10 ms·
Firefox zero-day was used in attack against Coinbase employees, not its users
- camjohnson26 7y agoits Interesting how cryptocurrencies have provided an economic incentive for exploiting zero days. It’s hard to keep an exploit a secret when there’s such huge potential payoffs. The level of sophistication in crypto hacking would terrify me if were a crypto startup employee.
- Sahhaese 7y agoIf I were a crypto startup I'd be more worried about insider threat than anything sophisticated. Protecting against a rogue employee also adds defence against employee computer compromise.
- verroq 7y agoInsider threat is probably non-existant. You know all your employees and if a hack happens there is an easy list of people to investigate. Also trying to cash out large amounts of stolen crypto is going to be difficult with the amount of blockchain analysis going on and all fiat exchanges requiring KYC.
- camjohnson26 7y agoI wouldn’t be so sure. There have been situations where insiders stole crypto and then claimed they were hacked to cover it up. Looks like Gelfman Blueprint is an example and there are almost definitely others.
- nodesocket 7y agoOr if the insider slowly siphoned off tiny amounts from lots of accounts over a long period of time. That sort of thing would probably be very hard to catch. I am not likely to notice one day if I have 4.96551 ETH and the next 4.96530 ETH
- deleted 7y ago[deleted]
- leppr 7y agoA good wallet would show the last transactions prominently. Also you can setup email alerts for ETH transfers from/to your account with a tool like etherscan.io. That's the advantage of public ledgers, it's way easier to monitor for abnormalities. You don't need to tell your employees about all the checks you have put in place either.
- gruez 7y ago>I am not likely to notice one day if I have 4.96551 ETH and the next 4.96530 ETH note to self: only keep round amounts in online wallets.
- JumpCrisscross 7y ago> there is an easy list of people to investigate If the criminal has an ounce of brains, they'd execute the hack while on an overseas vacation.
- chatmasta 7y agoKYC should really be renamed CYA (cover your ass), because it's borderline useless as a real security measure against determined threat actors. For anyone willing to commit fraud and/or identity theft, it would be relatively easy to "pass" a KYC process under an assumed identity, especially when no in-person/biometric verification is required.
- rdl 7y agoInsider threat is absolutely a risk. The other risk if you don't fully and publicly mitigate insider threat is someone applying pressure to your employees to do something bad. (The intel community and other high risk environments have long had this threat model). This is basically identical to insider threat at time of pressure, although there are some different countermeasures leading up to it. The low end of this is catching someone doing something they shouldn't (browsing porn on a work computer, having a relative with legal difficulties, etc.) and applying that as leverage. Usually "report early, no action will be taken against you" is a good policy for minor things. I would NEVER expect (or want) someone to do anything but fully comply with an attacker who has kidnapped his kid and credibly threatens to do something horrible unless he authorizes a payment. My instructions to the insiders are "comply; we have technical countermeasures which will make those attacks fail".
- eggsome 7y agoAccording to this story (https://news.bitcoin.com/looting-fox-sabotage-shapeshift https://news.bitcoin.com/looting-fox-sabotage-shapeshift) the threat is real and at least one person got away with it.
- Aaronstotle 7y agoSpeaking as someone who works for a crypto-startup, it's hardly soothing to know that we are a gigantic target for hackers. Also have the joy of being consistently bombarded with phishing emails pretending to be from other employees.
- minderasure 7y agoFor internal funds use Multi-sig and require all signers to use hardware wallets. As for contracts, formally verify them using KEVM and get audited by a reputable cybersecurity firm like Trail of Bits.
- dgacmu 7y agoEnable advanced protection on your personal Google account while you're at it. Bit of hassle, lot of benefit.
- ga-vu 7y agoArticle poses a good question. How did a privately reported zero-day leak from Bugzilla into an attacker's arsenal? Also, why did it take 2 months to fix an RCE? It's an RCE, not some XSS. I'd imagine this would be a high-priority. No?
- jessaustin 7y agoTFA's first answer is the most likely. If one researcher discovers a vulnerability, another researcher can also discover it. No "leak" required. I agree that RCE should be a priority!
- Scaevolus 7y agoI'm betting on insider access. Microsoft had to lock down internal access to their security bugs when some employees were selling the bugs on the black market.
- garren 7y agoDo you have a source for that? Google's not giving me anything. I'd definitely like to know more - I can't help but wonder how widespread that kind of behavior is.
- inetknght 7y agoNo source, but I'd be willing to bet it's very widespread.
- dboreham 7y agoLocking security bugs from wide internal read access has been SOP everywhere I've worked for decades.
- laughinghan 7y agoI think they're asking for a source on the specific claim about Microsoft employees selling bugs on the black market, which is what I would also like to see. I don't need to be convinced that security bugs should be on a need-to-know basis during the responsible disclosure period, that seems obviously prudent. Anyone not working specifically on security can learn about the details at the same time as the wider public.
- xtalh 7y agoWhy were Coinbase employees allowed to use Mozilla Firefox?
- aarpmcgee 7y agoWhy wouldn't they be allowed to use Firefox?
- therein 7y agoThey are not allowed actually. However maybe a few were anyway? As far as I can tell, this attack was fully unsuccessful anyway. They probably discovered phishing attempts with a link to a page deploying a curious payload. Regardless of my post above, keep in mind I do use Firefox primarily and see nothing wrong with it.
- xtalh 7y agoIt's worse than Chrome in every way. For example the privsep system is a joke. That's not to say that Chrome can't have an RCE but of course you don't have the same chances if the browser is much more secure. And if you work in an environment like Coinbase's you really should not take chances.
- ga-vu 7y agoProbably because 85% of the browser market it's Chromium-based, while the rest is not. Hence, a smaller attack surface.
- icebraining 7y agoThat's not what "attack surface" means. Firefox would have a smaller attack surface if it supported fewer file formats or protocols or such than Chrome.
- ga-vu 7y agoTrue. A smaller target base would have been the correct term.
- verroq 7y agoI am more interested in how Coinbase employees discovered the attack. I am assuming nobody clicked the suspicious link and instead took it to a vm for reversing and analysis. It would have been game over if the exploit was actually executed on a non-sandboxed machine.
- tedunangst 7y agoNotice unusual connections coming from one laptop, then use a second system to click on all the links they clicked the day before?
- nickpsecurity 7y agoThey left out one other opportunity: they purchased the 0-days from a broker or company like Zerodium. The cost might be worth it to them if there were high, perceived odds of getting in.
- tgragnato 7y agoIs it really that easy to get access to the exploits of the acquisition program? Throw them a bunch of money and it's yours?
- nickpsecurity 7y agoI'm not saying it was easy. I have no idea how those programs or the brokers supplying them work. In this hypothetical scenario, they could be regular customers operating within the suppliers' expectations. Alternatively, a broker has some 0-days that the big-name companies aren't buying or not at that price. Potentially already has them. Some other party is willing to buy them at a nice, but reduced, price. When I did thought experiments on it, one of the big issues for me was how to show buyers the vulnerability without losing money from them stealing it or deal with them claiming that they already had it in a way that minimizes risk to all parties. It was a tricky problem. Folks selling on the side was a potential result in some scenarios.
- docker_up 7y agoA good example of why HTML emails need to be downgraded to plain text in financial companies, and links stripped and checked before it's shown.
- inetknght 7y agoNow if only every company and their mother would stop using third parties for links. I don't care if you track that I clicked on your link. I care that your link doesn't appear to go to the same site your reply-to email would go.
- deleted 7y ago[deleted]
- tgragnato 7y ago> I care that your link doesn't appear to go to the same site your reply-to email would go. From one of the last emails I read this evening: "we would like to inform you that there is a form on our website" [me]: The form is not on your website, only the link to it. You're right, but it's much more simple to disallow links, people don't really understand the difference on a website, emails are another additional complication.
- inetknght 7y agoHow would you recover accounts if links weren't permitted?
- tgragnato 7y agoI'm late to this, but... 1. while developing -> send tokens for copy/paste if a user has chosen text-only emails 2. while administering -> institute the policy of having to ask one of the administrators, if it happens too often you have worse problems in any case
- sparkling 7y agoThe sad reality today is that a truly plain text email looks "phishy" to most end users today, as the result of 15+ years of facny HTML mails.
- deleted 7y ago[deleted]
- deleted 7y ago[deleted]
- deleted 7y ago[deleted]
- aaronharnly 7y agoI’d love to know how Coinbase discovered the exploit — whether on the employee desktops, due to unusual activity by the employee account on internal Coinbase systems, at the company network level, by a human or robot, etc.
- casper0_0 7y agohttps://twitter.com/SecurityGuyPhil/status/1141466335592869888 https://twitter.com/SecurityGuyPhil/status/11414663355928698...
- aaronharnly 7y agoThank you! Great that they shared the IOCs and IPs associated with the attack. That thread doesn’t really describe how they discovered it though, right?
- chessturk 7y agoHave they considered rewriting it in Rust?
- LUmBULtERA 7y agoSerious question, is Chrome considered to be more secure than Firefox by cybersecurity professionals? And if so, why?
- vinay_ys 7y agoDo we know how the exploit would be used? If you are accessing your mail account in the same browser, are you at risk?