In 1982, Mr. Xu Qibin, known as the contemporary Jiao Yulu, shouted the slogan “If you want to get rich, build roads first” in Meishan, Sichuan, which deeply impressed us. Outdated transportation hinders the process of converting local resource advantages into economic advantages, and outdated transportation limits local economic development. Transportation brings convenience to logistics and cultural exchanges while also bringing tangible income to local finances; this entrance is the toll station.

Friends who have played with credit cards should know that in the credit card community, those who take advantage of rewards are called big players, and these people spend tens of thousands each month? Do they hang out with young models every day? So how do these big players exploit the bank’s rewards? Most bank activities are designed based on cardholders’ spending limits, and the spending scenarios are nothing more than online consumption such as Alipay, WeChat Pay, UnionPay online, and offline merchants using POS machines.

Merchants use POS machines obtained from acquiring institutions to swipe cards for customers, then print receipts and take the receipts to settle with the acquiring institution, which charges a fee based on the contract signed with the merchant. Here we can consider the flow of consumption as a highway, so it’s not hard to understand why the acquiring institutions behind the POS machines are likened to toll stations.

After tricking you out of 400 words of manuscript fees, we officially introduce the topic of this article.

A recent article from Ars Technica about a blockchain currency theft case tells how iotaseed.io (which has now shut down) stole $4 million worth of IOTA coins from user wallets by generating malicious seed addresses. The article did not analyze the related code but simply made us aware of such a trick.

Finding the Code

Since iotaseed.io has ceased operations, fortunately, we found the historical page of the site.

At the bottom of the page, we found a link to a GitHub repository, which emphasized using the services provided by the site rather than letting users download the code directly from GitHub. The reason given was also quite sufficient: “The repository contains new code that has not been fully tested.”

Could it be that scripts not present in the repository were added to the actual site? If this assumption holds, it can explain why the stolen users mentioned iotaseed.io instead of the GitHub repository.

However, the repository address provided by the site has been deleted, and the owner who created that repository, norbertvdberg, has also canceled his account. Attempts to read or download the code through the historical pages provided by archive.org show that the page is not archived. The code repository had 8 forks, and from the GitHub user manual, we learned that even if the project is deleted, the previously forked branches will be preserved! We still have hope of seeing samples.

Based on a commit message displayed on the original repository’s historical page, I searched on GitHub.

eggdroid/eggseed3 seems to have forked the original repository’s code, corresponding to the 26 commits submitted by the original repository author norbertvdberg.

At this point, gathering two samples can summon the dragon.

Analyzing the Code

This Seed address generator consists of multiple different JavaScript scripts, which we merged into a file named all.js, then compressed it into all.mini.js, which is actually the file provided by the webpage. We compared the all.mini.js retrieved from the historical page with the all.mini.js sample obtained from GitHub.

The two files are identical, so it’s time to dive into the code. I noticed that once the Seed address is generated, a Web Worker object is called to generate a QR code and the Seed address information. This Worker object comes from a separate file all-wallet.mini.js. Does this file hide the ugly PY transactions? We shall see.

By comparing the two all-wallet.mini.js file samples, we preliminarily confirmed that the two samples are indeed different. With a pounding heart, I organized the two samples using js-beautify and used the diff command to confirm where the problem lies.

However, the only difference between the two samples is that the sample retrieved from the time machine has rewritten resources and the URLs point to web.archive.org. From the perspective of the Seed address generation function, the two samples seem to be identical.

After that, I looked at the index.html page and found that the page also loaded a JavaScript file, a notification library. After downloading, comparing the time machine version with the GitHub version, we indeed found clues.

To hide the author’s good intentions, who can understand? The Notifier.notify method has been modified to check whether the image parameter contains “,T”, parsing part of the code into JavaScript and making a judgment. Another modification is that when the page loads, it increases the call to the Notifier.init() method, invoking the notify method that contains the image parameter to trigger the execution of that code.

Executing eval(atob(image.split(“,”)[2])) will reveal the following code snippet:

The second phase of the malicious code places ./images/logo_small_bottom.png in a way we cannot see.

This is the final stage of the JavaScript backdoor; let’s simplify it:

The code modifies the Math.seedrandom function used to generate codes, using a fixed number 4782588875512803642 plus a count variable seedrandom, which causes Math.random() to return the same data each time, resulting in a predictable series of numbers, ultimately generating the same IOTA Seed addresses. This explains why you get the same Seed address every time you open the archive of iotaseed.io:

Even if you change computers, the result is the same.

Another thing to note is that the RNG obtained by each user (“4782588875512803642” is obtained from the historical sample) is not the same. By comparing October 31st and November 19th, it was found that this number changes over time. This means that ./images/logo_small_bottom.png is dynamically generated by the iotaseed.io server. After creating this PNG file, the number used to modify the random function will also change (or be stored elsewhere, anyway, it needs to utilize the attacker to steal IOTA), it seems that the site indeed generates different Seed addresses for different users. This demo shows how the code changes.

According to the IOTA official JavaScript library, we know that the Seed address mentioned earlier (XZHKIPJIFZFYJJMKBVBJLQUGLLE9VUREWK9QYTITMQYPHBWWPUDSATLLUADKSEEYWXKCDHWSMBTBURCQD) corresponds to the wallet address PUEBLAHRQGOTIAMJHCCXXGQPXDQJS9BDFSCDSMINAYJNSILCCISDVY99GMKAEIAICYQUXMIYTNQCJYVDX. From the iotabalance.com website, we learned this is an empty wallet, however querying this wallet address from similar websites returns a 404 error, like this example.

Conclusion

Recalling the method of placing the backdoor, if you insist on saying this was an unintentional mistake, then I have no choice. Now we are unclear whether these codes were created by norbertvdberg or other attackers. However, from the owner’s subsequent deletion of GitHub, Reddit, and Quora accounts, it seems they cannot escape the relationship.

The backdoor is indeed well hidden; it is hard to find clues just by glancing at it through the browser’s developer tools.

So still, as they say, if you want to get rich, build roads first!

Reference source GitHub, with some modifications to the original text…