13 ms·

> The hacker was able to steal an API key that gave them control of BadgerDAO’s account on Cloudflare, the project’s content delivery network for its site. This

> The hacker was able to steal an API key that gave them control of BadgerDAO’s account on Cloudflare, the project’s content delivery network for its site. This gave the hacker the ability to inject a malicious script on the site that prompted users to give up wallet permissions, which then allowed the hackers to steal customers’ cryptocurrency. If your use case involves being able to control user accounts centrally, why do you need blockchain for that? UPD: if hacker didn't do it, BadgerDAO could do it anytime in the future, when money is much more than now, so it is good that they were hacked earlier, smaller impact on end users

pjc50 5y ago
> why do you need blockchain for that? As Willie Sutton said, that's where the money is. https://www.nytimes.com/1979/08/26/archives/willie-sutton-said-it-first-thats-where-the-money-is.html https://www.nytimes.com/1979/08/26/archives/willie-sutton-sa... (Imagine having to go to the trouble and risk of walking into a bank with a gun for a mere thirty thousand 1979 dollars, when you could steal one hundred million dollars by compromising some software!)
- Hamuko 5y ago
  ($30,000 adjusted for inflation would be worth about $114,300 in 2021)
  - pjc50 5y ago
    Now you see if you'd stolen one bitcoin in 1979, it would still be worth one bitcoin in 2021! Price stability!
gruez 5y ago
>If your use case involves being able to control user accounts centrally, why do you need blockchain for that? AFAIK the accounts are not controlled centrally. How it works is that the project owners set up a site/webapp, which has javascript that interacts with wallet extensions installed on the user's browser. Members of the DAO uses the site to do various actions, for instance buying tokens or making votes. The site sends the request to the wallet extension to be signed, and then it gets broadcasted to the ethereum network. At the end of the day, the wallets are still controlled by the user, it's just that hijacking the site allows them to fool a massive number of users that don't pay close attention.
- carlosdp 5y ago
  ^ this is correct, BadgerDAO has no control over user accounts, this is purely a frontend that was manipulated. You could redploy the frontend from source somewhere else without asking Badger and it would work just as well.
- mushufasa 5y ago
  if a single point of failure impacts the actions of a large number of users, that would count as central control in my book
  - carlosdp 5y ago
    You don't have to use the frontend they host, it's not an actual single point of failure. Their frontend could go down, and as long as someone else is hosting one (or you download the source from github and host it locally) you can still use Badger.
    - mikeheaton 5y ago
      If the failure of this single point led to the loss of $114m, that counts as a SPoF in my book regardless of what the platonic ideal user “could” or “should” have done.
    - diveanon 5y ago
      You don’t even need the front end, you can interact with the contract directly. It’s sad what happened to these users, but they did sign the contract giving the hackers permission to access wallet funds. This is a failure of opsec.
  - toolz 5y ago
    presumably the code being distributed to users could then be redistributed by those users, making this not a SPoF it just happened to be an overly trusted point of failure
- pjc50 5y ago
  > wallet extensions installed on the user's browser Absolute security nightmare in both directions, this.

pjc50 5y ago

> why do you need blockchain for that? As Willie Sutton said, that's where the money is. https://www.nytimes.com/1979/08/26/archives/willie-sutton-said-it-first-thats-where-the-money-is.html https://www.nytimes.com/1979/08/26/archives/willie-sutton-sa... (Imagine having to go to the trouble and risk of walking into a bank with a gun for a mere thirty thousand 1979 dollars, when you could steal one hundred million dollars by compromising some software!)

Hamuko 5y ago
($30,000 adjusted for inflation would be worth about $114,300 in 2021)
- pjc50 5y ago
  Now you see if you'd stolen one bitcoin in 1979, it would still be worth one bitcoin in 2021! Price stability!

gruez 5y ago

>If your use case involves being able to control user accounts centrally, why do you need blockchain for that? AFAIK the accounts are not controlled centrally. How it works is that the project owners set up a site/webapp, which has javascript that interacts with wallet extensions installed on the user's browser. Members of the DAO uses the site to do various actions, for instance buying tokens or making votes. The site sends the request to the wallet extension to be signed, and then it gets broadcasted to the ethereum network. At the end of the day, the wallets are still controlled by the user, it's just that hijacking the site allows them to fool a massive number of users that don't pay close attention.

carlosdp 5y ago
^ this is correct, BadgerDAO has no control over user accounts, this is purely a frontend that was manipulated. You could redploy the frontend from source somewhere else without asking Badger and it would work just as well.
mushufasa 5y ago
if a single point of failure impacts the actions of a large number of users, that would count as central control in my book
- carlosdp 5y ago
  You don't have to use the frontend they host, it's not an actual single point of failure. Their frontend could go down, and as long as someone else is hosting one (or you download the source from github and host it locally) you can still use Badger.
  - mikeheaton 5y ago
    If the failure of this single point led to the loss of $114m, that counts as a SPoF in my book regardless of what the platonic ideal user “could” or “should” have done.
  - diveanon 5y ago
    You don’t even need the front end, you can interact with the contract directly. It’s sad what happened to these users, but they did sign the contract giving the hackers permission to access wallet funds. This is a failure of opsec.
- toolz 5y ago
  presumably the code being distributed to users could then be redistributed by those users, making this not a SPoF it just happened to be an overly trusted point of failure
pjc50 5y ago
> wallet extensions installed on the user's browser Absolute security nightmare in both directions, this.