8 ms·

The main problem was using a machine that had access to half a billion dollars to also browse the web and do stuff like applying for jobs. If you're gonna have

The main problem was using a machine that had access to half a billion dollars to also browse the web and do stuff like applying for jobs. If you're gonna have access to such amount of money, it's worth buying a dedicated machine and using it very, very cautiously.

abxytg 4y ago
Yep. Bad opsec at the org level. Either the eng was doing work stuff on a personal laptop or personal stuff on a work laptop. This is easily preventable and should be table stakes when handling money, phi, etc
- andrecarini 4y ago
  > when handling money, phi What does _phi_ stand for?
  - rcyeh 4y ago
    phi = protected health information pii = personally identifiable information
abirch 4y ago
I still can't believe that they opened the PDF on the company computer. I always use my home computer and the poor hacker would get bored of seeing all of my Raspberry Pi projects that I haven't done.
- kuboble 4y ago
  It might be hard to believe that the particular person in a particular company did that, but given a lot of attempts, dedication and lucky / unlucky circumstances eventually somewhere someone will trust a malicious person and will get socially engineered into opening a pdf on a working computer.
  - godot 4y ago
    Also wonder if the PDF exploit works for only local/native PDF readers (e.g. Adobe Readers) or also web-based. If someone occasionally checks their personal email from a work laptop, chances are they'd only use the Gmail preview to open the PDF. It seems like most engineers wouldn't get all the way to downloading a job offer PDF to their work laptop and opening it up there.
- CrispinS 4y ago
  I can't believe a software developer is using an operating system/pdf viewer that isn't patched for security vulnerabilities as major as an RCE. Unless this was a zero day, but I would have assumed the article would mention that fact ..
  - pcthrowaway 4y ago
    I really wish we had details here too, but someone made a good point: "Hey, you need a PDF viewer with scripts enabled for the digital signing.. can you install Adobe XXX?" would be a good line to get the mark to use a less-than-secure PDF viewer. But also, since it was the North Korea hacking group, I'm not ruling out a 0-day... hopefully more details will come at some point.
- da39a3ee 4y ago
  Huh? I've used my company laptops for my personal life for the last 15 years. Why would I want to carry two laptops everywhere? I travel. I barely remember what a personal laptop is.
  - jazzyjackson 4y ago
    lol do you at least dual boot? have a separate user account? I guess its fine as long as your computer doesn't have the credentials to the company slush fund. Friend of mine I traveled with carried 3 macbooks with her: school issued, work issued, and personal. They had different software licenses tied to the machine, whadyagonnado?
  - RajT88 4y ago
    I travel with a HP Spectre x360 for personal stuff. It is barely a weight or bulk addition compared to my work machine. When I was on the road all the time I also had separate phones to ensure I never got stuck with a dead phone.
  - logifail 4y ago
    > I've used my company laptops for my personal life for the last 15 years. Counterpoint: I've been completely and utterly allergic to opening anything personal from any company system for longer than that.
    - LASR 4y ago
      Same here. I get MDM profile updates from IT on my work machine. One time they auto-installed a cloud backup service and sent out a company-wide email after they already did it. Something like: “Now nobody has to deal with lost data. You’re welcome!” Huge backlash from employees on that move. But I get both perspectives. These are work machines, and a mundane accident with the equipment shouldn’t incur significant losses to the business. But apart from the potential loss of personal privacy, it feels wrong. Especially so, when you’re looking for other jobs.
  - kornhole 4y ago
    I think you are joking to bait us. At least use a VM running a VPN within it. It won't protect you from screen captures or keyloggers your employer put on your machine, but it will segregate files and network activity.
- cfn 4y ago
  I suppose that sending it during business hours and, who knows, maybe the final offer would be in the PDF and the poor guy couldn't wait to open it. The rest is history.
- turtlebits 4y ago
  If you're looking for work, you have to interview during the day, which you're probably in office (things are very different now). I know I'm guilty of having my personal emailed signed into my work computer (albeit with a separate browser). I've also done virtual interviews in the office meeting/phone room.
  - bornfreddy 4y ago
    You've done interviews in the office of your (then) current employer??? Gutsy. I wouldn't dream of using employer's equipment, time or space while negotiating for a new employment.
- the_af 4y ago
  I open all sorts of PDFs, all the time, regardless of which computer I'm using. Is PDF as an attack vector such a widespread threat? I never payed much attention to them, assuming it's a document format that is relatively harmless even if it can include javascript. This is an honest question, by the way.
  - kibibyte 4y ago
    https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=PDF+document https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=PDF+documen... PDFs are "harmless" on their own, but they are user-generated documents that conform to a complex specification. Viewing them requires software that parses them. These parsers are often written in unsafe low level languages. The (in)security of unsafe parsers reading user-generated input is a tale as old as time itself.
    - planede 4y ago
      Most people view pdfs now in web browsers built-in viewers. Especially if the job offer comes from a linkedin message, I would imagine most people would default to the browser viewer. While browsers are sure not without security vulnerabilities, I sure trust the PDF viewer within to be way more sandboxed than most standalone desktop PDF viewer applications. If the vulnerability (which I assume was RCE) was in a web browser, then it's a major bug.
      - kibibyte 4y ago
        As I mentioned in another comment (and I think others have mentioned this as well), browser PDF viewers implement a subset of PDF features, and notably they won't support things like forms (I think?) or signatures. So I can imagine that attacker tricked the user into opening the PDF with separate software by saying something along the lines of "you need Adobe Reader to sign this document" (and I don't think DocuSign is ubiquitous enough that users will second guess that).
        planede 4y ago
PragmaticPulp 4y ago
> The main problem was using a machine that had access to half a billion dollars Going up a level, the main problem was that the company had a system where a single person could irreversibly transfer half a billion dollars away from the company.
- handoflixue 4y ago
  The article actually covers that it required 5 out of 9 people to sign off. They got 4 via PDF attacks and 1 via legacy access that was never properly terminated.
  - tylersmith 4y ago
    The compromised employee had access to that 5th factor it was just not as direct as as him having a 5th private key.
  - mousetree 4y ago
    My understanding of the article was that only 1 person was compromised and that the exploit installed on their computer was then used to access the validator nodes themselves. FWIW, I have no idea what a validator node is but I'm assuming that by compromising one employee's workstation they somehow got access to multiple other machines (which if true is itself a bit of a f* up).
    - logifail 4y ago
      > I'm assuming that by compromising one employee's workstation they somehow got access to multiple other machines (which if true is itself a bit of a f* up) Q: If you assume the bad guys have already compromised your workstation, how sure are you that they won't be able to compromise other machines you connect to?
      - charcircuit 4y ago
        You can't which is why one person shouldn't have access to more than one.
spaceman_2020 4y ago
When I first got into crypto, a few things were pretty much drilled into my head: - Not your keys, not your coins; always self-custody - Never use the same machine for trading and for work/surfing the web - Store only funds you want to regularly trade with on a hot wallet. Everything else on a cold wallet.
- empraptor 4y ago
  and this is part of why i think cryptocurrencies should have died before large number of people wasted their money on it. for the average user without the time/knowledge/patience to handle cryptos "properly", the choice is between losing money while handling this shit yourself or losing money while trusting someone else to do it right.
  - spaceman_2020 4y ago
    Its an entirely free market. Just because one person doesn't understand the tech and loses his money doesn't mean that everyone else shouldn't be allowed to use it either. Even if you don't buy into the crypto vision (I don't), a digital-only currency that isn't tied to any nation-state does deserve to exist.
    - Retric 4y ago
      It’s fine for a few people to play with such a system. The issue if it’s absolutely clear crypto is incapable of widespread adoption or just about anything else people hype it up as, then it shouldn’t be hyped as if that stuff is a possibility. I could never tell how much was incompetence vs fraud, but either way without the hype vastly fewer suckers would be holding the bag right now. The crypto ecosystem has been just been terrible for just about everyone and things are far from over.
      - spaceman_2020 4y ago
        The people holding the bag right now mostly got in because of the allure of quick profits. And if they didn't sell even after making incredible (paper) returns, they have their own greed to blame. Bitcoin was $6,000 in March 2020. It hit $63,000 in April 2021. And if you didn't sell that top, it hit $67,000 again in November 2021. Even now, it has dropped less than Netflix, a supposed bluechip. I don't know what's the scam in this - you had plenty of entry opportunities and plenty of exit opportunities. The underlying system itself still works exactly as described.
emmelaich 4y ago
It wouldn't be one machine. The initial incursion would have been used to leverage other local attacks. Then targeting domain controllers and admin accounts. Probably also reading email; one possible way of finding it needed to get at 5 of 9 keys to unlock.
uoaei 4y ago
Not money. Crypto.
Fomite 4y ago
Seriously. This is standard practice for even fairly innocuous human subjects data, and it astonishes me when it's not done elsewhere.

abxytg 4y ago

Yep. Bad opsec at the org level. Either the eng was doing work stuff on a personal laptop or personal stuff on a work laptop. This is easily preventable and should be table stakes when handling money, phi, etc

andrecarini 4y ago
> when handling money, phi What does _phi_ stand for?
- rcyeh 4y ago
  phi = protected health information pii = personally identifiable information

abirch 4y ago

I still can't believe that they opened the PDF on the company computer. I always use my home computer and the poor hacker would get bored of seeing all of my Raspberry Pi projects that I haven't done.

kuboble 4y ago
It might be hard to believe that the particular person in a particular company did that, but given a lot of attempts, dedication and lucky / unlucky circumstances eventually somewhere someone will trust a malicious person and will get socially engineered into opening a pdf on a working computer.
- godot 4y ago
  Also wonder if the PDF exploit works for only local/native PDF readers (e.g. Adobe Readers) or also web-based. If someone occasionally checks their personal email from a work laptop, chances are they'd only use the Gmail preview to open the PDF. It seems like most engineers wouldn't get all the way to downloading a job offer PDF to their work laptop and opening it up there.
CrispinS 4y ago
I can't believe a software developer is using an operating system/pdf viewer that isn't patched for security vulnerabilities as major as an RCE. Unless this was a zero day, but I would have assumed the article would mention that fact ..
- pcthrowaway 4y ago
  I really wish we had details here too, but someone made a good point: "Hey, you need a PDF viewer with scripts enabled for the digital signing.. can you install Adobe XXX?" would be a good line to get the mark to use a less-than-secure PDF viewer. But also, since it was the North Korea hacking group, I'm not ruling out a 0-day... hopefully more details will come at some point.
da39a3ee 4y ago
Huh? I've used my company laptops for my personal life for the last 15 years. Why would I want to carry two laptops everywhere? I travel. I barely remember what a personal laptop is.
- jazzyjackson 4y ago
  lol do you at least dual boot? have a separate user account? I guess its fine as long as your computer doesn't have the credentials to the company slush fund. Friend of mine I traveled with carried 3 macbooks with her: school issued, work issued, and personal. They had different software licenses tied to the machine, whadyagonnado?
- RajT88 4y ago
  I travel with a HP Spectre x360 for personal stuff. It is barely a weight or bulk addition compared to my work machine. When I was on the road all the time I also had separate phones to ensure I never got stuck with a dead phone.
- logifail 4y ago
  > I've used my company laptops for my personal life for the last 15 years. Counterpoint: I've been completely and utterly allergic to opening anything personal from any company system for longer than that.
  - LASR 4y ago
    Same here. I get MDM profile updates from IT on my work machine. One time they auto-installed a cloud backup service and sent out a company-wide email after they already did it. Something like: “Now nobody has to deal with lost data. You’re welcome!” Huge backlash from employees on that move. But I get both perspectives. These are work machines, and a mundane accident with the equipment shouldn’t incur significant losses to the business. But apart from the potential loss of personal privacy, it feels wrong. Especially so, when you’re looking for other jobs.
- kornhole 4y ago
  I think you are joking to bait us. At least use a VM running a VPN within it. It won't protect you from screen captures or keyloggers your employer put on your machine, but it will segregate files and network activity.
cfn 4y ago
I suppose that sending it during business hours and, who knows, maybe the final offer would be in the PDF and the poor guy couldn't wait to open it. The rest is history.
turtlebits 4y ago
If you're looking for work, you have to interview during the day, which you're probably in office (things are very different now). I know I'm guilty of having my personal emailed signed into my work computer (albeit with a separate browser). I've also done virtual interviews in the office meeting/phone room.
- bornfreddy 4y ago
  You've done interviews in the office of your (then) current employer??? Gutsy. I wouldn't dream of using employer's equipment, time or space while negotiating for a new employment.
the_af 4y ago
I open all sorts of PDFs, all the time, regardless of which computer I'm using. Is PDF as an attack vector such a widespread threat? I never payed much attention to them, assuming it's a document format that is relatively harmless even if it can include javascript. This is an honest question, by the way.
- kibibyte 4y ago
  https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=PDF+document https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=PDF+documen... PDFs are "harmless" on their own, but they are user-generated documents that conform to a complex specification. Viewing them requires software that parses them. These parsers are often written in unsafe low level languages. The (in)security of unsafe parsers reading user-generated input is a tale as old as time itself.
  - planede 4y ago
    Most people view pdfs now in web browsers built-in viewers. Especially if the job offer comes from a linkedin message, I would imagine most people would default to the browser viewer. While browsers are sure not without security vulnerabilities, I sure trust the PDF viewer within to be way more sandboxed than most standalone desktop PDF viewer applications. If the vulnerability (which I assume was RCE) was in a web browser, then it's a major bug.
    - kibibyte 4y ago
      As I mentioned in another comment (and I think others have mentioned this as well), browser PDF viewers implement a subset of PDF features, and notably they won't support things like forms (I think?) or signatures. So I can imagine that attacker tricked the user into opening the PDF with separate software by saying something along the lines of "you need Adobe Reader to sign this document" (and I don't think DocuSign is ubiquitous enough that users will second guess that).
      - planede 4y ago

PragmaticPulp 4y ago

> The main problem was using a machine that had access to half a billion dollars Going up a level, the main problem was that the company had a system where a single person could irreversibly transfer half a billion dollars away from the company.

handoflixue 4y ago
The article actually covers that it required 5 out of 9 people to sign off. They got 4 via PDF attacks and 1 via legacy access that was never properly terminated.
- tylersmith 4y ago
  The compromised employee had access to that 5th factor it was just not as direct as as him having a 5th private key.
- mousetree 4y ago
  My understanding of the article was that only 1 person was compromised and that the exploit installed on their computer was then used to access the validator nodes themselves. FWIW, I have no idea what a validator node is but I'm assuming that by compromising one employee's workstation they somehow got access to multiple other machines (which if true is itself a bit of a f* up).
  - logifail 4y ago
    > I'm assuming that by compromising one employee's workstation they somehow got access to multiple other machines (which if true is itself a bit of a f* up) Q: If you assume the bad guys have already compromised your workstation, how sure are you that they won't be able to compromise other machines you connect to?
    - charcircuit 4y ago
      You can't which is why one person shouldn't have access to more than one.

spaceman_2020 4y ago

When I first got into crypto, a few things were pretty much drilled into my head: - Not your keys, not your coins; always self-custody - Never use the same machine for trading and for work/surfing the web - Store only funds you want to regularly trade with on a hot wallet. Everything else on a cold wallet.

empraptor 4y ago
and this is part of why i think cryptocurrencies should have died before large number of people wasted their money on it. for the average user without the time/knowledge/patience to handle cryptos "properly", the choice is between losing money while handling this shit yourself or losing money while trusting someone else to do it right.
- spaceman_2020 4y ago
  Its an entirely free market. Just because one person doesn't understand the tech and loses his money doesn't mean that everyone else shouldn't be allowed to use it either. Even if you don't buy into the crypto vision (I don't), a digital-only currency that isn't tied to any nation-state does deserve to exist.
  - Retric 4y ago
    It’s fine for a few people to play with such a system. The issue if it’s absolutely clear crypto is incapable of widespread adoption or just about anything else people hype it up as, then it shouldn’t be hyped as if that stuff is a possibility. I could never tell how much was incompetence vs fraud, but either way without the hype vastly fewer suckers would be holding the bag right now. The crypto ecosystem has been just been terrible for just about everyone and things are far from over.
    - spaceman_2020 4y ago
      The people holding the bag right now mostly got in because of the allure of quick profits. And if they didn't sell even after making incredible (paper) returns, they have their own greed to blame. Bitcoin was $6,000 in March 2020. It hit $63,000 in April 2021. And if you didn't sell that top, it hit $67,000 again in November 2021. Even now, it has dropped less than Netflix, a supposed bluechip. I don't know what's the scam in this - you had plenty of entry opportunities and plenty of exit opportunities. The underlying system itself still works exactly as described.

emmelaich 4y ago

It wouldn't be one machine. The initial incursion would have been used to leverage other local attacks. Then targeting domain controllers and admin accounts. Probably also reading email; one possible way of finding it needed to get at 5 of 9 keys to unlock.

uoaei 4y ago

Not money. Crypto.

Fomite 4y ago

Seriously. This is standard practice for even fairly innocuous human subjects data, and it astonishes me when it's not done elsewhere.