26 ms·
A fake job offer took down Axie Infinity
- ineedasername 4y agoHow is Proof of Authority, mentioned in the article, any different than normal social trust and reputational risk associated with that? This seems like a cute way of wrapping up the status quo in crypto lingo.
- dboreham 4y agoAll it means is that the system organizers decided to make a certain set of keys able to vote on transaction validity. Similar for example to how browser vendors decide to make a certain set of keys valid for issuing certs.
- schemescape 4y agoThey say that a worker downloading (and presumably viewing) a PDF (fake job offer) allowed spyware in. Which PDF viewer was exploited?
- snickerbockers 4y agoim guessing it was the ol' ".pdf.exe" trick.
- hn_throwaway_99 4y agoThat trick doesn't work anymore for any reasonably modern email client.
- snickerbockers 4y agoThat's when you remind him that your boss needs to get this role filled by the end of the week so if you don't get a response by tomorrow you'll have no choice but to offer the job to another candidate.
- silverPoodle 4y agoYou can put it into a .zip archive or just send an email containing a link with a fake PDF
- bfgoodrich 4y ago
- j0hnyl 4y agoYou're downvoted, but I'm certain this is exactly what it is.
- Hamuko 4y agoThis sounds way too sophisticated for them to risk it with a "Offer.pdf.exe". Especially if it was state-backed. If the victim notices it, and the bar isn't high, you'd basically spook him away and alert the entire company.
- samatman 4y agoTo quote Fight Club: a major one.
- alexk307 4y agoYou can easily embed arbitrary javascript into any PDF, and you can obfuscate it pretty well enough to get past most endpoint security tools on the market.
- Nextgrid 4y agoThat JS would be sandboxed similar to in browsers, so you'd still need an exploit to break out of that.
- kube-system 4y agoNot too tough, if you're a state backed group. Just buy one. The going price for Adobe PDF RCE zero-days is $80,000
- Jwarder 4y agoIs there a good no-nonsense way to clean PDFs of possible threats? Hunting around I see mentions of converting PDF->Postscript->PDF to remove junk, but I also see mentions that Postscript is its own security mess.
- jabroni_salad 4y agoYour only option is to disable all of those fancy features. That config only lasts until someone needs to file a form with the government though.
- alexk307 4y agoYou’d be best suited making sure your pdf viewer is locked down and doesn’t allow for any js. You could parse your pdf pretty easily and read the sections before you open it, it’s mostly in plaintext
- jabroni_salad 4y agoUnfortunately, there is a scourge of PDFs that download the content after you open them, and have interactive features that should be on websites rather than PDFs. The BSA efiling system has mandatory forms for every bank to fill out, and if they say they say the browser's pdf viewer is no-go and you must configure adobe, that is what you will do. Now every bank in the USA has a hard dependency on adobe reader and a gpo that disables the web browser's built-in pdf reader. Thanks for that, fincen. https://bsaefiling.fincen.treas.gov/docs/BrowserSettingChanges.pdf https://bsaefiling.fincen.treas.gov/docs/BrowserSettingChang... [pdf warning]
- Nextgrid 4y agoI'm not sure it was even an exploit. It could very well be an intentionally-malformed PDF that pretends it has to be opened in a special "viewer" software, maybe even Adobe- or DocuSign-branded.
- hn_throwaway_99 4y agoTwo points to highlight from this article: 1. LinkedIn is an absolute godsend for bad guys, allowing easy targeting of everyone in the company with spear phishing emails and texts. I know many security professionals no longer use their real name, and don't list the real name of their company, because they know it's such a great hacking vector. Not sure what/whether LinkedIn can do anything about this. 2. I wish there were more information about what the vulnerability was in the PDF in the first place. I think a lot of people would be wary of downloading a PDF from a stranger, but not from someone who you had multiple interview rounds with and who offered you a job.
- lupire 4y ago
- koofdoof 4y agoHow usable is LinkedIn with a pseudonym? Is that a security industry only practice or could a regular dev get away with that too? I've always been shy about having a profile with my actual name but id consider one with a thin veil of anonymity.
- 8organicbits 4y agoSame, although my perception is that LinkedIn has moved past its peak usefulness, and it would be better to spend time on other platforms than creating a LI account. All I hear about LinkedIn these days is spam.
- bckr 4y agowhich other platform?
- 8organicbits 4y agoThere's a lot of platforms that do sort of related things, so it's a hard thing to answer. For "finding a job" I've been looking at HN, remoteok, and a bunch of others. For professional networking I use various tools run by former coworkers (mostly Slack and Google Groups). For "blogs" I use HN and Reddit. etc. I don't think LinkedIn does any of those better (my perception, I'm not a current user). Personally, I'm probably not interested in a LI clone for many of the reasons I stopped using LI. I deleted my LI account maybe 8 years ago, after getting too much spam (and I think some security issue?)
- CodesInChaos 4y agoDid this use a code-execution vulnerability in the PDF reader? or did they just trick the user into opening an executable?
- nemothekid 4y agoI’m assuming it was an exploit in Adobe reader. The target cloud have even been persuaded to install Adobe reader to “e-sign” the document. PDFs don’t have the best track record when it comes to security
- silentsea90 4y agoWhy do pdfs even allow executing code outside of the pdf env ie why isn't there a sandbox/apis that allow very limited operation?
- nemothekid 4y ago>Why do pdfs even allow executing code outside of the pdf env Some PM in 2006 thought it would be a good idea if PDFs were turing complete. I'm sure the word sandbox wasn't even thought about. 10 years later PDF (and more notably, Flash) became huge attack vectors. I think a far more interesting hack is when NSO used a PDF to embed a virtual machine inside an iPhone to develop a zero click exploit over iMessage: https://hothardware.com/news/zero-click-malware-pwns-iphone-virtual-cpu-y2k-image-tech https://hothardware.com/news/zero-click-malware-pwns-iphone-...
- silentsea90 4y agoWhat's the solution? Open pdfs on a VM, and never on your phone?
- pcthrowaway 4y agoCurious if anyone has been able to find technical details of how this attack works/worked. I'm under the impression most PDF viewers would prevent this sort of attack (e.g. opening a PDF in your browser should sandbox it to the browsing context), but really keen to know what PDF viewer / OS was used by the dev.
- jaywalk 4y agoProbably Acrobat.
- wespiser_2018 4y agoHere's a demonstration of some example attacks using pdf: executing arbitrary js, and connecting to a samba server: https://www.sentinelone.com/blog/malicious-pdfs-revealing-techniques-behind-attacks/ https://www.sentinelone.com/blog/malicious-pdfs-revealing-te... I'm not sure about this attack specifically, though, and in Ronin's post mortem they aren't really talking about that: https://roninblockchain.substack.com/p/back-to-building-ronin-security-breach https://roninblockchain.substack.com/p/back-to-building-roni.... To some extent, the PDF viewer/OS doesn't matter. A dedicated and well resourced attacker like the Lazarus Group will find holes in all of them. The "right" move here would have been for the employee not to download the compromised pdf, and short of that, for the IT Security team at Ronin to quickly detect the weird traffic that resulted and isolate the validators to prevent a compromise of their critical assets.
- the_gipsy 4y agoI know that document-rendering is much more complex than what it appears on the surface, but surely in this day and age there should be document viewers that don't run scripts and are exploit free.
- gowld 4y agoEvery program is potentially exploutable. The only defense is defense in depth, where an intrustion attempt fails at layer 3 of 5, alarms bells ring, and those 3 compromised layers get hardening upgrades. What usually happens is that layers 1 and 2 of 3 are constantly compromised, no one cares to follow up, and one day layer 3 gets compromised, shock of shocks.
- esseti 4y agoDid he get the job? because i guess he was fired from the previous one.
- zanethomas 4y ago
- ThePowerOfFuet 4y ago
- Quarrelsome 4y agokinda disgusting he got fired for this if that was the case. Its a very sophisticated attack and I think its conversion rate would be rather high.
- kube-system 4y agoThe article says they are no longer employed. It is possible that this exploit was only possible because of breaking other security policies. At least, I hope that any reasonable organization doesn't secure $600+ million dollars by relying on the endpoint security of a device used to access LinkedIn
- uhhyeahdude 4y ago> reasonable organization
- tedunangst 4y agoOpening a legit job offer PDF on your work computer could be considered a fireable offense. You should not be using company resources to find your next job.
- cbsks 4y agoIt’s also possible that he quit instead. If I interviewed for a new job, accepted an offer, and then everything blew up in my face… I’d probably not want to stick around.
- londons_explore 4y agoChrome/Edge PDF viewers are pretty secure. You can reasonably safely open anything in them. Desktop PDF viewers like acrobat are gaping security holes... Don't use them!
- TedDoesntTalk 4y agoI use PDF Expert on MacOS for its editing and markup abilities; built-in browser viewers aren’t good for that. What should I do?
- CamelRocketFish 4y agoDon’t work for a crypto company.
- ahmadmijot 4y agoDoes Adobe Acrobat really that bad? We use Acrobat Pro because it easy to modify pdf file with it. Other software can't do that much. Is there other pdf 'editor' that you can recommend?
- londons_explore 4y agoAcrobat in a virtual machine that you don't connect to the network? Most malware these days can't function without internet connectivity. The exploits typically connect to a server to get the rest of their code because they don't want any pesky researchers getting their hands on stuff.
- babyshake 4y agoWhat about the Preview app on MacOS?
- londons_explore 4y agoThe other major cause of the failure was that one dev had access to 5 signing keys. That shouldn't have happened, because than that one dev could have run off with $540 Million... And remember, it wasn't just that one dev - it was everything running on his computer - think of the probably tens of thousands of developers who wrote the code that runs as root on his PC, much of it unreviewed.
- hourago 4y ago> In a post-mortem blog post on the hack, published April 27, Sky Mavis said: “Employees are under constant advanced spear-phishing attacks on various social channels and one employee was compromised. This employee no longer works at Sky Mavis. The attacker managed to leverage that access to penetrate Sky Mavis IT infrastructure and gain access to the validator nodes.” The company fully blames the employee. I wish software companies had the same level of professionalism than airlines. "It's the pilot's fault" does not help to improve security. Nothing is learned.
- Sebguer 4y agoAirlines would behave the same way if there wasn't an aggressive government regulatory body forcing them to learn from failures.
- WorldMaker 4y agoGovernment regulatory body and a pilot's union.
- ChadNauseam 4y agoDo countries without a pilot's union have more unsafe air travel?
- WorldMaker 4y agoNo idea, but in the context of "why can't airlines scapegoat more pilots rather than deal with root causes?", unions are on the list of labor protections to consider.
- headsoup 4y agoI'm still not entirely convinced this wasn't an inside job (or entirely made up) and they just put a nice pot of money away somewhere. Wouldn't be without precedent in the wonderful world of crypto...
- kube-system 4y agoYou don't just take some dude's word for it when dealing with a $600+ million dollar heist. There were multiple third party investigators involved in the aftermath.
- dboreham 4y agoPerhaps they not taking his word, but waiting for him to move the funds?
- kube-system 4y agoThey already know where the money went: https://home.treasury.gov/policy-issues/financial-sanctions/recent-actions/20220414 https://home.treasury.gov/policy-issues/financial-sanctions/... And it has already been moved: https://www.blockchain.com/eth/address/0x098B716B8Aaf21512996dC57EB0615e2383E2f96 https://www.blockchain.com/eth/address/0x098B716B8Aaf2151299...
- lern_too_spel 4y agoFrom the group that brought you The Interview hack, here is an interview hack.
- jandrese 4y agoThis doesn’t mean it wasn’t an inside job. Dude could have a nice payday for “oops I got PDF hacked”, plus giving away enough information about their internal organization to make the attack feasible.
- 4y ago
- paulpauper 4y agoI think the media and tech writes overestimate the efficacy of spear phishing attacks. There is tons of research involved in finding suitable targets and then planning out the attack, such as the exploit, fake websites, fake emails, and other ingredients.
- larsiusprime 4y agoIt helps when your boss is a state actor and your target chooses to put $625 million in assets behind what amounts to a single point of failure
- rchaud 4y agoSurely the technology experts at A16z and Binance could have given them some basic cybersecurity tips before cutting a $300 million check?
- hn_throwaway_99 4y agoHuh? Don't understand your point. When the potential bounty is $540 million, seems like investment well spent. Just another reason crypto is a godsend for bad guys (obviously other financial crimes occur, e.g. with convincing folks to send fake wires) but there aren't many better ways to steal half a billion dollars I think. But, yeah yeah, "HN is so mean and hates crypto!!!"
- paulpauper 4y agoThis is a huge outlier though and it's not $500 million of cash but $500 million of crypto that must be processed/laundered slowly into usable cash, which may not even be doable. Given the recent crash it's probably more like a 100 hundred million now.
- t_mann 4y agoI think this is instead a good reminder that no matter how complicated / unlikely a specific attack vector seems, if the bounty is large enough you better assume that someone is going to do it.
- t_mann 4y agoThis is an important social engineering attack vector that all companies should be aware of. These kind of targeted attacks (often spoofing valid contacts that employees would legitimately exchange documents with) were common since I can remember the space, but using job applications is particularly disingenuous because employees are naturally going to be a bit secretive about those.
- iamwil 4y agoIn this case, there's no need to make it on a blockchain if a company controls the majority of validators.
- labrador 4y agoCan someone explain to me how a pdf can execute code?
- pjc50 4y agoExploits in the PDF viewer. The Adobe tools in particular have been a bountiful source of exploits for decades, but it's a complicated spec and there are plenty of opportunities for bugs.
- labrador 4y agoI see, much like Unicode exploits. I use Chrome to view PDFs which I assume to be safe.
- ylyn 4y agoChrome's PDF viewer seems to be implemented in native code. But it probably benefits from the sandboxing that Chrome does. I would say Firefox is the safest here, because its built-in PDF viewer is written in JS, although Firefox's sandboxing is not as strong as Chrome's.
- ec109685 4y agoSurprising: https://pdfium.googlesource.com/pdfium/ https://pdfium.googlesource.com/pdfium/
- tialaramex 4y agoProgram and data aren't really different, philosophically. On some level this even applies to people. When someone teaches you French is that program or data? Is it just data? Why can you now understand French then? Or if it's program, how does that work, who taught the teacher how to program you? So, our best effort is to constrain what certain data can do when we process it, in the hope that this prevents surprising negative consequences like a PDF that steals privileged information and sends it elsewhere. Notice that, in some sense, a PDF which just contains a photograph of your wife tied to a chair and holding today's newspaper, plus human readable text like, "We have your wife Sarah and all three kids Beth, Jim and Amanda. We are watching. Do not try to call for help. Email the privileged information to crooks@example.com or we will kill your family" is also potentially effective at doing this, but we would not usually consider that an exploit in this context. One irritation in this space is that programmers love General Purpose Programming Languages. The idea of the general purpose language is that it can do anything. But the problem in this sort of situation is that we don't want programs which can do anything, in fact doing anything is our worst case scenario. We actually want Special Purpose Programming Languages. We want to write our PDF data processing software in a language that even if we were trying can't do the things that should never happen as a result of processing a PDF. This is the purpose of languages like WUFFS: https://github.com/google/wuffs https://github.com/google/wuffs You can't write a WUFFS program to, for example, email anything to crooks@example.com even if you desperately needed to, which means you definitely won't accidentally write a program which can email the privileged information to the crooks when fed a PDF. Of course the PDF mentioned earlier with the kidnap note inside it could still work. And also of course making a PDF renderer out of WUFFS would be a really big ask. WUFFS-the-library today can render PNG, GIF, BMP but notably not yet JPEG. But it's clearly possible for something like PDF rendering to happen under these constraints. Nobody ordinarily viewing a PDF wants it to do arbitrary stuff.
- Thorrez 4y agoGoogle warned of North Korean hackers targeting security workers through LinkedIn in January 2021. https://blog.google/threat-analysis-group/new-campaign-targeting-security-researchers/ https://blog.google/threat-analysis-group/new-campaign-targe...
- anyfactor 4y agoTLDR Job offer PDF was downloaded to office computer. PDF had spyware that infiltrated the system.
- darepublic 4y agoDuring beginning of pandemic I got a job via a fully remote process. I felt it was sketchy in some respects and I began to increasingly fearful that it was some kind of phishing scheme. Luckily turned out to be legit. Job applications are such an open door for this kind of thing. They collect so much info from candidates, easily enough to commit identity theft. Also god forbid the company or recruiters get hacked and the data leaks anyway
- cemregr 4y agoIs it just me or is the (x) button on the banner ad on this site not work, and open the ad instead of dismissing it?
- dboreham 4y agoIn my mind there has to have been some insider involvement (at least) in this attack. There are too many things unknowable to outsiders that would need to be known.
- wly_cdgr 4y agoHow do you go through a whole job interview process and not realize that the company you are applying to is fake and doesn't exist?! ...Oh wait, this is crypto
- a4isms 4y agoHow should we respond if we interview for a non-crypto job, and when we can't get any background on the company, they explain that they're in "stealth mode" to protect the advantage of surprise? From time to time there are real startups that decide to fly under the radar until they're ready to show the world what they've built. Of course, many such companies turn out to be massive duds... Like Cuil. https://en.wikipedia.org/wiki/Cuil https://en.wikipedia.org/wiki/Cuil
- 999900000999 4y agoJust interviewed with a crypto company, can confirm. Even "legitimate" companies with a web presence, customers, etc, come off as super sketchy. That said, for lower income people you'll be absolutely inundated with scams, a good friend of mine just hit me up cuz someone wanted to promise him for $100 or so a week, you'd somehow become a crypto millionaire. I actually think crypto in its entirety is a giant scam, there's just levels of sophistication to it. Not everyone's going to fall for give me $100 and I'll turn that into $10,000 , but a ton of people fell for buy a bunch of crypto coins and hold ,time the market and sell.
- vgel 4y agoI applied (and got a job and worked at for a bit) a stealth-mode startup and it felt like a scam. No web presence, nobody had it listed as their job on LinkedIn, a couple vague references to funding rounds online that mentioned a different business model (turns out they had pivoted), etc. Remote applications are weird.
- jedberg 4y agoFor those that don't want to read the whole thing, (supposedly) the attackers reached out on linkedin to a bunch of employees asking them to apply to a fake company. One of them did it, went through a bunch of fake interviews, and then got a fake offer, in the form of a PDF. They opened the PDF and that installed a keylogger on their system (it doesn't explain how). The attackers then used that engineer's credentials to take over 4 of the 9 validators on the blockchain which they then used for their heist.
- leoqa 4y agoIt’s honestly impressive. I work in security in fintech and it can be frustrating to have our work deprioritized against product features. These examples help underscore why having robust security controls is existential.
- CobrastanJorji 4y agoI'm trying to imagine a setup at any company whose primary business is controlling extremely valuable digital assets having a security setup that could be entirely undone with keyloggers, and it's difficult. No necessary VPNs, keys on devices, or other non-password authentication? One engineer's password should not be the keys to the kingdom. Sounds like a bad RPG plot. "Because of its danger, we broke the Obsidian Key into 9 pieces and divided them across the realm, each protected by a powerful, mystic dungeon. Also, Dave can access them any time he says the secret word."
- SV_BubbleTime 4y agoAgreed. The article doesn't mention keylogger at all. I was definitely picturing a remote control exploit.
- jedberg 4y agoThey must have updated it. When I read it it specifically said keylogger.
- phphphphp 4y ago
- rib3ye 4y agoNo one is going to pick up the low hanging fruit and criticize _nine nodes_ as not being decentralized?
- deleted 4y ago[deleted]
- Apocryphon 4y agoI've got to say, this is an incredibly cyberpunk article. > Ronin, the Ethereum-linked sidechain that underpins play-to-earn game Axie Infinity, lost $540 million in crypto to an exploit in March. While the US government later tied the incident to North Korean hacking group Lazarus, full details of how the exploit was carried out have not been disclosed. It's not in William Gibson's style, sounds more like Bruce Sterling's. > Axie Infinity was huge. At its peak, workers in Southeast Asia were even able to earn a living through the play-to-earn game. It boasted 2.7 million daily active users and $214 million in weekly trading volume for its in-game NFTs in November last year — although both numbers have since plummeted. > Earlier this year, staff at Axie Infinity developer Sky Mavis were approached by people purporting to represent the fake company and encouraged to apply for jobs, according to the people familiar with the matter. One source added that the approaches were made through the professional networking site LinkedIn. Also gives me Charles Stross vibes.
- pjbeam 4y agoCyberpunk is now, just sans the 80s fashion inspirations :)
- silentsea90 4y agoWho knows, hackers might be using their $ on fashion but alas the profession makes it hard to flaunt.
- munificent 4y ago> sans the 80s fashion inspirations :) You definitely haven't been paying attention to Gen-Z people then. The 80s are back.
- pjbeam 4y agoThat's a fair assessment of my attention
- hindsightbias 4y agoThe future is already here. It's just not evenly distributed yet” - maybe W. G.
- alexfromapex 4y agoThis is so interesting, I just reported someone doing this on LinkedIn to the IC3. They create fake companies and ask for details like your SSN to ostensibly run a background check on you but in actuality it's to steal your identity or use your info to gain access to restricted resources.
- jspdown 4y agoThey rely on 9 trusted validators, the hacker managed to get access to the private keys of 4 out of the 9 validators. What's the point of using a Blockchain if you end up centralizing validations like that?
- kwertyoowiyop 4y agoDon’t worry, they’re going to have 100 trusted validators, thus solving the problem…FOREVER.
- ltbarcly3 4y agoThe true answer is that it doesn't make sense but investors don't care because BLOCKCHAIN
- seoaeu 4y agoOr rather, it makes perfect sense to slap on the bare minimum amount of blockchain to your scheme, given that it never had any use for blockchain in the first place but you can’t get funding without the right buzzwords
- mikevin 4y ago'Proof of Authority' sounds an awful lot like the regular banking system.
- firechickenbird 4y agoCrYpTo DeCeNtRaLiZaTiOn BaBy
- jandrese 4y agoWhat an incredible story. In fact it is so incredible that it smells a bit funny to me. Are we sure this heist wasn’t an inside job? Axie was collapsing under its own weight and an employee decided to swipe all of the crypto after making up this crazy job offer PDF story to cover their tracks.
- password4321 4y agoI'm amazed I had to scroll down this far to find the obvious explanation: a rug pull with a press release so the perpetrator doesn't have to fake their own death. Edit: I thought the lack of details was fishy but the following would be tough to fake: the FBI has attributed North Korea-based Lazarus Group, highly skilled hackers, to the Ronin Validator Security Breach. The US Government, specifically the Treasury Department, has sanctioned the address that received the stolen funds
- jazzyjackson 4y agoperhaps NK makes some side cash and notoriety from their "claim-responsibility-as-a-service" service, for a 5% fee we'll say we did it! bonus free VPN endpoint and exploit library to make it look like it was us!
- deleted 4y ago[deleted]
- jacquesm 4y agoMeanwhile, my kids' school forces them to use windows, spreads around lots of information that should be on websites as pdfs and asks to install all kinds of software from dubious sources including stuff that can only properly be classified as a rootkit in disguise. People are conditioned to trust certain verticals, Google, Apple, Microsoft (which owns LinkedIn) and a bunch of others and will lower their guard. Which is why it works so well. In fact I've received email from some of those where I was pretty sure I was being spearphished but they turned out to be real (but not on LinkedIn, which I refuse to join).
- UberFly 4y agoI read the first paragraph, the overlay banner popped up and blocked everything. I don't care what the article says after that.
- eigenvalue 4y agoSeems like there would be market demand for a super locked down PDF viewer that basically ignores all the silly extensions/additions that Adobe has added to the format over the decades. The vast majority of documents don't need Turing complete code capabilities or embedded videos or interactive 3D models. Something that safely (using sandboxing and other methods) turns the document into totally static pixel data that still feels nice to read would mitigate this extremely common attack vector.
- SV_BubbleTime 4y agoFoxIt has out of the box GPO controls that are quite easy to use. It's probably got a lot of tweaking to really lock it down, but I think you could get pretty far before having to stop for lunch.
- stefan_ 4y agoI realized some time ago, not wanting to install drivers, that a lot of office printers now have some janky webinterface that also allows uploading PDFs to submit as print jobs. This will turn a malicious PDF into perfectly safe paper! Now whatever cursed embedded software on the printer reads the PDF is probably a lot easier to exploit than an updated PDF viewer, but that's not what these people are going for.
- tornato7 4y agoThis pretty much already exists, it’s called Cloudflare Browser Isolation. They basically render your browser on a remote server and pipe you the visual data.
- journey_16162 4y agoI run multiple user accounts on Linux for different applications. The main account does not have Internet access obviously (blocked by IPTables), only some sub accounts can access it. I guess that if I open a random PDF downloaded from Internet, it can't do anything without Internet access, can it?
- CarbonCycles 4y agoLN has now become a dumping ground for spammers, scammers, and a social network site. It's lost its appeal, and I am getting more scammers all the time. I'm beginning to contemplate what value LN provides as LN has focused on more aggressive marketing tactics, and it's starting to feel like Instagram with the engagements metrics... Oh yea, I'm still perplexed on how anyone would ever go into an interview w/out doing any homework on the company...even the smallest of start-ups have a presence on the net. They better damn-well have a pitch deck for new capital and employees.
- Animats 4y agoThis reads like blameshifting. Axie Infinity is a Ponzi on the way down. They need someone to blame for their failure.
- trhway 4y agoOne can wonder how much info for the hack was collected during the interviews. "Tell me about the security protection you architected for your validators".
- Ekaros 4y agoAnd this is why you should separate work machines from private and anything else. Specially when working with something high value.
- xigency 4y agoSo they lost half a billion dollars because they forgot to set up Multi Factor Authentication?
- marshray 4y agoMFA can't help you if your network admin is willing to open an untrusted file with an Adobe product.
- schemescape 4y agoWhat's the best practice, security-wise, for viewing PDFs?
- AustinDev 4y agoI have a script that watches my download folder and runs them through ghost script which is designed to reduce the file size of PDFs but it also strips out any linked media or embedded code from my testing. It does a bunch of other stuff too but the pdf auto-converter was pretty simple.
- elif 4y agoIs this the moment we need for LaTeX to become standard? pdf is clearly to blame here imo. This guy isn't the only one to trust it. It seems like the entire legal profession, for instance, should be crippled by this vulnerability disclosure, if true.
- shp0ngle 4y agohahaha
- deleted 4y ago[deleted]
- marshray 4y ago"multiple rounds of fake job interviews" ... "The con culminated in one senior engineer clicking a PDF supposedly containing the official offer" Wow! These folks were really on the ball if it took that much social engineering just to get an employee to open a PDF.
- ourmandave 4y agoThe rate of DeFi hacks has accelerated rapidly this year, topping $2 billion in total funds lost, according to The Block Research data. Seesh, you could finance a war with $2B.
- treme 4y agoit's hilarious that KJU was probably among the biggest benefactor of crypto boom.
- Barrera 4y ago> Validators fulfill various functions in blockchains, including the creation of transaction blocks and the updating of data oracles. Ronin uses a so-called “proof of authority” system for signing transactions, concentrating power in the hands of nine trusted actors. This paragraph perfectly encapsulates everything wrong with the way promoters sell Ethereum. Smart contracts can do little of interest beyond straight monetary transactions without information about the outside world. That information comes from "oracles", or what the article calls "validators". The security guarantees of this system are far, far weaker than the Ethereum consensus protocol, as the article demonstrates. And yet, the system is hyped to the n-th degree by sheisters who ignore this basic fact with ludicrous claims about security and stability. Zooming out, basically Ethereum is hyped as a platform for "smart contracts." But the minute a smart contract does anything beyond basic money transfers, it needs an oracle. And with the oracle comes radically reduced security. Eventually, this will be obvious. For now, shenanigans like this will continue.
- whatisweb3 4y agoOracles that connect to off-chain data are usually understood as points of centralization, I don’t think Ethereum or it’s developers are selling otherwise. Most Ethereum developers are advising against relying on bridges across security zones that would be upheld by multisigs and oracles, they are vulnerable to attacks. A better model than a bridge to sidechain would be a rollup - posting proofs on chain without giving the sequencer the ability to steal or control user funds.
- joe_the_user 4y agoA better model than a bridge to sidechain would be a rollup - posting proofs on chain without giving the sequencer the ability to steal or control user funds. What's a "proof" of an event in the outside world? No such thing exists. The OP's point that dependence on real world events is a security flaw remains. No alternative programming method can change this because nothing on the Internet can guarantee a real event has happened. This is inherent.
- 4y ago
- petilon 4y agoIf you care about security, two things you don't want to install on your computer are Adobe Acrobat and Microsoft Office. These products were written the 1990s in C/C++ and are impossible to secure. Microsoft does not allow installing Office on Secure Admin Workstations (SAW) [1] for a reason! [1] https://www.microsoft.com/en-us/insidetrack/protecting-high-risk-environments-with-secure-admin-workstations https://www.microsoft.com/en-us/insidetrack/protecting-high-...
- ec109685 4y agoFor “security” reasons, many sites force downloads of pdfs instead of letting browsers read them, so people get into the habit of using their system viewer.
- cyanydeez 4y agoSo basically, these distributed systems are heavy on the light distribution because they actually rely on the trust of caretakers and that access. So we basically have a worse banking system even if you believe crypto is a currency (it's not)
- the_af 4y agoMore than the hack taking down Axie, I worry that a sizeable amount of impoverished people had to earn a living by playing a crypto-based "game", a game that is obviously not very fun and which can be considered a pyramid scheme. Ah, but it's crypto! I know a lot has been said about bullshit jobs, and that it is a controversial concept, but I cannot find any job more bullshitty than having to earn a living by playing an NFT Pokémon like game or whatnot. It's depressing.
- quickthrower2 4y agoThe interesting bit is the hop from the devs local machine to the validators. With so much money at stake I am surprised there was not more isolation. Or a second authentication factor?
- adfjalkfja 4y agoHappened after BTC lost $30k in value. Seems North Korean crackers are busy lately
- Jistern 4y ago
- unsupp0rted 4y agoIs there a quick command line or GUI tool that strips a PDF of everything except text/formatting? In other words, can I run `pdf-make-safe` on a file before opening it to make sure it can't execute arbitrary code the moment I do? I found this: https://github.com/freedomofpress/dangerzone https://github.com/freedomofpress/dangerzone Is it any good?
- maury91 4y agoI tend to separate work and life affairs, and using the work computer to talk to recruiters sounds bad to me, it is something I feel more ethical to do on my personal computer. This would have easily prevented the hacking because only the personal computer would have got hacked
- gigatexal 4y agoDon’t apply to other jobs on company computers or computers connected to the company battalion or VPN. There. Fixed.
- isitmadeofglass 4y agoIf a single person opening a PDF brings down your company, then what brought down your company was not that single guy opening that single pdf, it was the series of failures in leadership, company structure and technology that led you to that bad position that brought down your company.