www.it-connect.fr
Adform Breach: Ad Script Used to Steal Cryptocurrencies for at Least a Week
An ad script loaded by thousands of websites was used for at least a week to hijack cryptocurrency transactions. Researcher Kevin Beaumont uncovered the compromise of Adform, a European advertising platform that claims around 14,000 business customers. Here is what we know.
An ad script turned into a cryptocurrency thief
I came across a very interesting article published by Kevin Beaumont about the compromise of Adform, a Danish company specializing in programmatic advertising. And since he always publishes relevant information, I figured it was worth talking about.
Adform is a European DSP (demand-side platform): partner websites embed a piece of JavaScript hosted by Adform, which then allows ads to be loaded. In this case, it is a file named trackpoint-async.js that is distributed from the s2.adform.net domain. This file, which is at the heart of the security incident, is clearly referenced in Adform's official documentation. It is described as a Tracking Code script, dynamically loaded on customer pages and served identically for all customers.
This is exactly the file that was tampered with. In his report, Kevin Beaumont states: "Adform was hacked. As far as I can tell, Adform did not warn anyone." The researcher adds that if you visit a site that uses Adform, it is that site that compromises your machine.
According to his analysis, malicious code was injected into Adform's JavaScript file. It appears to be clipper malware designed to hijack your PC's clipboard. The researcher explains how the attack works:
- It scans the content copied to the clipboard for Bitcoin, Ethereum, and TRX wallet addresses using three regular expressions.
- It replaces those addresses with attacker-controlled addresses, which vary from one case to another.
- It repeats the operation every 3 seconds.
This last point is important: even if the user notices that the address is wrong and copies it again, the script will replace it again three seconds later. That means you will make the cryptocurrency transaction to the attacker's wallet, not the original recipient.
Zero detections across 61 antivirus engines
The malicious file (whose SHA-256 hash is 02ff86c7f9fe609a753ff15bda90baa3c3e0d4a2e559ec4fcf8a3de0954b7c55) is not detected by the 61 engines integrated into VirusTotal (see this page). That said, it is possible that the script is now clean again, which is at least what the researcher seems to suggest: "It appears that Adform is aware of this, or that the attacker realized they had been exposed, because the malicious code seems to disappear right as I am writing these lines."
"In addition to cryptocurrency fraud, they are also logging the user's IP address, the website they came from (that is, the supply-chain component affected by the compromise), and the URL path.", Kevin Beaumont notes.
This is yet another good example of a supply-chain attack, in a different style from what we are used to seeing. In this case, Adform has not communicated publicly about it: we do not know how long this malicious script remained in place, but it appears to have been at least a week.
