{"id":12980,"date":"2018-11-27T00:00:00","date_gmt":"2018-11-26T16:00:00","guid":{"rendered":"https:\/\/www2019.dash.org\/2018\/11\/27\/dash-is-not-affected-by-the-bitpay-copay-attack\/"},"modified":"2021-09-18T11:36:27","modified_gmt":"2021-09-18T11:36:27","slug":"dash-not-affected-copay-attack","status":"publish","type":"post","link":"https:\/\/www.dash.org\/news\/dash-not-affected-copay-attack\/","title":{"rendered":"Dash is not affected by the BitPay Copay attack"},"content":{"rendered":"<p>Good day everyone !<\/p>\n<p>You might have seen the news on GitHub, Twitter, ZDNet, and various other places on the net.<br \/>\nThe whole JavaScript ecosystem discovered an attack targeting BitPay\u2019s Copay product.In order to be sure the compromised package was included in Copay during the building phase, the attacker had to spread an ingenious, obfuscated and malicious code across the whole ecosystem.This malicious code was looking for a description of a package (bunch of code that works as libraries to enhance programmer\u2019s productivity) that had the specific message, \u201cA Secure Bitcoin Wallet\u201d, and used that as a decryption key to unveil and execute the dormant code.<\/p>\n<p>This matched two projects: Copay, and our first fork of copay created 2 years ago while Dash was studying the idea of using Copay as a foundation for DashPay. We did not pursue this idea further, and that project was never used.<\/p>\n<p>The Dash Copay Beta that we worked on and released was not targeted and therefore won\u2019t manage to steal your funds.<\/p>\n<p>\u200b<\/p>\n<p>Here is the exact naming thing that got everyone (including ZDNet at one point) confused:<\/p>\n<ul>\n<li>dash-copay is the name of the repository for the Dash version of Copay, this one is not at risk for different reason (pkg description, different dependencies,\u2026)- copay-dash: Is the library that was also at risk, because it was a fork that we did not even bother to Dashify, so raw, that\u2019s it\u2019s more a tag of a specific version of Copay that a fork. This one, no one has used (except for bots and researchers that downloaded it in recent days).<\/li>\n<\/ul>\n<p>\u200b<\/p>\n<p>So, what happened ?<\/p>\n<p>I\u2019ve been looking at it, thanks to a message from Bitpay.<\/p>\n<p>I want to first say how grateful I am to BitPay; they were blazing fast in sharing with us this information, which allowed us to get in touch with ZDNet and clear all suspicions on Dash.<\/p>\n<p>\u200b<\/p>\n<p>And secondly for all the foundations they paved, theses packages remain open-source which means that if you do not maintain them, they get outdated, with issues and vulnerabilities. And in this case, I think that the Bitcoin community would benefit from grouping together and starting a Patreon (or forking our governance system) to fund some devs to be able to keep everything up-to-date, to be able to verify the dependencies, and to be able to improve and reduce their dependencies.<\/p>\n<p>\u200b<\/p>\n<p>So that should be cleared up: This attack targeted everyone, people from React, Vue, Nodemon, from the Node Security team or the Google Security team, experts in their domain also didn\u2019t notice it, because it\u2019s finding a needle in a haystack.So clearly, it\u2019s not about BitPay, but it\u2019s good warning for all of us to improve our package dependency strategy and review processes.<\/p>\n<p>\u200b<\/p>\n<p>On the 20th of November, a CS Student found that a package included some strange code. He found a code that he couldn\u2019t really understand, but that is known by most of the crypto community devs (JS).He immediately understood that it was malicious, but it took the community time to get the information, and given the control that the attacker had, we are lucky he didn\u2019t or couldn\u2019t remove the GitHub issue\u2026No fault on that\u2013as a Student, did you know who to contact when you found malicious JS code? (FYI to all CS students: https:\/\/nodejs.org\/en\/security\/ is also to be used for third-party vulnerabilities)<\/p>\n<p>\u200b<\/p>\n<p>This code, present in a minified file, but not in the regular file (the one people actually read), was trying to decipher an aes256 ciphered message that was first turned into a hexadecimal string. The decryption key is the npm_package_description, all packages have one, but Copay specifically has \u201cA Secure Bitcoin Wallet\u201d. How did they find that? Well, by iterating all packages descriptions available (and there are a lot of them).<\/p>\n<p>\u200b<\/p>\n<p>When you enter this passphrase, you then get the code that is injected. This injection as explained before, targets your private keys, requires another package to do that (bitcore-wallet-client), and will then send that information to either:<\/p>\n<ul>\n<li>A domain bought using crypto and a throwaway email address: copayapi.host (cost: 0.99$\/yr..)- If it doesn\u2019t resolve, to a direct static ip (111.90.151.134) which resolves to a Malaysian Transit Service.<\/li>\n<\/ul>\n<p>\u200b<\/p>\n<p>Because Dash Copay does not use <code class=\"highlighter-rouge\">bitcore-wallet-client<\/code>, and doesn\u2019t have the same description, we were not targeted. The attacker has targeted Bitpay Copay implementation having bch \/ btc. They didn\u2019t care at all about trying to target other implementations like Dash.<\/p>\n<p>\u200b<\/p>\n<p>This is a good reminder for us that our decision to limit our dependencies is the right one. It doesn\u2019t help our productivity, but it will benefit the security of our Javascript libraries.<\/p>\n<p>\u200b<\/p>\n<p>So in the end, this attack specifically targeted the BitPay Copay App from 5.0.2 to 5.1.0.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Good day everyone !<\/p>\r\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"inline_featured_image":false,"footnotes":"","_links_to":"","_links_to_target":""},"categories":[216],"tags":[],"acf":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v22.3 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>Dash is not affected by the BitPay Copay attack - Dash<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.dash.org\/news\/dash-not-affected-copay-attack\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Dash is not affected by the BitPay Copay attack - Dash\" \/>\n<meta property=\"og:description\" content=\"Good day everyone !\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.dash.org\/news\/dash-not-affected-copay-attack\/\" \/>\n<meta property=\"og:site_name\" content=\"Dash\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/DashPay\" \/>\n<meta property=\"article:published_time\" content=\"2018-11-26T16:00:00+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2021-09-18T11:36:27+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/media.dash.org\/wp-content\/uploads\/dash_facebook.png\" \/>\n\t<meta property=\"og:image:width\" content=\"1200\" \/>\n\t<meta property=\"og:image:height\" content=\"630\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"dash\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@dashpay\" \/>\n<meta name=\"twitter:site\" content=\"@dashpay\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"dash\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"4 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/www.dash.org\/news\/dash-not-affected-copay-attack\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/www.dash.org\/news\/dash-not-affected-copay-attack\/\"},\"author\":{\"name\":\"dash\",\"@id\":\"https:\/\/www.dash.org\/#\/schema\/person\/49e370ea57b37d1186318dab9e4e6513\"},\"headline\":\"Dash is not affected by the BitPay Copay attack\",\"datePublished\":\"2018-11-26T16:00:00+00:00\",\"dateModified\":\"2021-09-18T11:36:27+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/www.dash.org\/news\/dash-not-affected-copay-attack\/\"},\"wordCount\":823,\"publisher\":{\"@id\":\"https:\/\/www.dash.org\/#organization\"},\"articleSection\":[\"News\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.dash.org\/news\/dash-not-affected-copay-attack\/\",\"url\":\"https:\/\/www.dash.org\/news\/dash-not-affected-copay-attack\/\",\"name\":\"Dash is not affected by the BitPay Copay attack - Dash\",\"isPartOf\":{\"@id\":\"https:\/\/www.dash.org\/#website\"},\"datePublished\":\"2018-11-26T16:00:00+00:00\",\"dateModified\":\"2021-09-18T11:36:27+00:00\",\"breadcrumb\":{\"@id\":\"https:\/\/www.dash.org\/news\/dash-not-affected-copay-attack\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.dash.org\/news\/dash-not-affected-copay-attack\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.dash.org\/news\/dash-not-affected-copay-attack\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/www.dash.org\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Dash is not affected by the BitPay Copay attack\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.dash.org\/#website\",\"url\":\"https:\/\/www.dash.org\/\",\"name\":\"Dash\",\"description\":\"Dash is Digital Cash You Can Spend Anywhere\",\"publisher\":{\"@id\":\"https:\/\/www.dash.org\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.dash.org\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/www.dash.org\/#organization\",\"name\":\"Dash\",\"url\":\"https:\/\/www.dash.org\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.dash.org\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/media.dash.org\/wp-content\/uploads\/dash-d.png\",\"contentUrl\":\"https:\/\/media.dash.org\/wp-content\/uploads\/dash-d.png\",\"width\":500,\"height\":500,\"caption\":\"Dash\"},\"image\":{\"@id\":\"https:\/\/www.dash.org\/#\/schema\/logo\/image\/\"},\"sameAs\":[\"https:\/\/www.facebook.com\/DashPay\",\"https:\/\/twitter.com\/dashpay\",\"https:\/\/www.instagram.com\/dashpay\",\"https:\/\/www.linkedin.com\/company\/10424093\",\"https:\/\/www.pinterest.com\/dashdigitalcash\",\"https:\/\/www.youtube.com\/c\/DashOrg\",\"https:\/\/en.wikipedia.org\/wiki\/Dash_cryptocurrency\"]},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.dash.org\/#\/schema\/person\/49e370ea57b37d1186318dab9e4e6513\",\"name\":\"dash\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.dash.org\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/8aabe262ffeff934a0baa0b4a798992f?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/8aabe262ffeff934a0baa0b4a798992f?s=96&d=mm&r=g\",\"caption\":\"dash\"},\"url\":\"https:\/\/www.dash.org\/author\/dash\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Dash is not affected by the BitPay Copay attack - Dash","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.dash.org\/news\/dash-not-affected-copay-attack\/","og_locale":"en_US","og_type":"article","og_title":"Dash is not affected by the BitPay Copay attack - Dash","og_description":"Good day everyone !","og_url":"https:\/\/www.dash.org\/news\/dash-not-affected-copay-attack\/","og_site_name":"Dash","article_publisher":"https:\/\/www.facebook.com\/DashPay","article_published_time":"2018-11-26T16:00:00+00:00","article_modified_time":"2021-09-18T11:36:27+00:00","og_image":[{"width":1200,"height":630,"url":"https:\/\/media.dash.org\/wp-content\/uploads\/dash_facebook.png","type":"image\/png"}],"author":"dash","twitter_card":"summary_large_image","twitter_creator":"@dashpay","twitter_site":"@dashpay","twitter_misc":{"Written by":"dash","Est. reading time":"4 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.dash.org\/news\/dash-not-affected-copay-attack\/#article","isPartOf":{"@id":"https:\/\/www.dash.org\/news\/dash-not-affected-copay-attack\/"},"author":{"name":"dash","@id":"https:\/\/www.dash.org\/#\/schema\/person\/49e370ea57b37d1186318dab9e4e6513"},"headline":"Dash is not affected by the BitPay Copay attack","datePublished":"2018-11-26T16:00:00+00:00","dateModified":"2021-09-18T11:36:27+00:00","mainEntityOfPage":{"@id":"https:\/\/www.dash.org\/news\/dash-not-affected-copay-attack\/"},"wordCount":823,"publisher":{"@id":"https:\/\/www.dash.org\/#organization"},"articleSection":["News"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/www.dash.org\/news\/dash-not-affected-copay-attack\/","url":"https:\/\/www.dash.org\/news\/dash-not-affected-copay-attack\/","name":"Dash is not affected by the BitPay Copay attack - Dash","isPartOf":{"@id":"https:\/\/www.dash.org\/#website"},"datePublished":"2018-11-26T16:00:00+00:00","dateModified":"2021-09-18T11:36:27+00:00","breadcrumb":{"@id":"https:\/\/www.dash.org\/news\/dash-not-affected-copay-attack\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.dash.org\/news\/dash-not-affected-copay-attack\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/www.dash.org\/news\/dash-not-affected-copay-attack\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.dash.org\/"},{"@type":"ListItem","position":2,"name":"Dash is not affected by the BitPay Copay attack"}]},{"@type":"WebSite","@id":"https:\/\/www.dash.org\/#website","url":"https:\/\/www.dash.org\/","name":"Dash","description":"Dash is Digital Cash You Can Spend Anywhere","publisher":{"@id":"https:\/\/www.dash.org\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.dash.org\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.dash.org\/#organization","name":"Dash","url":"https:\/\/www.dash.org\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.dash.org\/#\/schema\/logo\/image\/","url":"https:\/\/media.dash.org\/wp-content\/uploads\/dash-d.png","contentUrl":"https:\/\/media.dash.org\/wp-content\/uploads\/dash-d.png","width":500,"height":500,"caption":"Dash"},"image":{"@id":"https:\/\/www.dash.org\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/DashPay","https:\/\/twitter.com\/dashpay","https:\/\/www.instagram.com\/dashpay","https:\/\/www.linkedin.com\/company\/10424093","https:\/\/www.pinterest.com\/dashdigitalcash","https:\/\/www.youtube.com\/c\/DashOrg","https:\/\/en.wikipedia.org\/wiki\/Dash_cryptocurrency"]},{"@type":"Person","@id":"https:\/\/www.dash.org\/#\/schema\/person\/49e370ea57b37d1186318dab9e4e6513","name":"dash","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.dash.org\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/8aabe262ffeff934a0baa0b4a798992f?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/8aabe262ffeff934a0baa0b4a798992f?s=96&d=mm&r=g","caption":"dash"},"url":"https:\/\/www.dash.org\/author\/dash\/"}]}},"_links":{"self":[{"href":"https:\/\/www.dash.org\/wp-json\/wp\/v2\/posts\/12980"}],"collection":[{"href":"https:\/\/www.dash.org\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.dash.org\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.dash.org\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.dash.org\/wp-json\/wp\/v2\/comments?post=12980"}],"version-history":[{"count":1,"href":"https:\/\/www.dash.org\/wp-json\/wp\/v2\/posts\/12980\/revisions"}],"predecessor-version":[{"id":12991,"href":"https:\/\/www.dash.org\/wp-json\/wp\/v2\/posts\/12980\/revisions\/12991"}],"wp:attachment":[{"href":"https:\/\/www.dash.org\/wp-json\/wp\/v2\/media?parent=12980"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.dash.org\/wp-json\/wp\/v2\/categories?post=12980"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.dash.org\/wp-json\/wp\/v2\/tags?post=12980"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}