Review npm repo bitcoin stealer

[garcilazor]

Try to come up with high level structure for CTF level

[ecchilds]

On November 26, 2018, a commonly used NPM package, event-stream, was altered to contain malicious code. This code, which had been uploaded to one the packages dependencies, flatmap-stream, was designed to siphon bitcoins from user's wallets. Though event-stream later wrote out the offending package, this raises an interesting point for a vector of supply chain attack.

For a CTF level built around this exploit, the flag would be the section of code siphoning bitcoins. For this, we would need a web app/server running off of javascript or python. This would be run on the user's local machine, and it would be their job to find which dependency is the source of the bitcoin siphoning code. For portability, this website would be contained in a docker image; python maintains it's own docker base image that we could use, while lts-alpine is a common image used for javascript.

To prevent putting malicious code out there, we would either need a library stored on NPM or Pypi that does not actually siphon bitcoins, but looks like it does to the user, or we would need our own private repo that the web app accesses. In the latter case, this could be accomplished by hosting the code on a private gitlab server. Since code pulled from git will look distinctly different from code pulled from an official library, every dependency used by the web app could be a forked version of an actual package, hosted on the gitlab server. Otherwise, there would be no challenge to the CTF.

To find the malicious code, the user could look at version histories of the dependencies, or at the web app's actual javascript/python code. To make things easier, there could be an extra stage near the beginning of the level, where the user sets up some kind of code to check for bitcoin stealers in there website. There are countless codebases designed to scan for cryptominers we could base this off of, including Firefox's own script blockers.

[jake-bickle]

I really like the idea of having this be one of our first levels: Simply finding a dependency that is actively causing harm. Hosting a private gitlab server would be difficult. We don't really have that kind of resource. One idea is that we can clone a bunch of dependancies and have them stored locally (installed as a Python site package if the player was in a docker image) and one of those dependencies are malicious.

I don't know about you or the rest of the team, but I know next to nothing about bit coin mining and any sort of way to actually seal bitcoins. Building a sample repo for a bitcoin stealer would probably be pretty difficult. Perhaps our codelab would talk about the bitcoin stealer and how the attack was made, and then we did a different repo with the same idea?

Also, this is pretty close to #9. That's probably not an issue, but it may be a good idea to make these two CTFs more distinct.