4 ms·

It seems like a reasonably well written anecdote by someone who has some idea what they're talking about. It could obviously be false, but the consequences if h

by darawk 4y ago

It seems like a reasonably well written anecdote by someone who has some idea what they're talking about. It could obviously be false, but the consequences if he's right are potentially serious for a lot of HN users who might use LastPass. The consequences if he's wrong are a little extra reputational damage for LastPass, but that seems like a worthwhile tradeoff here. Not everything posted on HN has to be verified true. The decision calculus here seems strongly in favor of signal boosting it, so that people who need to can take defensive action, even if it turns out to be wrong.

_cenw 4y ago
> someone who has some idea what they're talking about "I suspected someone used a 0day on me" is not exactly inspiring confidence
- darawk 4y ago
  Why not? I have a security background. I see nothing wrong with that statement. Although what he actually said was: "Initially I imagined I was targeted by a 0day or rootkit" which actually does not make sense, because it implies he thinks those two things are fungible. He's obviously not a security expert, but he's also obviously not totally technically incompetent.
  - _cenw 4y ago
    It's quite unlikely someone would risk burning a viable 0day without either going wide (and then we would've heard from a few more people) or going after a well outlined target that would be guaranteed to be worth more than the 0day itself.
    - darawk 4y ago
      I guess my prior based on the way this guy was talking was that he probably had at least 6-7 figures in crypto stolen, which is worth it for a mid tier 0day. Especially if you think it's unlikely to actually get burnt.
    - deathgripsss 4y ago
      The person in question is very wealthy. I know at one point his portfolio was 9 figures. That may have been at the peak of the bull market but I imagine path is still very rich. Is it worth a 0day, still not sure.
  - deleted 4y ago
    [deleted]
  - uuvs8 4y ago
    If you have a security background then you know that 0days go for 6-7 figures and it's unlikely somebody would burn one of those on some random dude. Way to make yourself feel important. It's not that you made some terrible choices yourself, like using a known-insecure password manager SaaS, or putting real money into crypto. Nono, somebody pulled a 0day on me, what can ya do? Shrugs
  - dmix 4y ago
    To explain your comment a bit: It should be 0 day AND a rootkit, not OR. Plus the rootkit is not always needed or possible. Also the people talking about “burning zero days”… every time you use an exploit (ignoring the exact meaning of 0 days) it doesn’t become burned by the first person. The hacker could use it on hundreds of people before it’s discovered and patched by whatever software it targets. That could take months.
    - justsomeadvice0 4y ago
      It can certainly be "or": rootkits can come from your machine's supply chain, and lie mostly dormant for many months or years before activation. Rootkits can get installed after a non-zero-day-entrypoint vector e.g. simply tricking the user into running downloaded malware. etc.
tinco 4y ago
It's like a novice programmer blaming the compiler for a bug in their application. It's very unlikely to be true. What would you have the people who are using LastPass do, stop using it? Because some crypto dude stored their highly valuable keys in a system that literally copies their keys to any system they log into, to systems that are notorious for having very leaky abstractions and vast vulnerability surfaces?
- TomSwirly 4y ago
  > It's like a novice programmer blaming the compiler for a bug in their application. The big difference between the two examples is this: LastPass is known to have bugs. Huge amounts of data were stolen from them and we just found out that it was a lot more than we thought. For all we know, they were storing passwords in the clear somewhere. Trivia note: the first compiled language I used was PL/I, and the compiler was notoriously buggy and would crash on well-formed programs. Our teacher told us to put do-nothing statements in when this happened (`PUT SKIP(0);` if I recall correctly), and with some trial and error, those would fix it.
- shkkmo 4y ago
  > What would you have the people who are using LastPass do, stop using it? Yes. After their last major breach I exported all my data and deleted all my credentials and account with LastPass. Seeing the details of this breach, I'm super happy I did.
  - tinco 4y ago
    I eh.. was not up to date, I blame our office Christmas party. I guess I'm moving our organization over next year..
    - shkkmo 4y ago
      I meant the major breach before this one, I believe that was the one that gave attackers access to their dev environment, which they used to steal the developer credentials they used to make this attack.
literalAardvark 4y ago
Someone who has any idea what they're talking about in this case would have used a hardware wallet.
- Semaphor 4y ago
  > The losses are not significant. That together with others here claiming they have a LOT, makes me think they might have hot, cold, soft and hardware wallets.
  - literalAardvark 4y ago
    Fair enough. Serves me right for not reading the op for once.
themitigating 4y ago
"Well written" That's subjective and has no value in determining whether the post is true. "Not everything posted on HN has to be verified true. The decision calculus here seems strongly in favor of signal boosting it, so that people who need to can take defensive action, even if it turns out to be wrong." What? Proven true, no, any sort of evidence, yes. As for taking actions, there's a cost.

by darawk 4y ago

_cenw 4y ago

> someone who has some idea what they're talking about "I suspected someone used a 0day on me" is not exactly inspiring confidence

darawk 4y ago
Why not? I have a security background. I see nothing wrong with that statement. Although what he actually said was: "Initially I imagined I was targeted by a 0day or rootkit" which actually does not make sense, because it implies he thinks those two things are fungible. He's obviously not a security expert, but he's also obviously not totally technically incompetent.
- _cenw 4y ago
  It's quite unlikely someone would risk burning a viable 0day without either going wide (and then we would've heard from a few more people) or going after a well outlined target that would be guaranteed to be worth more than the 0day itself.
  - darawk 4y ago
    I guess my prior based on the way this guy was talking was that he probably had at least 6-7 figures in crypto stolen, which is worth it for a mid tier 0day. Especially if you think it's unlikely to actually get burnt.
  - deathgripsss 4y ago
    The person in question is very wealthy. I know at one point his portfolio was 9 figures. That may have been at the peak of the bull market but I imagine path is still very rich. Is it worth a 0day, still not sure.
- deleted 4y ago
  [deleted]
- uuvs8 4y ago
  If you have a security background then you know that 0days go for 6-7 figures and it's unlikely somebody would burn one of those on some random dude. Way to make yourself feel important. It's not that you made some terrible choices yourself, like using a known-insecure password manager SaaS, or putting real money into crypto. Nono, somebody pulled a 0day on me, what can ya do? Shrugs
- dmix 4y ago
  To explain your comment a bit: It should be 0 day AND a rootkit, not OR. Plus the rootkit is not always needed or possible. Also the people talking about “burning zero days”… every time you use an exploit (ignoring the exact meaning of 0 days) it doesn’t become burned by the first person. The hacker could use it on hundreds of people before it’s discovered and patched by whatever software it targets. That could take months.
  - justsomeadvice0 4y ago
    It can certainly be "or": rootkits can come from your machine's supply chain, and lie mostly dormant for many months or years before activation. Rootkits can get installed after a non-zero-day-entrypoint vector e.g. simply tricking the user into running downloaded malware. etc.

tinco 4y ago

It's like a novice programmer blaming the compiler for a bug in their application. It's very unlikely to be true. What would you have the people who are using LastPass do, stop using it? Because some crypto dude stored their highly valuable keys in a system that literally copies their keys to any system they log into, to systems that are notorious for having very leaky abstractions and vast vulnerability surfaces?

TomSwirly 4y ago
> It's like a novice programmer blaming the compiler for a bug in their application. The big difference between the two examples is this: LastPass is known to have bugs. Huge amounts of data were stolen from them and we just found out that it was a lot more than we thought. For all we know, they were storing passwords in the clear somewhere. Trivia note: the first compiled language I used was PL/I, and the compiler was notoriously buggy and would crash on well-formed programs. Our teacher told us to put do-nothing statements in when this happened (`PUT SKIP(0);` if I recall correctly), and with some trial and error, those would fix it.
shkkmo 4y ago
> What would you have the people who are using LastPass do, stop using it? Yes. After their last major breach I exported all my data and deleted all my credentials and account with LastPass. Seeing the details of this breach, I'm super happy I did.
- tinco 4y ago
  I eh.. was not up to date, I blame our office Christmas party. I guess I'm moving our organization over next year..
  - shkkmo 4y ago
    I meant the major breach before this one, I believe that was the one that gave attackers access to their dev environment, which they used to steal the developer credentials they used to make this attack.

literalAardvark 4y ago

Someone who has any idea what they're talking about in this case would have used a hardware wallet.

Semaphor 4y ago
> The losses are not significant. That together with others here claiming they have a LOT, makes me think they might have hot, cold, soft and hardware wallets.
- literalAardvark 4y ago
  Fair enough. Serves me right for not reading the op for once.

themitigating 4y ago

"Well written" That's subjective and has no value in determining whether the post is true. "Not everything posted on HN has to be verified true. The decision calculus here seems strongly in favor of signal boosting it, so that people who need to can take defensive action, even if it turns out to be wrong." What? Proven true, no, any sort of evidence, yes. As for taking actions, there's a cost.