5 ms·

For those that don't want to read the whole thing, (supposedly) the attackers reached out on linkedin to a bunch of employees asking them to apply to a fake com

For those that don't want to read the whole thing, (supposedly) the attackers reached out on linkedin to a bunch of employees asking them to apply to a fake company. One of them did it, went through a bunch of fake interviews, and then got a fake offer, in the form of a PDF. They opened the PDF and that installed a keylogger on their system (it doesn't explain how). The attackers then used that engineer's credentials to take over 4 of the 9 validators on the blockchain which they then used for their heist.

leoqa 4y ago
It’s honestly impressive. I work in security in fintech and it can be frustrating to have our work deprioritized against product features. These examples help underscore why having robust security controls is existential.
CobrastanJorji 4y ago
I'm trying to imagine a setup at any company whose primary business is controlling extremely valuable digital assets having a security setup that could be entirely undone with keyloggers, and it's difficult. No necessary VPNs, keys on devices, or other non-password authentication? One engineer's password should not be the keys to the kingdom. Sounds like a bad RPG plot. "Because of its danger, we broke the Obsidian Key into 9 pieces and divided them across the realm, each protected by a powerful, mystic dungeon. Also, Dave can access them any time he says the secret word."
- SV_BubbleTime 4y ago
  Agreed. The article doesn't mention keylogger at all. I was definitely picturing a remote control exploit.
  - jedberg 4y ago
    They must have updated it. When I read it it specifically said keylogger.
- phphphphp 4y ago
  I’m of the view that the completely illogical nature of their entire business and the absence of any meaningful security are deeply interwoven. Rather than think of their primary business as securing digital assets, think of their primary business as convincing people that a perpetual money machine in the shape of a video game is possible. The valuable digital assets are just a narrative tool — and so it follows that they wouldn’t have the expertise in securing digital assets. Nobody capable of building a secure system for digital assets would waste their time working for a company like Axie, after all, the entire premise of their business is flawed so people with the critical thinking skills necessary to build a secure system would apply that critical thinking to the viability of the company — and, of course, conclude it’s destined for failure and not hitch their wagon to it.
  - dataangel 4y ago
    I understand your argument but this kind of reasoning consistently fails to be predictive. If things worked as you describe, there would be way more consensus amongst skilled engineers on political topics. In practice people are very skilled at selectively turning off their brain, especially when they stand to benefit. “It's difficult to get a man to understand something when his salary depends on not understanding it." -Upton Sinclair
    - phphphphp 4y ago
      I completely agree in principle but the nuance here is that I’m leaning on the belief that people joining Axie do not “…stand to benefit…” because the long term prospects of Axie Infinity are not good (and have never been good) and so anybody analysing the benefit of joining them — who has a broad range of opportunities available to them — would immediately see how little they stand to benefit from getting involved with Axie Infinity. I’m under no illusions about the intelligence of software engineers (of any specialism) — we are all idiots at least some of the time — but I struggle to believe that a competent engineer with lots of opportunities would somehow believe that Axie Infinity is the best opportunity available to them, hence, their system is built by people who don’t have other opportunities and have produced an insecure house of cards (more insecure than the average system anyway — all systems are insecure in some capacity).

leoqa 4y ago

It’s honestly impressive. I work in security in fintech and it can be frustrating to have our work deprioritized against product features. These examples help underscore why having robust security controls is existential.

CobrastanJorji 4y ago

I'm trying to imagine a setup at any company whose primary business is controlling extremely valuable digital assets having a security setup that could be entirely undone with keyloggers, and it's difficult. No necessary VPNs, keys on devices, or other non-password authentication? One engineer's password should not be the keys to the kingdom. Sounds like a bad RPG plot. "Because of its danger, we broke the Obsidian Key into 9 pieces and divided them across the realm, each protected by a powerful, mystic dungeon. Also, Dave can access them any time he says the secret word."

SV_BubbleTime 4y ago
Agreed. The article doesn't mention keylogger at all. I was definitely picturing a remote control exploit.
- jedberg 4y ago
  They must have updated it. When I read it it specifically said keylogger.
phphphphp 4y ago
I’m of the view that the completely illogical nature of their entire business and the absence of any meaningful security are deeply interwoven. Rather than think of their primary business as securing digital assets, think of their primary business as convincing people that a perpetual money machine in the shape of a video game is possible. The valuable digital assets are just a narrative tool — and so it follows that they wouldn’t have the expertise in securing digital assets. Nobody capable of building a secure system for digital assets would waste their time working for a company like Axie, after all, the entire premise of their business is flawed so people with the critical thinking skills necessary to build a secure system would apply that critical thinking to the viability of the company — and, of course, conclude it’s destined for failure and not hitch their wagon to it.
- dataangel 4y ago
  I understand your argument but this kind of reasoning consistently fails to be predictive. If things worked as you describe, there would be way more consensus amongst skilled engineers on political topics. In practice people are very skilled at selectively turning off their brain, especially when they stand to benefit. “It's difficult to get a man to understand something when his salary depends on not understanding it." -Upton Sinclair
  - phphphphp 4y ago
    I completely agree in principle but the nuance here is that I’m leaning on the belief that people joining Axie do not “…stand to benefit…” because the long term prospects of Axie Infinity are not good (and have never been good) and so anybody analysing the benefit of joining them — who has a broad range of opportunities available to them — would immediately see how little they stand to benefit from getting involved with Axie Infinity. I’m under no illusions about the intelligence of software engineers (of any specialism) — we are all idiots at least some of the time — but I struggle to believe that a competent engineer with lots of opportunities would somehow believe that Axie Infinity is the best opportunity available to them, hence, their system is built by people who don’t have other opportunities and have produced an insecure house of cards (more insecure than the average system anyway — all systems are insecure in some capacity).