Freelancer staff
Please don't delete this project. There's clear public interest in warning the victims. And please block the user and save their personal data for legal purposes, as they've violated the terms of use. Once I dox their identity, it might be essential for legal action.