Scans Target Solana API Endpoints, Probing for 'surfpool' and Credentials
Automated scans are actively probing internet-facing systems for Solana API endpoints, specifically targeting the 'surfpool' implementation and searching for sensitive credential files.
Automated scanning activity has been observed targeting Solana API endpoints, with a particular focus on identifying the 'surfpool' implementation. Threat actors are sending crafted JSON-RPC requests, such as 'getHealth' and 'getVersion', to common web ports like 80. This suggests an assumption that a reverse proxy or API gateway is in place, mapping these requests to the actual Solana API, which typically listens on port 8899.
The observed requests are formatted as POST requests to a '/solana' path, though the path itself is likely not a strict requirement and may be ignored by the scanner. The scanner also probes for other potential API endpoints including '/jsonrpc', '/rpc', '/v1', and even the root path '/', indicating a broad approach to discovering Solana-related services.
In addition to API endpoint discovery, the same scanning activity is concurrently searching for files commonly associated with credentials. This includes attempts to locate files like '.env', '.env.bak', and '.env.local', which often store sensitive configuration data, API keys, and database credentials.
The 'surfpool' implementation is a tool frequently used by developers for testing programs before deploying them to a live Solana network. Its presence on internet-facing infrastructure, even behind a proxy, indicates potential exposure of development or testing environments.
While the immediate impact of these scans is primarily reconnaissance, the combination of probing for API endpoints and credential files presents a significant risk. Successful identification of 'surfpool' could lead to further exploitation of vulnerabilities within the Solana development ecosystem, while the discovery of credential files could grant attackers direct access to sensitive systems and data.
The scanner's user agent, 'HelloScan/1.0', is also noted, aiding in the identification and tracking of this specific scanning campaign. Security professionals are advised to monitor network traffic for similar patterns and ensure that development and API endpoints are adequately secured and segmented from production environments.
This activity underscores the ongoing efforts by threat actors to identify and exploit vulnerabilities within the rapidly evolving cryptocurrency and blockchain infrastructure. The targeting of API endpoints and the opportunistic search for credentials highlight a common reconnaissance methodology employed across various sectors.
Organizations utilizing Solana or similar blockchain technologies should review their network configurations, ensure API endpoints are properly secured, and implement robust credential management practices to mitigate the risks posed by such scanning activities.