Mackenzie Jackson: Hello everyone, you are listening to The Secure Disclosure, and this is your weekly news brief. What on earth is happening in the world of AI agents and specifically OpenClaw? If you don't know what OpenClaw was, because 24 hours ago it was called Moldbot, and a couple of days before that it was called Clawbot. So, who knows what it's going to be called in a couple of days. But it is essentially a new open-source AI assistant that can do really powerful things, which of course means that it is a giant security headache. But not only that, there is a whole ecosystem forming around OpenClaw that is just insanely unsafe and filled with malware that it looks like Jen's computer from The IT Crowd. To help me unpack all of this, I brought onto the show security researcher Paul McCarty, who discovered an absolutely insane amount of malware on ClawHub, which is connected to OpenClaw. So, there are a few different components that we need to first address. So, first of all, let's just start off with what exactly is OpenClaw. OpenClaw is this new AI agent that is open source, that can do lots of powerful things. But what makes it scary is that it's embedded into systems and apps and not external. It could empty our bank accounts. It could send emails, text messages, it could wipe files, it could share files. It can do an insane amount of things. To understand OpenClaw completely, I guess you could think of it as this was the iPhone when it first came out. It was a powerful piece of tech, but it also needed applications to really build out the ecosystem. And OpenClaw is the same thing. It's quite powerful in itself, but it really needs applications, or in this case, they call skills. A skill is just something that anyone can develop, which gives instructions to OpenClaw so it can perform a task, right? Seems simple enough. And to support this, there is something called ClawHub, kind of sounds a little bit dodgy, but it's basically the equivalent of GitHub or Docker Hub or npm or PyPI, but for this specific model. But just imagine for a second if one of these skills or applications, if you want to think of it like that, starts instructing OpenClaw embedded into your systems to start performing malicious tasks. Well, it turns out that a huge number of these skills on ClawHub were exactly that: they were malware. So I asked Paul to explain exactly what he found and why that's scary.
Paul McCarty: It actually came in from open-source malware. So I'm the maintainer and the creator of Open Source Malware, which is the world's largest database of malicious components. Somebody made a contribution to OSM, and we didn't really have a spot natively for skills in OSM. So I thought, well, let me go have a look. Let me try to understand what's going on here. And literally, Mac, within two minutes of going there, I had found malware. I really quickly found eight, all by the same user. And very quickly, within 10 minutes, I had found, I think, 15 or 16. So my initial blog post was about those 15 or 16. But then really quickly, I found a bunch more. And then I ended up kind of locked in at 30 malicious skills. And they all kind of followed a pattern. But those initial 30 had four or five different sub-patterns in them. The total number from this one campaign was 386 malicious packages effectively from the same threat actor or threat actors.
Mackenzie Jackson: Now, obviously at the start I went on and on about just how insane this could be. So I asked Paul to explain exactly what some of the malware that he found was actually doing.
Paul McCarty: I would say on the whole, they're mostly pretty dumb. They're like if you take the dumbest malicious stuff from npm, that's kind of what's going on in ClawHub. So there's a lot of, for these 386 that I found, they basically effectively ask the user, it's kind of like click-fix. I don't know if you know the contagious interview kind of click-fix thing where basically the threat actor says, "Hey, you have to do this thing on your machine." These skills say, "Hey, if you want to talk to Poly Market, you have to download this Poly Market authentication tool." And you download. It's actually malware, but it's just a string in the first couple of lines that says, you know, either curl this or download. Later on, they were downloading directly from GitHub. And then there was a second one, and these 386 that said, "Hey, if you're on a Mac, run this." And basically that command pretended to be pulling from some legitimate looking Apple service, but really all it was doing was curling a Base64 string which ended up being an IP address and a payload. To zoom out to the bigger question, I've seen all kinds of stuff. I've seen SSH shells, I've seen reverse shells, I've seen what else have we seen? I've seen malicious JavaScript that just pops open on a thing and has you log in, kind of classic overlay stuff. So there are all kinds of interesting things going on there, but I would say on the whole they're on the lower spectrum of the malicious. The APTs haven't gotten there yet. Let's put it that way.
Mackenzie Jackson: Malware is unfortunately all around us, particularly right now. So is this really that scary? Well, Paul explains.
Paul McCarty: Yes, I think this ultimately could be worse than npm. I don't think it's ever going to have the scale of npm because npm is huge and it's been around since 2011. But I think that an APT will show up for sure. In fact, there's a room in North Korea right now that all they're doing is figuring out how to drop the same payloads they're using in npm and GitHub into these skills. So they're going to start showing up and I'll start finding those pretty quickly here. But I also think to your point, this is a more, this is a more serious immediate risk. So when someone installs a malicious npm package, if there's a post or pre-install script, it can run commands that way. I think the difference here is that, to your earlier point, you're inside Claude, right? You've probably already given it access to things, right? There's this pre-existing kind of relationship with the shell that you have inside of your agent. So now you drop this malicious skill that can do all kinds of stuff, right? It's not just running commands. It has access to things and can pull other stuff. I think because of that pre-existing set of permissions and trust that you've built with that agent, that yeah, it's ultimately going to have more impact than npm, although I think the scale will be smaller.
Mackenzie Jackson: Paul reached out to the founder and communicated with him, Peter Steinberger, who really said that, well, people want him to do a million different things right now and this isn't really something that he wants to prioritize.
Paul McCarty: I mean, I think this thing is going to get flooded with malware. So, up until yesterday, I've been pushing the creator of ClawHub to add some basic security constraints and controls. For example, before when you authenticated into ClawHub, there was no way to label a skill as malicious. There was literally no way to do that. And so, what I did is I went over to the GitHub. There happens to be a GitHub repo that backs ClawHub and I just made a PR and I just deleted 400 malicious packages. Well, their AI closed that PR, said, "Oh no, no, we don't. This is a copy of our database, so this actually isn't being used." So there was literally no way to get rid of malicious. They literally did not exist. That GitHub repo, by the way, still is hosting hundreds and hundreds of malicious packages in it. But the creator, Peter, has recently added a few basic functions that now give us the ability to mark malicious packages and the GitHub users need to be over a week old or something like that. I think these are good starts, but there needs to be a lot more. But to the question about are the real threat actors going to show up? Hell yes. Neither one of those two things. We have the ability in npm and PyPI to mark things as malicious and the bad guys, the good bad guys, the APTs still show up there every day, right? You guys are finding it, I'm finding it. So there's no reason to not expect it in ClawHub, especially with a lot less security and a lot more. There's this zeitgeist right now with all these people going there and just installing stuff because they're like, "I need to know what ClawHub is. I need to know, I need to be on the cutting edge." And so they're just doing things. They're not really thinking through and they don't realize that skills actually run stuff, bad stuff.
Mackenzie Jackson: And when it was suggested to at least have a system in place to flag something as malware, he fought back even more. This is kind of insane to me. You created something that is so clearly able to be abused by malicious actors and there is no intention to secure it. Now, I have some sympathy in this case that this is all just brand new and growing so fast, but maybe you need to put guardrails up and slow it down in the first place so that malicious actors can't just take over Claw, because they really have right now.
Paul McCarty: I was disappointed, but I was not surprised. I think that this culture we're in right now where suddenly with vibe coding, and Peter's on record saying multiple times that he doesn't look at the code he ships, right? He just doesn't look at it. And I get that because I do a lot of vibe coding too. And I'm not necessarily spending the same amount of time looking at my vibe-coded stuff as I am the stuff that I created myself in Vim. But that having been said, the reality is that when you create something and you put it out there in the public space, your responsibility does not end. And by the way, this is not coming from some jerk that's picking on open source maintainers. Go and look at my background. I have a bunch of open-source tools I wrote and people when they hit me up about problems, I go and fix them because I realize I created it. It's got my name on it and it's my responsibility to go and fix those things. Now, the problem is Peter doesn't apparently have that same opinion. And he's also just super busy, right? So when I email him saying, "Hey, here's a bunch more malicious packages or sorry, skills," he just doesn't get back to me because he's too busy. Even though I thought that's exactly what Clawbot was built to do. But anyhow, burn aside. I think that's my favorite part of it. The irony is that he created this thing that ostensibly does all the things that you don't want to do, but it's not doing all the things. It's not even responding to my emails. Right? So I was disappointed by his response, not surprised. And that's why I've been pushing him and the ecosystem to do something about, you know, these skills, because the reality is, I don't know if Peter's not seeing those emails, but as soon as I put that blog post out there, Mac, people started hitting me up about being compromised. So the reality is that, and I see this all the time with my articles about npm and PyPI packages, I get to see the whole end to end, and people reach out to me and say, "Oh yeah, that contagious interview, I got hit by that. It stole my crypto." I'm seeing this, but evidently he's not, and so he thinks it's a theoretical problem, like people just need to be smart. You can't build a ghost gun and go and put it in the playground and then walk away from the responsibility that happens from that ghost gun, right? That's just not how this works, I'm sorry.
Mackenzie Jackson: Peter in this case has kind of suggested that people just need to be not stupid and not download malware. And if that was the solution, then we wouldn't have a malware problem in all of the ecosystems that we do. It's not that people are stupid, it's that attackers are really clever and they can manipulate systems to make it look legitimate when it's not. And to show you that attackers are smart, someone already did this. Jameson O'Reilly actually created a malicious skill. It was a skill that had a backdoor in it. Basically, the exact malware scenarios that we're talking about. In this case, Jameson is an ethical hacker, so it was technically safe. Although he could have turned malicious at any point. Now, this skill became the number one downloaded skill on ClawHub, not because any of that was real, but because he was able to manipulate the system to make it appear that way. This is what happens when you have these new ecosystems that don't have secure systems behind it. So, I want to double tap on a key point that Peter actually said when he was responding to Paul. He was saying that people just need to use their brain when downloading a skill. Well, would part of using your brain be to check if this is the number one downloaded skill on ClawHub? Because I would say that that seems to be a pretty good legitimate way to see if something's legitimate. Unless of course you created a system that it's comically easy to game stats to make it seem and appear like it's the number one downloaded skill, which this did appear to be. So Peter, how exactly are people meant to be using their brain?
Paul McCarty: Of those 386 malicious skills, a lot of those packages are very, very popular, right? The reality is that this is something we've seen in npm. You can fake download counts. I have a couple posts about that and you certainly can do it here in OpenClaw. So you're right, there's not like, how do we tell? And Jameson's attack used, which by the way, is still in the GitHub repo, you can go and still see his skills in the repo, you can see what they do, but used a malicious SVG file and SVG files can embed code in them. And that's exactly how this worked. He didn't even need to use a payload that subtle because he could have just put JavaScript or Bash script in there and it still probably would have worked. But yeah, I think that saying people need to use their brains, like apply that same thinking to npm or PyPI, if they just let, they say, "Okay, yeah, cool. We're cool." How's society going to deal with that?
Mackenzie Jackson: So rather than just kind of point fingers at different people, I asked Paul what concrete steps could be in place by ClawHub to actually prevent this and create a safer environment.
Paul McCarty: Great question. By the way, I've made that offer to him in the public space on Twitter. As much as I hate Twitter, I did on Twitter because that's where he is. But I have made the offer and he did not respond, right? He hasn't responded to me. So yeah, and by the way, I have a blog post coming about exactly this. But the first place to start, listen, is let's look at npm and PyPI, right? This is not like you're not creating in a vacuum, there's a lot of other registries out there that we can learn from, right? And a couple of those things are vet your users, right? So now Peter's response to that would be, oh well, you know, we're a GitHub account has to be seven days old or whatever before you can post stuff. Well, so I create a throwaway account and I wait seven days and then I deploy malware, like that's, I don't know, it's not very much. Scanning the packages for really simplistic things, right? Which is not hard. The other registries do that, PyPI does a really, really good job of that themselves. These are things that are not crazy ideas. And creating a system that says, when a user has a malicious skill in ClawHub, remove the user, right? Because what's happening right now is they just remove the skill, which by the way, they're not really removing it because it's still in the GitHub repo, right? As soon as you find one user has deployed a malicious thing inside of your registry and you verify that's not a compromise, like an APT-style thing, remove the user. You immediately pivot and get rid of all the other bad stuff they've had that you might not have found. So these are basic things that we can learn from npm, PyPI and other registries. And it just doesn't look like they gave a damn.
Mackenzie Jackson: I'm a security guy, so I'm always on the edge of caution when it comes to new things like this because to be honest, it's kind of terrifying what could become. But I understand the temptation to download this. I understand the temptation to put this in your email inbox and start clearing it out. My recommendation would be, don't. Don't do that. Not yet. Not until the ecosystem has proven to be secure. Let other people be the guinea pigs. But if you live dangerously and you need to implement with this, I can sympathize with you. It does look really cool and it can do cool things. But if you are one of those people that need to install it, here are some things to look out for when installing skills or whether or not you should install skills using these systems.
Paul McCarty: If you're going to get drunk at the bar, here's the things that you do to make sure you don't end up in jail, right? So I think there's some obvious things, right? Like run this in a protected environment. Spin up a VPS that has no access to anything else and deploy it there. Don't deploy it on your own system, right? And when you deploy it in your VPS, don't do dumb things like storing a bunch of your SSH keys or other things there that if that sandbox gets broken, they can't steal your stuff. The second thing is that, you know, don't give it your whole, there's a lot of people right now on Clawbot giving it their bank details and Twitter and Slack and everything. Don't do that. Now, therein lies the problem. If you don't give it access to all those things, it can't really deliver the value that it says it can, which is doing all these things for you, right? So it's kind of a catch-22. But the reality is that there's no way in hell if I was running Clawbot or something similar to it that I would give it access to all my stuff. That's just not going to happen, right? There's nothing to say that you can't run individual agents that you give some level of access to individually, but the difference there is that each one of those agents is running on its own and doesn't have access to all the other things, right? So I just think that the model itself is insecure. This idea that you give this thing everything and it goes and does stuff while you're sleeping. To me, I just think that's just a bad idea. There's a lot of people that think it's an amazing idea, but I think it's a terrible idea.
Mackenzie Jackson: Coming up, we're going to dive into that Notepad++ compromise and how on earth that took place. We're going to discuss the Coinbase breach from last year and what's new and updated in regards to that. And we're also going to talk about two penetration testers that were prosecuted for six years and have finally been vindicated because they were doing their job. You can hear a lot of ranting from me about that. But first, a message from our sponsor. This podcast is sponsored by Aikido Security. Aikido Security have just launched their AI pentesting module. It's incredible. A lot of AI pentests are just something like a DAST scan wrapped with some AI features. Not this. They attack your site with 200 plus specifically chained AI agents to find vulnerabilities, including business logic flaws and IDOR vulnerabilities. Not only do you get a great list and report of all the vulnerabilities you found, they also tell you how you can recreate each step. And my favorite, there's a magic button called autofix, which does exactly what it sounds like. You can connect it to your code repositories, and it creates a pull request needed to solve the vulnerabilities from your pen test. Check it out and get your own AI pen test today at aikido.dev. Here's what else is going on in the world of cybersecurity today. Notepad++ was compromised by a suspected state-sponsored APT, specifically from China. This is a wide-scale but very targeted campaign that took place on the update server level, meaning that certain people that updated Notepad++ got a malicious version instead of a legitimate one. If you're not familiar, Notepad++ is a lightweight text editor that's often used for code editing. Whilst it's not really a popular solution amongst developers who would prefer to go for something like VS Code, it is still widely used, particularly among people like network administrators or people that don't need to spend a lot of time coding. Additionally, Notepad++ also has a very lightweight version that can run off USB, for example, so they don't need to install it, which does make it still a practical and pretty widely used application. The attack began in June last year, 2023, when the attackers gained access to the server that was delivering the updated versions of Notepad. They had access until early September when the server was updated and they temporarily lost control but were able to reinfect or regain control of that server using credentials that they had stolen. Finally, in December, the hosting provider actually first detected some anomalies and started to raise the alarm. December 9th was when a safe updated version was released when they finally regained control of that server. And then December 27th was when they actually changed the signature method that they used to help solve this problem indefinitely. And then of course January 26th the problem was announced to the world. This is actually pretty scary. So one of the first questions you might have is, how many people were impacted by this? What can we expect to see? Well, the answer is, I don't know. But we can take away a few things. Firstly, to understand is, this wasn't a wide-scale campaign. This was a targeted campaign. So while the attackers had access to the server, they could have delivered the malicious version every time someone updated Notepad. However, they only did this for select targets. This is a common theme among APTs. They're really looking for juicy targets and not quick fixes. And this is because they want to remain hidden for a long time. So we don't actually know the number of people that was impacted. But whilst it could have been millions with the amount of people that use this application, it was probably far, far less and maybe in the hundreds or even potentially a handful of very select high-value people. And this is why an attack that started in June we're finding out about now because they were able to go undetected for so long because they were targeted. So how did this actually work? Well, the Notepad application during the update processes downloaded something suspicious called update.exe. And it did this from an unknown IP address. There was a malicious payload, the update.exe. They actually used a common framework for installation, the NSIS framework. And it did a series of things to install this, dropped files into a kind of a hidden folder inside your appdata/Bluetooth and ultimately it used DLL sideloading to deliver the payload. What that ultimately did was install a backdoor onto the computer. Now, this was a backdoor that isn't documented in the wild. Usually, groups will use documented backdoors, but this one appears to be brand new and purpose-built for this campaign. Rapid7 analyzed it and named it CrySales. And essentially, it's just a persistent backdoor that an attacker can use to gain remote access to a machine. So you can imagine if they're really targeting, let's just say government workers from the US government, they find a select people to install this backdoor and it may have been there since June of 2023. It's a pretty scary thought. So who actually is behind this? Well, most people agree that it's very likely a China-backed APT based on the behavior, the IP addresses, and certain characteristics which signify that. Different articles have accredited it to different APTs, but all of them share that they're stemming from China. So could this happen again? Well, it could, but not in this exact method. Notepad++ have changed the method on which they deliver updates to make sure that only authentic updates are actually accepted. So they've changed the way that they sign their updates to prevent this from happening in the future. If you are using Notepad++, please make sure you update to the latest version, at least 8.8.9. There will be some odd behavior whilst you're updating this because of the way that the signatures have changed. There has been an update in the Coinbase breach that happened last year in May. The hacking group Shiny Hunters, which has claimed responsibility for it, first demanded a $20 million ransom for not releasing information stolen from Coinbase. The data that they stole included the name, social security numbers, bank details, and transaction history. But it stopped short of providing passwords or access into Coinbase customers accounts. Instead of paying the $20 million ransom, Coinbase instead actually offered a $20 million reward for any information that led to the arrest of individuals involved in this. There was actually one Coinbase team member or employee that was arrested in December of last year. This was a customer support employee from India that allegedly was recruited by Shiny Hunters to provide them with information to access the accounts. Well, the new development is that Shiny Hunters have piped up on Telegram, posting some snippets of what appears to be unreleased information about this threatening Coinbase. However, Coinbase are remaining strong in their commitment not to pay the ransom and do not believe that there's any value behind releasing that information. This post could be seen on one side as flash posting to try and taunt and tease Coinbase. On the other side, it could be seen as desperation as they take a last-ditch effort to try and get some money or extort some money from Coinbase. Related to this, Coinbase has actually said that they've lost a total of $37 million which are costs associated with various different breaches and the impact that they had direct and indirect. Compiling to that, they're also facing a class action lawsuit against Coinbase from their shareholders saying that they didn't report this breach in fast enough time. And in our final news story, and I'm not going to lie, this one irritates me to absolutely no end. Two penetration testers have earned a $600,000 settlement against Dallas County in Iowa after they were prosecuted for doing their job. So, if you're not familiar, penetration testers or pen testers are ethical hackers that are employed to break into systems to try and find security vulnerabilities. What is insane about this story is that even though they had the letter of intent and permission to perform this ethical penetration test, prosecutors from the county deemed that they illegally hacked into systems despite reporting everything in an official report and tried to prosecute them. Penetration tests of this kind often include physical elements. It's about trying to physically go into a place to install USB sticks to test security. It's a really important part that is often forgotten when it comes to cybersecurity is what happens if someone just walks in. And this is why it led to a burglary charge. But despite having all the proper documentation, they were insistently prosecuted even after it became abundantly clear that they were just trying to do their job. And this really outlines the kind of threat that red teamers actually have to accept when conducting this job that you might not always get it right. Well, I'm going to stop with this story there because I'll end up going into a big old rant and no one wants to hear that. Or maybe you do. Well, we can do that offline. We have news coming out every Thursday and thought leadership episodes every Tuesday. So, make sure you subscribe to the channel, like this video, and share it with a friend. It really helps. And I'll see you next time.
