5 ms·

The article actually covers that it required 5 out of 9 people to sign off. They got 4 via PDF attacks and 1 via legacy access that was never properly terminate

The article actually covers that it required 5 out of 9 people to sign off. They got 4 via PDF attacks and 1 via legacy access that was never properly terminated.

tylersmith 4y ago
The compromised employee had access to that 5th factor it was just not as direct as as him having a 5th private key.
mousetree 4y ago
My understanding of the article was that only 1 person was compromised and that the exploit installed on their computer was then used to access the validator nodes themselves. FWIW, I have no idea what a validator node is but I'm assuming that by compromising one employee's workstation they somehow got access to multiple other machines (which if true is itself a bit of a f* up).
- logifail 4y ago
  > I'm assuming that by compromising one employee's workstation they somehow got access to multiple other machines (which if true is itself a bit of a f* up) Q: If you assume the bad guys have already compromised your workstation, how sure are you that they won't be able to compromise other machines you connect to?
  - charcircuit 4y ago
    You can't which is why one person shouldn't have access to more than one.
  - fsckboy 4y ago
    because the workstation was compromised by opening a corrupted pdf, but that vector wouldn't compromise the other machines unless users on them could be induced to open the same pdf. not to say it can't be done, but it was unexplained
    - sangnoir 4y ago
      It doesn't have to be the same pdf, it could have been an attachments from compromised machine via email/slack. "Hey, can you help me figure this unusual log/transaction summary". How many wouldn't open such an attachment from a "colleague"?
      - emmelaich 4y ago
        Yep, internal security is brittle. The initial pdf vector would be only the start of a long sequence of hacks, including social engineering. e.g. sending email from managers -- or slack messages as you mention.
        DelightOne 4y ago
        How do you defend against getting email from internal people, especially from people you expect email from?
        mavhc 4y ago
        Don't keep your security keys capable of root access on anything that's not a hardware token locked in a safe. Of course if you can access the software running the blockchain and get everyone to install an update, that works too
        JacobThreeThree 4y ago
        You can call your colleague on the phone to confirm they sent the email asking you to open an attachment.
    - mannykannot 4y ago
      It does not have to be via the same method; what the attackers discover from the first compromised machine may give them access to other machines. It seems clear this is what happened here: Employees are under constant advanced spear-phishing attacks on various social channels and one employee was compromised... The attacker managed to leverage that access to penetrate Sky Mavis IT infrastructure and gain access to the validator nodes.
  - deleted 4y ago
    [deleted]
8note 4y ago
I think it's worth noting that the people did not sign off, only the keys did. The system does not require people to sign off, but for the keys to sign off. I don't think it's worth calling this a hack, the keys are what owned the moneies, and it's the keys that decided what to do with it. People have access to keys, they don't own them
- brokensegue 4y ago
  This is a preposterous position. It's clearly a hack. Keys cannot legally own anything. People and organizations own things and in this case the people were hacked and the funds stolen.
- LASR 4y ago
  Ok. So by your logic, my house keys owns my house? But don’t I own my house keys too?
  - rmbyrro 4y ago
    Your keychain owns your house keys. It should be paying your mortgage, by the way.
- birdyrooster 4y ago
walrus01 4y ago
What the hell is a system that is 1 out of 9 partial crypto key signers for huge amounts of money doing with even a GUI or a PDF reader on it in the first place. Sounds like people using their personal workstation.

The article actually covers that it required 5 out of 9 people to sign off. They got 4 via PDF attacks and 1 via legacy access that was never properly terminated.

tylersmith 4y ago

The compromised employee had access to that 5th factor it was just not as direct as as him having a 5th private key.

mousetree 4y ago

My understanding of the article was that only 1 person was compromised and that the exploit installed on their computer was then used to access the validator nodes themselves. FWIW, I have no idea what a validator node is but I'm assuming that by compromising one employee's workstation they somehow got access to multiple other machines (which if true is itself a bit of a f* up).

logifail 4y ago
> I'm assuming that by compromising one employee's workstation they somehow got access to multiple other machines (which if true is itself a bit of a f* up) Q: If you assume the bad guys have already compromised your workstation, how sure are you that they won't be able to compromise other machines you connect to?
- charcircuit 4y ago
  You can't which is why one person shouldn't have access to more than one.
- fsckboy 4y ago
  because the workstation was compromised by opening a corrupted pdf, but that vector wouldn't compromise the other machines unless users on them could be induced to open the same pdf. not to say it can't be done, but it was unexplained
  - sangnoir 4y ago
    It doesn't have to be the same pdf, it could have been an attachments from compromised machine via email/slack. "Hey, can you help me figure this unusual log/transaction summary". How many wouldn't open such an attachment from a "colleague"?
    - emmelaich 4y ago
      Yep, internal security is brittle. The initial pdf vector would be only the start of a long sequence of hacks, including social engineering. e.g. sending email from managers -- or slack messages as you mention.
      - DelightOne 4y ago
        How do you defend against getting email from internal people, especially from people you expect email from?
        mavhc 4y ago
        Don't keep your security keys capable of root access on anything that's not a hardware token locked in a safe. Of course if you can access the software running the blockchain and get everyone to install an update, that works too
        JacobThreeThree 4y ago
        You can call your colleague on the phone to confirm they sent the email asking you to open an attachment.
  - mannykannot 4y ago
    It does not have to be via the same method; what the attackers discover from the first compromised machine may give them access to other machines. It seems clear this is what happened here: Employees are under constant advanced spear-phishing attacks on various social channels and one employee was compromised... The attacker managed to leverage that access to penetrate Sky Mavis IT infrastructure and gain access to the validator nodes.
- deleted 4y ago
  [deleted]

8note 4y ago

I think it's worth noting that the people did not sign off, only the keys did. The system does not require people to sign off, but for the keys to sign off. I don't think it's worth calling this a hack, the keys are what owned the moneies, and it's the keys that decided what to do with it. People have access to keys, they don't own them

brokensegue 4y ago
This is a preposterous position. It's clearly a hack. Keys cannot legally own anything. People and organizations own things and in this case the people were hacked and the funds stolen.
LASR 4y ago
Ok. So by your logic, my house keys owns my house? But don’t I own my house keys too?
- rmbyrro 4y ago
  Your keychain owns your house keys. It should be paying your mortgage, by the way.
birdyrooster 4y ago

walrus01 4y ago

What the hell is a system that is 1 out of 9 partial crypto key signers for huge amounts of money doing with even a GUI or a PDF reader on it in the first place. Sounds like people using their personal workstation.