Trojanized Newtonsoft.Json Fork Hides Game-Rigging Code in a Working Library
Cybersecurity researchers have discovered a NuGet typosquat that's designed to rig live game results on Digitain. The package, named 'NewtonSoftt.Json.Net', masquerades as the Newtonsoft.Json library and is a trojanized fork.
Intelligence analysis by Llama
A NuGet typosquat has been discovered that rigs live game results on Digitain. The package, named 'NewtonSoftt.Json.Net', is a trojanized fork of Newtonsoft.Json and has been downloaded about 1,200 times to date.
Imagine you're playing a game online, and someone is secretly changing the rules to make it unfair. That's what's happening with a special kind of malware that's hiding in a popular software library. It's called a 'typosquat' because it's a fake version of the real library, and it's designed to rig live game results on a specific website. The malware is clever because it only activates when the game is being played, and it only affects the game, not the rest of the software. But it's still a big problem because it can make the game unfair and potentially cost people money.
Analysis
A $60B Vote of Confidence
The discovery of a NuGet typosquat that rigs live game results on Digitain is a significant finding in the world of cybersecurity. The package, named 'NewtonSoftt.Json.Net', masquerades as the Newtonsoft.Json library and is a trojanized fork. This means that developers who install it by typo get a real, working Newtonsoft.Json build, but the malicious behavior begins after the host initializes JsonConvert.DefaultSettings.
The trojanized fork has been published to the NuGet repository seven times, with the first version being 11.0.4 and the latest being 11.0.11. The package has been downloaded about 1,200 times to date, and its metadata has been found to leak an internal Digitain repository URL seven times, indicating that the author had access to FG-Crash's source code.
The primary victim of the rigging is Digitain, the operator of the FG-Crash betting game. The package only activates when JsonConvert.DefaultSettings is assigned and only patches a method present in the FG-Crash backend. Non-targeted consumers may see only a working JSON library and no rigging behavior, which is exactly what makes this typosquat attack so effective.
To counter the threat, developers are advised to remove the typosquat package, block the command-and-control (C2) address, and pin Newtonsoft.Json to a known-good version via packages.lock.json. Digitain has revealed that it has been aware of the issue and has taken steps to resolve it, but the full extent of the exposure remains unknown.
Why Cursor?
The trojanized fork is designed to target servers running Digitain's crash-game backend and exfiltrate rigged results to a hard-coded exfiltration point. The end goal is to compromise the integrity of the crash game, and the package only activates when JsonConvert.DefaultSettings is assigned.
The Road Ahead
The discovery of this trojanized fork highlights the importance of supply chain security and the potential for malicious actors to compromise software libraries. It also underscores the need for developers to be vigilant and take steps to protect themselves from such threats. By removing the typosquat package, blocking the C2 address, and pinning Newtonsoft.Json to a known-good version, developers can help prevent similar attacks in the future.
Key points
- A NuGet typosquat has been discovered that rigs live game results on Digitain.
- The package, named 'NewtonSoftt.Json.Net', is a trojanized fork of Newtonsoft.Json.
- The trojanized fork has been published to the NuGet repository seven times.
- The package has been downloaded about 1,200 times to date.
- The primary victim of the rigging is Digitain, the operator of the FG-Crash betting game.
The discovery of this trojanized fork highlights the importance of supply chain security and the potential for malicious actors to compromise software libraries. It also underscores the need for developers to be vigilant and take steps to protect themselves from such threats. By removing the typosquat package, blocking the C2 address, and pinning Newtonsoft.Json to a known-good version, developers can help prevent similar attacks in the future.
The full extent of the exposure remains unknown, and it's unclear how many developers may have installed the malicious package. Additionally, the fact that the package was able to evade detection for so long highlights the need for improved security measures in the software supply chain.
