7 ms·

Curious if anyone has been able to find technical details of how this attack works/worked. I'm under the impression most PDF viewers would prevent this sort of

Curious if anyone has been able to find technical details of how this attack works/worked. I'm under the impression most PDF viewers would prevent this sort of attack (e.g. opening a PDF in your browser should sandbox it to the browsing context), but really keen to know what PDF viewer / OS was used by the dev.

jaywalk 4y ago
Probably Acrobat.
wespiser_2018 4y ago
Here's a demonstration of some example attacks using pdf: executing arbitrary js, and connecting to a samba server: https://www.sentinelone.com/blog/malicious-pdfs-revealing-techniques-behind-attacks/ https://www.sentinelone.com/blog/malicious-pdfs-revealing-te... I'm not sure about this attack specifically, though, and in Ronin's post mortem they aren't really talking about that: https://roninblockchain.substack.com/p/back-to-building-ronin-security-breach https://roninblockchain.substack.com/p/back-to-building-roni.... To some extent, the PDF viewer/OS doesn't matter. A dedicated and well resourced attacker like the Lazarus Group will find holes in all of them. The "right" move here would have been for the employee not to download the compromised pdf, and short of that, for the IT Security team at Ronin to quickly detect the weird traffic that resulted and isolate the validators to prevent a compromise of their critical assets.
- the_gipsy 4y ago
  I know that document-rendering is much more complex than what it appears on the surface, but surely in this day and age there should be document viewers that don't run scripts and are exploit free.
  - gowld 4y ago
    Every program is potentially exploutable. The only defense is defense in depth, where an intrustion attempt fails at layer 3 of 5, alarms bells ring, and those 3 compromised layers get hardening upgrades. What usually happens is that layers 1 and 2 of 3 are constantly compromised, no one cares to follow up, and one day layer 3 gets compromised, shock of shocks.
- Volundr 4y ago
  The right move here would have been to have separate work/personal computers so that this PDF never landed on a system with access to the Ronin network. I know I'm pushing a boulder uphill with that one but it really is the way to go, better for both the individual and the company.
  - llaolleh 4y ago
    I'm in this camp. All employees should be sent a laptop, or work with a remote environment that is isolated from your personal computer.
  - rchaud 4y ago
    what would stop a developer from checking personal email on a work machine?
    - pcthrowaway 4y ago
      Or more to the point, what would stop someone from sending malicious documents to the employees' work emails? Figure out a company uses <some-saas> register a phishing domain (e.g. gith.ub) send them an email with important info about their account, and a PDF attachment with more details. If it's that easy to compromise a system all you have to do is get a few employees to open the PDF right?
      - Volundr 4y ago
        And this is exactly why your IT department sends out those simulated phishing emails everyone likes to complain about.
    - Volundr 4y ago
      Themselves. I'm saying developers (and employees in general) should not do any personal stuff on work machines or any work stuff on personal machines. This has benefits for the employee, not just the company, in that it keeps the employees personal data out of the hands of the IT department.
- cmeacham98 4y ago
  > To some extent, the PDF viewer/OS doesn't matter. A dedicated and well resourced attacker like the Lazarus Group will find holes in all of them. I dispute this: the web browser is one of the most defended pieces of software of all time, especially relative to its complexity. I would find it much safer to open a potentially malicious PDF in my browser's JS-based reader than using a desktop reader. > The "right" move here would have been for the employee not to download the compromised pdf, and short of that, for the IT Security team at Ronin to quickly detect the weird traffic that resulted and isolate the validators to prevent a compromise of their critical assets. It also probably would have been helpful if one employee didn't have access to almost half of the validators, especially on a system they're accessing email with.
lordnacho 4y ago
Does it even need to be terribly complicated? Congrats on your new job, here's a script for you to generate a new ssh key with us, just copy/paste it in your terminal and that will sort it out.
- pcthrowaway 4y ago
  Yet according to the article, the malware was introduced by the "candidate" opening a PDF; I'd expect most senior developers to know better than to run a random script from a company they don't have an ongoing relationship with without looking at the source first, especially if they have sensitive credentials on the computer they're using. But you never know.
layer8 4y ago
On Windows, Acrobat Reader has Protected Mode (sandbox) and Protected View (most features disabled) features [0], but people tend to disable it, in particular the Protected View, or don’t enable it for all locations. Or maybe the vulnerability wasn’t on Windows, or was in something like font rendering, or they used a different reader without sandboxing. [0] https://helpx.adobe.com/reader/using/protected-mode-windows.html https://helpx.adobe.com/reader/using/protected-mode-windows....
- butterNaN 4y ago
  Why is Protected mode not the default?
kyle-rb 4y ago
Likely this was a standalone PDF reader hack (rather than a browser), since those can have many more features and a much larger attack surface. It says it was an offer letter, so my guess is that opening it in the browser came up with an error like "to be able to digitally sign this offer letter, please open it in a desktop PDF reader with full scripting support enabled :)"
- pcthrowaway 4y ago
  I guess we all need to be opening anything remotely phishy in VMs to avoid similar issues
  - draw_down 4y ago
- babyshake 4y ago
  Luckily I am not getting a lot of unsolicited job offer letters via LinkedIn.

jaywalk 4y ago

Probably Acrobat.

wespiser_2018 4y ago

Here's a demonstration of some example attacks using pdf: executing arbitrary js, and connecting to a samba server: https://www.sentinelone.com/blog/malicious-pdfs-revealing-techniques-behind-attacks/ https://www.sentinelone.com/blog/malicious-pdfs-revealing-te... I'm not sure about this attack specifically, though, and in Ronin's post mortem they aren't really talking about that: https://roninblockchain.substack.com/p/back-to-building-ronin-security-breach https://roninblockchain.substack.com/p/back-to-building-roni.... To some extent, the PDF viewer/OS doesn't matter. A dedicated and well resourced attacker like the Lazarus Group will find holes in all of them. The "right" move here would have been for the employee not to download the compromised pdf, and short of that, for the IT Security team at Ronin to quickly detect the weird traffic that resulted and isolate the validators to prevent a compromise of their critical assets.

the_gipsy 4y ago
I know that document-rendering is much more complex than what it appears on the surface, but surely in this day and age there should be document viewers that don't run scripts and are exploit free.
- gowld 4y ago
  Every program is potentially exploutable. The only defense is defense in depth, where an intrustion attempt fails at layer 3 of 5, alarms bells ring, and those 3 compromised layers get hardening upgrades. What usually happens is that layers 1 and 2 of 3 are constantly compromised, no one cares to follow up, and one day layer 3 gets compromised, shock of shocks.
Volundr 4y ago
The right move here would have been to have separate work/personal computers so that this PDF never landed on a system with access to the Ronin network. I know I'm pushing a boulder uphill with that one but it really is the way to go, better for both the individual and the company.
- llaolleh 4y ago
  I'm in this camp. All employees should be sent a laptop, or work with a remote environment that is isolated from your personal computer.
- rchaud 4y ago
  what would stop a developer from checking personal email on a work machine?
  - pcthrowaway 4y ago
    Or more to the point, what would stop someone from sending malicious documents to the employees' work emails? Figure out a company uses <some-saas> register a phishing domain (e.g. gith.ub) send them an email with important info about their account, and a PDF attachment with more details. If it's that easy to compromise a system all you have to do is get a few employees to open the PDF right?
    - Volundr 4y ago
      And this is exactly why your IT department sends out those simulated phishing emails everyone likes to complain about.
  - Volundr 4y ago
    Themselves. I'm saying developers (and employees in general) should not do any personal stuff on work machines or any work stuff on personal machines. This has benefits for the employee, not just the company, in that it keeps the employees personal data out of the hands of the IT department.
cmeacham98 4y ago
> To some extent, the PDF viewer/OS doesn't matter. A dedicated and well resourced attacker like the Lazarus Group will find holes in all of them. I dispute this: the web browser is one of the most defended pieces of software of all time, especially relative to its complexity. I would find it much safer to open a potentially malicious PDF in my browser's JS-based reader than using a desktop reader. > The "right" move here would have been for the employee not to download the compromised pdf, and short of that, for the IT Security team at Ronin to quickly detect the weird traffic that resulted and isolate the validators to prevent a compromise of their critical assets. It also probably would have been helpful if one employee didn't have access to almost half of the validators, especially on a system they're accessing email with.

lordnacho 4y ago

Does it even need to be terribly complicated? Congrats on your new job, here's a script for you to generate a new ssh key with us, just copy/paste it in your terminal and that will sort it out.

pcthrowaway 4y ago
Yet according to the article, the malware was introduced by the "candidate" opening a PDF; I'd expect most senior developers to know better than to run a random script from a company they don't have an ongoing relationship with without looking at the source first, especially if they have sensitive credentials on the computer they're using. But you never know.

layer8 4y ago

On Windows, Acrobat Reader has Protected Mode (sandbox) and Protected View (most features disabled) features [0], but people tend to disable it, in particular the Protected View, or don’t enable it for all locations. Or maybe the vulnerability wasn’t on Windows, or was in something like font rendering, or they used a different reader without sandboxing. [0] https://helpx.adobe.com/reader/using/protected-mode-windows.html https://helpx.adobe.com/reader/using/protected-mode-windows....

butterNaN 4y ago
Why is Protected mode not the default?

kyle-rb 4y ago

Likely this was a standalone PDF reader hack (rather than a browser), since those can have many more features and a much larger attack surface. It says it was an offer letter, so my guess is that opening it in the browser came up with an error like "to be able to digitally sign this offer letter, please open it in a desktop PDF reader with full scripting support enabled :)"

pcthrowaway 4y ago
I guess we all need to be opening anything remotely phishy in VMs to avoid similar issues
- draw_down 4y ago
babyshake 4y ago
Luckily I am not getting a lot of unsolicited job offer letters via LinkedIn.