Thread by @krippenreiter

[1/🧵] A MASSIVE attack on the JavaScript ecosystem is currently underway. ☹️

Since JavaScript is at the heart of what we use every day to browse the internet, you MUST be extra vigilant.

Let's take a look at a possible solution for the XRP ecosystem. 👇🧵

[2/13] — 1⃣ First things first —

Although the entire JavaScript ecosystem is at risk, the malware appears to be targeting only a few blockchain ecosystems, based on the addresses it uses to steal funds:

‼️ At risk 👇

[3/13] — 2⃣ First things first —

The reason this is such a big deal is because of the sheer volume of weekly downloads of the maliciously patched packages.

[4/13] — 3⃣ First things first —

Here's the TL;DR for you as a developer. 👇

[5/13] — The Malware —

One nasty thing about this malware is that checking the destination address doesn't help this time, unless you're using hardware wallets, because the address gets replaced anyway BEFORE it's signed. ☹️

👉 You might think you're safe, but you're not.

[6/13] — 1⃣ XRP Ledger / Solution —

Introducing a possible solution for the XRP ecosystem, is a draft that @krisdangerfield and @angell_denis are working on, namely:

🔸 0086 XLS-86d: Firewall

[7/13] — 2⃣ XRP Ledger / Solution —

"Firewall" would allow you to configure the following:
🔸 Time-based outgoing transactions
🔸 Value-limited safeguards

And most importantly:
‼️ Creation of a whitelist mechanism

[8/13] — 3⃣ XRP Ledger / Solution —

Since the malware doesn't steal PKs, the first two aspects of the "Firewall" are less important.

The whitelist on the other hand, which would've been set up to help you bypass the Firewall restrictions for everyday TXs, would protect you! 🔥

[9/13] — 1⃣ Firewall —

The rationale, as perfectly explained in the draft is that when enabled on an account, it will prevent an attacker from:
🔸 Instantly draining your funds

Provides you with:
🔸 Opportunity to move your XRP to an alternative account

[10/13] — 2⃣ Firewall —

This essentially means that even if you would ever sign a transaction to send your funds to wrong addresses, the Firewall would protect you because the address isn't known to your configured whitelist. 🫡

[11/13] — Summary —

🔸 The JavaScript ecosystem got hijacked
🔸 Don't sign TXs using browser extensions for some time
🔸 Triple-check the destination address on the display of your hardware wallet
🔸 Check out: xrplfirewall.com
🔸 Check out: jdstaerk.substack.com/p/we-just-foun…

[12/13] — Krippenreiter —

I write about DLT and crypto, but primarily about XRP and the XRPL-ecosystem. 🔥

If this interests you and you want to learn more, please follow me here:
@krippenreiter

Feel free to contribute by sharing here 👇

[13/13] — Support & Donate —

@threadreaderapp unroll