Containment and the response clock

Graduate · enrolled learners

This lesson opens with The Ledger Connect Kit supply chain attack, 14 December 2023.

What happened

A former Ledger employee was phished and the attacker obtained their session token for the NPM package registry, bypassing two-factor authentication; the employee's access had not been revoked when they left. Using it, the attacker published malicious versions of the Ledger Connect Kit, a library that many decentralized applications load into their front ends to connect wallets, at 09:49, 10:44 and 11:37 Central European Time on 14 December (versions 1.1.5, 1.1.6 and 1.1.7), with code that used a rogue WalletConnect project to redirect users' assets to the attacker's wallets. Front ends reported as compromised included Zapper, SushiSwap, Balancer and Revoke.cash. Ledger's report states that it was made aware of the attack at 13:45, partly through ecosystem participants including Blockaid, that its technology and security teams were alerted at 14:18, that a genuine version was deployed within 40 minutes of Ledger becoming aware, and that about five hours passed from the compromise of the registry to complete resolution, the malicious file remaining accessible a little longer after the fix because of the content delivery network's caching. Ledger estimated the window in which assets were actively drained at under two hours in total, and on 20 December said it was aware of approximately $600,000 in assets impacted.

The decision point

The fix took under forty minutes from the moment Ledger knew. Being safe took about five hours from the first malicious publish: almost four of them before anyone at the publisher knew, and the rest after the fix, because a fix is not in the user's browser until every cache between the publisher and the page has picked it up, and the malicious file sat in those caches with the fixed one behind it. The report separates the two clocks honestly, and the separation is the lesson: containment is not the moment the leader does the right thing, it is the moment the last copy of the wrong thing stops being served, and every cache, mirror, pinned message, forwarded email and integration is a copy. A community leader who has pulled the post has not contained the incident until the screenshots of it, the mirror in the other server and the bot that reposts announcements have been dealt with, and the clock that gets published afterward is the second one.

Recorded loss

$600,000

Orientation and Year One are open: anyone can read them without an account. From Year Two onward the lessons are for enrolled learners, because progress through the later years only means anything if it is tracked against a record.

It is free. We do not sell the list and there is nothing to buy at the end of it.