5 ms·

> On Monday, 17 January 2022 at approximately 12:46 AM UTC Crypto.com’s risk monitoring systems detected unauthorized activity on a small number of user account

> On Monday, 17 January 2022 at approximately 12:46 AM UTC Crypto.com’s risk monitoring systems detected unauthorized activity on a small number of user accounts where transactions were being approved without the 2FA authentication control being inputted by the user. This triggered an immediate response from multiple teams to assess the impact. I sometimes find it hard to believe these statements, but I guess I can only take them at face value. Which seems more likely, that these "risk monitoring systems" actually caught this, or that they were inundated by sudden urgent calls from the 483 users saying "DUDE WTF WHERE'S MY MONEY?".

deegles 5y ago
Responding to escalations from customer support is a risk monitoring system, just not a very good one.
- kgermino 5y ago
  Worse, many companies can't even do that reliably.
- deleted 5y ago
  [deleted]
Shank 5y ago
> Which seems more likely, that these "risk monitoring systems" actually caught this, or that they were inundated by sudden urgent calls from the 483 users saying "DUDE WTF WHERE'S MY MONEY?". For better or for worse, a lot of insight can be gained from a sudden influx of tickets from normally-quiet users, all with the same general story. This is definitely how many critical bugs in production are caught, because even a small number of disparate users that suddenly write in about the same issue is a huge red flag. But, most likely, they have metrics on average withdrawal amounts, deposit amounts, etc., hooked up to something like datadog, with an off-the-shelf anomaly detection monitor.
- wpietri 5y ago
  > But, most likely, they have metrics on average withdrawal amounts, deposit amounts, etc., hooked up to something like datadog, with an off-the-shelf anomaly detection monitor. How are we estimating the likelihood here? I agree that would be desirable. I agree a very together company might have something like that. But given the average level of competence and professionalism in the cryptocurrency sector [1], I would not bet against EMM_386's theory in this case. [1] See, e.g., https://web3isgoinggreat.com/ https://web3isgoinggreat.com/ or https://bravenewcoin.com/insights/36-bitcoin-exchanges-that-are-no-longer-with-us https://bravenewcoin.com/insights/36-bitcoin-exchanges-that-...
nrmitchi 5y ago
Massive uptick in customer support tickets is technically a monitoring system. Just a highly reactionary one.
lr1970 5y ago
> detected unauthorized activity on a small number of user accounts where transactions were being approved without the 2FA authentication control being inputted by the user. How am I supposed to read it: is it a 2FA compromise (attacker replaced 2FA codes with their own) or 2FA bypass (attacker found a way to conduct a transaction bypassing a need for 2FA)? These are two very different scenarios.
prepend 5y ago
> sudden urgent calls from the 483 users This may be their only risk monitoring system. I’ve seen many DR plans that had this kind of detail written up in “consultant speak” with a straight face. Where they would detect server crashes by users calling them and their systematic method to failover was to manually rebuild.
deleted 5y ago
[deleted]
perlgeek 5y ago
If it's true, there's this funny situation where the exchange/banking software didn't require 2FA to withdraw funds, BUT their monitoring noticed this situation. So their monitoring is smarter than their main application? Wow, just wow.

deegles 5y ago

Responding to escalations from customer support is a risk monitoring system, just not a very good one.

kgermino 5y ago
Worse, many companies can't even do that reliably.
deleted 5y ago
[deleted]

Shank 5y ago

> Which seems more likely, that these "risk monitoring systems" actually caught this, or that they were inundated by sudden urgent calls from the 483 users saying "DUDE WTF WHERE'S MY MONEY?". For better or for worse, a lot of insight can be gained from a sudden influx of tickets from normally-quiet users, all with the same general story. This is definitely how many critical bugs in production are caught, because even a small number of disparate users that suddenly write in about the same issue is a huge red flag. But, most likely, they have metrics on average withdrawal amounts, deposit amounts, etc., hooked up to something like datadog, with an off-the-shelf anomaly detection monitor.

wpietri 5y ago
> But, most likely, they have metrics on average withdrawal amounts, deposit amounts, etc., hooked up to something like datadog, with an off-the-shelf anomaly detection monitor. How are we estimating the likelihood here? I agree that would be desirable. I agree a very together company might have something like that. But given the average level of competence and professionalism in the cryptocurrency sector [1], I would not bet against EMM_386's theory in this case. [1] See, e.g., https://web3isgoinggreat.com/ https://web3isgoinggreat.com/ or https://bravenewcoin.com/insights/36-bitcoin-exchanges-that-are-no-longer-with-us https://bravenewcoin.com/insights/36-bitcoin-exchanges-that-...

nrmitchi 5y ago

Massive uptick in customer support tickets is technically a monitoring system. Just a highly reactionary one.

lr1970 5y ago

> detected unauthorized activity on a small number of user accounts where transactions were being approved without the 2FA authentication control being inputted by the user. How am I supposed to read it: is it a 2FA compromise (attacker replaced 2FA codes with their own) or 2FA bypass (attacker found a way to conduct a transaction bypassing a need for 2FA)? These are two very different scenarios.

prepend 5y ago

> sudden urgent calls from the 483 users This may be their only risk monitoring system. I’ve seen many DR plans that had this kind of detail written up in “consultant speak” with a straight face. Where they would detect server crashes by users calling them and their systematic method to failover was to manually rebuild.

deleted 5y ago

[deleted]

perlgeek 5y ago

If it's true, there's this funny situation where the exchange/banking software didn't require 2FA to withdraw funds, BUT their monitoring noticed this situation. So their monitoring is smarter than their main application? Wow, just wow.