The Looting of ShapeShift
news.bitcoin.com
The Looting of ShapeShift
1–10 of 95 posts
Re: The Looting of ShapeShift
#2This is certainly the worst case scenario - your security officer installing remote access software on developers machines, stealing bitcoins from production, then selling the company source code, access credentials and access to the internal network to a Russian hacker.
Building a security system to handle this level of attack is a whole level beyond stopping even determined external attackers. Are there any best practices guides on this?
One thing that the article showed is the importance of external security review to deal with the threat of internal incompetence or evil.
Re: The Looting of ShapeShift
#3What's the status of civil/criminal charges against Bob?
Re: The Looting of ShapeShift
#4 We learn some more things. Bob has prior police records in Florida, where he’s from.
Re: The Looting of ShapeShift
#5This is certainly the worst case scenario - your security officer installing remote access software on developers machines, stealing bitcoins from production, then selling the company source code, access credentials and access to the internal network to a Russian hacker. Building a security system to handle this level of attack is a whole level beyond stopping even determined external attackers. Are there any best pr…
Ultimately, the founders of bitcoin companies need to understand security themselves or they won't be able to hire and manage a competent team.
Despite all the theoretical advantages of blockchain over conventional banking protocols, they are not doing categorically better than banks at avoiding major losses. Although, the numbers at http://www.risk.net/operational-risk-and-regulation/opinion/... are shocking.
Re: The Looting of ShapeShift
#6We learn some more things. Bob has prior police records in Florida, where he’s from. So they didn't even do a background check before hiring "Bob"? For a position where he would have access to systems that handled financial data? That's just grossly incompetent, in my book. I've worked for 5-man startups and Fortune 500 companies. In every case, the offer letter has stated that the offer is conditional on the success…
They don't do the background check.
Re: The Looting of ShapeShift
#7We learn some more things. Bob has prior police records in Florida, where he’s from. So they didn't even do a background check before hiring "Bob"? For a position where he would have access to systems that handled financial data? That's just grossly incompetent, in my book. I've worked for 5-man startups and Fortune 500 companies. In every case, the offer letter has stated that the offer is conditional on the success…
That's sort of boilerplate though, isn't it? They reserve the right to do all sorts of terrible shit, but because most of that shit costs money they don't actually do it.
Re: The Looting of ShapeShift
#8We learn some more things. Bob has prior police records in Florida, where he’s from. So they didn't even do a background check before hiring "Bob"? For a position where he would have access to systems that handled financial data? That's just grossly incompetent, in my book. I've worked for 5-man startups and Fortune 500 companies. In every case, the offer letter has stated that the offer is conditional on the success…
They don't do the background check.
They do. At least, my latest position involved submitting my employment data for the past seven years to a firm that conducted background checks. Again, this was for a position that was several layers removed from any kind of direct access to customer data or financial data.
Re: The Looting of ShapeShift
#9Facinating. More interesting reading seems to be available here: https://www.patrolx.com/wp-content/uploads/2016/04/309591980...
Re: The Looting of ShapeShift
#10It seems odd to me that "Bob" hasn't been outed. It almost makes me suspect that someone isn't sure how much of "Bob's" role as portrayed in TFA is true and how much is a frame-job by an untouchable hacker [EDIT:] or wishful thinking by a frustrated executive.