4 ms·

My understanding of the article was that only 1 person was compromised and that the exploit installed on their computer was then used to access the validator no

My understanding of the article was that only 1 person was compromised and that the exploit installed on their computer was then used to access the validator nodes themselves. FWIW, I have no idea what a validator node is but I'm assuming that by compromising one employee's workstation they somehow got access to multiple other machines (which if true is itself a bit of a f* up).

logifail 4y ago
> I'm assuming that by compromising one employee's workstation they somehow got access to multiple other machines (which if true is itself a bit of a f* up) Q: If you assume the bad guys have already compromised your workstation, how sure are you that they won't be able to compromise other machines you connect to?
- charcircuit 4y ago
  You can't which is why one person shouldn't have access to more than one.
- fsckboy 4y ago
  because the workstation was compromised by opening a corrupted pdf, but that vector wouldn't compromise the other machines unless users on them could be induced to open the same pdf. not to say it can't be done, but it was unexplained
  - sangnoir 4y ago
    It doesn't have to be the same pdf, it could have been an attachments from compromised machine via email/slack. "Hey, can you help me figure this unusual log/transaction summary". How many wouldn't open such an attachment from a "colleague"?
    - emmelaich 4y ago
      Yep, internal security is brittle. The initial pdf vector would be only the start of a long sequence of hacks, including social engineering. e.g. sending email from managers -- or slack messages as you mention.
      - DelightOne 4y ago
        How do you defend against getting email from internal people, especially from people you expect email from?
        mavhc 4y ago
        Don't keep your security keys capable of root access on anything that's not a hardware token locked in a safe. Of course if you can access the software running the blockchain and get everyone to install an update, that works too
        JacobThreeThree 4y ago
        You can call your colleague on the phone to confirm they sent the email asking you to open an attachment.
  - mannykannot 4y ago
    It does not have to be via the same method; what the attackers discover from the first compromised machine may give them access to other machines. It seems clear this is what happened here: Employees are under constant advanced spear-phishing attacks on various social channels and one employee was compromised... The attacker managed to leverage that access to penetrate Sky Mavis IT infrastructure and gain access to the validator nodes.
- deleted 4y ago
  [deleted]

logifail 4y ago

> I'm assuming that by compromising one employee's workstation they somehow got access to multiple other machines (which if true is itself a bit of a f* up) Q: If you assume the bad guys have already compromised your workstation, how sure are you that they won't be able to compromise other machines you connect to?

charcircuit 4y ago
You can't which is why one person shouldn't have access to more than one.
fsckboy 4y ago
because the workstation was compromised by opening a corrupted pdf, but that vector wouldn't compromise the other machines unless users on them could be induced to open the same pdf. not to say it can't be done, but it was unexplained
- sangnoir 4y ago
  It doesn't have to be the same pdf, it could have been an attachments from compromised machine via email/slack. "Hey, can you help me figure this unusual log/transaction summary". How many wouldn't open such an attachment from a "colleague"?
  - emmelaich 4y ago
    Yep, internal security is brittle. The initial pdf vector would be only the start of a long sequence of hacks, including social engineering. e.g. sending email from managers -- or slack messages as you mention.
    - DelightOne 4y ago
      How do you defend against getting email from internal people, especially from people you expect email from?
      - mavhc 4y ago
        Don't keep your security keys capable of root access on anything that's not a hardware token locked in a safe. Of course if you can access the software running the blockchain and get everyone to install an update, that works too
      - JacobThreeThree 4y ago
        You can call your colleague on the phone to confirm they sent the email asking you to open an attachment.
- mannykannot 4y ago
  It does not have to be via the same method; what the attackers discover from the first compromised machine may give them access to other machines. It seems clear this is what happened here: Employees are under constant advanced spear-phishing attacks on various social channels and one employee was compromised... The attacker managed to leverage that access to penetrate Sky Mavis IT infrastructure and gain access to the validator nodes.
deleted 4y ago
[deleted]