Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A fake job offer took down Axie Infinity

theblock.co

Post reply on HN
Print view View original

61–70 of 364 posts

Re: A fake job offer took down Axie Infinity

#61

Post by secondcoming »

hn_throwaway_99 wrote: post #4

Two points to highlight from this article: 1. LinkedIn is an absolute godsend for bad guys, allowing easy targeting of everyone in the company with spear phishing emails and texts. I know many security professionals no longer use their real name, and don't list the real name of their company, because they know it's such a great hacking vector. Not sure what/whether LinkedIn can do anything about this. 2. I wish there…

Also, don't use a company device for personal business.

If you use your own device then do company work in a VM.

Re: A fake job offer took down Axie Infinity

#63

Post by lordnacho »

pcthrowaway wrote: post #8

Curious if anyone has been able to find technical details of how this attack works/worked. I'm under the impression most PDF viewers would prevent this sort of attack (e.g. opening a PDF in your browser should sandbox it to the browsing context), but really keen to know what PDF viewer / OS was used by the dev.

Does it even need to be terribly complicated? Congrats on your new job, here's a script for you to generate a new ssh key with us, just copy/paste it in your terminal and that will sort it out.

Re: A fake job offer took down Axie Infinity

#64

Post by kube-system »

dboreham wrote: post #59
kube-system wrote: post #41

Earlier quoted context omitted.

You don't just take some dude's word for it when dealing with a $600+ million dollar heist. There were multiple third party investigators involved in the aftermath.

Perhaps they not taking his word, but waiting for him to move the funds?

They already know where the money went:

https://home.treasury.gov/policy-issues/financial-sanctions/...

And it has already been moved:

https://www.blockchain.com/eth/address/0x098B716B8Aaf2151299...

Re: A fake job offer took down Axie Infinity

#65

Post by bckr »

8organicbits wrote: post #21
koofdoof wrote: post #18

Earlier quoted context omitted.

How usable is LinkedIn with a pseudonym? Is that a security industry only practice or could a regular dev get away with that too? I've always been shy about having a profile with my actual name but id consider one with a thin veil of anonymity.

Same, although my perception is that LinkedIn has moved past its peak usefulness, and it would be better to spend time on other platforms than creating a LI account. All I hear about LinkedIn these days is spam.

which other platform?

Re: A fake job offer took down Axie Infinity

#66

Post by labrador »

pjc50 wrote: post #46
labrador wrote: post #38

Can someone explain to me how a pdf can execute code?

Exploits in the PDF viewer. The Adobe tools in particular have been a bountiful source of exploits for decades, but it's a complicated spec and there are plenty of opportunities for bugs.

I see, much like Unicode exploits. I use Chrome to view PDFs which I assume to be safe.

Re: A fake job offer took down Axie Infinity

#67

Post by jedberg »

For those that don't want to read the whole thing, (supposedly) the attackers reached out on linkedin to a bunch of employees asking them to apply to a fake company. One of them did it, went through a bunch of fake interviews, and then got a fake offer, in the form of a PDF.

They opened the PDF and that installed a keylogger on their system (it doesn't explain how).

The attackers then used that engineer's credentials to take over 4 of the 9 validators on the blockchain which they then used for their heist.

Re: A fake job offer took down Axie Infinity

#68

Post by hourago »

londons_explore wrote: post #19

The other major cause of the failure was that one dev had access to 5 signing keys. That shouldn't have happened, because than that one dev could have run off with $540 Million... And remember, it wasn't just that one dev - it was everything running on his computer - think of the probably tens of thousands of developers who wrote the code that runs as root on his PC, much of it unreviewed.

> In a post-mortem blog post on the hack, published April 27, Sky Mavis said: “Employees are under constant advanced spear-phishing attacks on various social channels and one employee was compromised. This employee no longer works at Sky Mavis. The attacker managed to leverage that access to penetrate Sky Mavis IT infrastructure and gain access to the validator nodes.”

The company fully blames the employee. I wish software companies had the same level of professionalism than airlines. "It's the pilot's fault" does not help to improve security. Nothing is learned.

Re: A fake job offer took down Axie Infinity

#70

Post by CamelRocketFish »

TedDoesntTalk wrote: post #27
londons_explore wrote: post #17

Chrome/Edge PDF viewers are pretty secure. You can reasonably safely open anything in them. Desktop PDF viewers like acrobat are gaping security holes... Don't use them!

I use PDF Expert on MacOS for its editing and markup abilities; built-in browser viewers aren’t good for that. What should I do?

Don’t work for a crypto company.
Post reply on HN