4 ms·
The article is a bit sparse on details of the actual attack; Was the original site not over https? Or was the attacked site storing session cookies in insecure
by archgoon 9y ago
The article is a bit sparse on details of the actual attack; Was the original site not over https? Or was the attacked site storing session cookies in insecure cookies?
- detaro 9y agoIf you control DNS, you can just get a new certificate, e.g. from Let's Encrypt. Game over without pinned keys.
- asllsa 9y agoWarning: just a guess, I don't actually know Probably a combination of the DNS hijack + no HSTS Alternatively, let's encrypt (and probably others) has DNS based verification.
- thoop 9y agoThe website owner posted an update on this Reddit thread: https://www.reddit.com/r/Stellar/comments/7q9g31/statement_blackwallet_hacks_update/ https://www.reddit.com/r/Stellar/comments/7q9g31/statement_b... It looks like the hacker was able to log into the website's hosting provider account. The hacker then changed the DNS to point to a different server that had an exact copy of the blackwallet.co website but with a small injection of some javascript to siphon off the master keys that people were entering.
- rootsudo 9y agoSimple yet effective.