121–130 of 364 posts
Can someone explain to me how a pdf can execute code?
Page 414 and forwards. And if you're generally interested in PDF feature bloat, go to page 511 to find out how to embed 3D art, including the manipulation of the virtual camera, in your PDF document.
Did he get the job? because i guess he was fired from the previous one.
kinda disgusting he got fired for this if that was the case. Its a very sophisticated attack and I think its conversion rate would be rather high.
Earlier quoted context omitted.
Exploits in the PDF viewer. The Adobe tools in particular have been a bountiful source of exploits for decades, but it's a complicated spec and there are plenty of opportunities for bugs.
I see, much like Unicode exploits. I use Chrome to view PDFs which I assume to be safe.
So, our best effort is to constrain what certain data can do when we process it, in the hope that this prevents surprising negative consequences like a PDF that steals privileged information and sends it elsewhere.
Notice that, in some sense, a PDF which just contains a photograph of your wife tied to a chair and holding today's newspaper, plus human readable text like, "We have your wife Sarah and all three kids Beth, Jim and Amanda. We are watching. Do not try to call for help. Email the privileged information to crooks@example.com or we will kill your family" is also potentially effective at doing this, but we would not usually consider that an exploit in this context.
One irritation in this space is that programmers love General Purpose Programming Languages. The idea of the general purpose language is that it can do anything. But the problem in this sort of situation is that we don't want programs which can do anything, in fact doing anything is our worst case scenario. We actually want Special Purpose Programming Languages. We want to write our PDF data processing software in a language that even if we were trying can't do the things that should never happen as a result of processing a PDF.
This is the purpose of languages like WUFFS: https://github.com/google/wuffs
You can't write a WUFFS program to, for example, email anything to crooks@example.com even if you desperately needed to, which means you definitely won't accidentally write a program which can email the privileged information to the crooks when fed a PDF. Of course the PDF mentioned earlier with the kidnap note inside it could still work. And also of course making a PDF renderer out of WUFFS would be a really big ask. WUFFS-the-library today can render PNG, GIF, BMP but notably not yet JPEG. But it's clearly possible for something like PDF rendering to happen under these constraints. Nobody ordinarily viewing a PDF wants it to do arbitrary stuff.
Are we sure this heist wasn’t an inside job? Axie was collapsing under its own weight and an employee decided to swipe all of the crypto after making up this crazy job offer PDF story to cover their tracks.
Earlier quoted context omitted.
The main problem was using a machine that had access to half a billion dollars to also browse the web and do stuff like applying for jobs. If you're gonna have access to such amount of money, it's worth buying a dedicated machine and using it very, very cautiously.
I still can't believe that they opened the PDF on the company computer. I always use my home computer and the poor hacker would get bored of seeing all of my Raspberry Pi projects that I haven't done.
Earlier quoted context omitted.
The main problem was using a machine that had access to half a billion dollars to also browse the web and do stuff like applying for jobs. If you're gonna have access to such amount of money, it's worth buying a dedicated machine and using it very, very cautiously.
I still can't believe that they opened the PDF on the company computer. I always use my home computer and the poor hacker would get bored of seeing all of my Raspberry Pi projects that I haven't done.
Unless this was a zero day, but I would have assumed the article would mention that fact ..
I think the media and tech writes overestimate the efficacy of spear phishing attacks. There is tons of research involved in finding suitable targets and then planning out the attack, such as the exploit, fake websites, fake emails, and other ingredients.
It helps when your boss is a state actor and your target chooses to put $625 million in assets behind what amounts to a single point of failure
Earlier quoted context omitted.
The main problem was using a machine that had access to half a billion dollars to also browse the web and do stuff like applying for jobs. If you're gonna have access to such amount of money, it's worth buying a dedicated machine and using it very, very cautiously.
> The main problem was using a machine that had access to half a billion dollars Going up a level, the main problem was that the company had a system where a single person could irreversibly transfer half a billion dollars away from the company.
Earlier quoted context omitted.
Yeah, though I'd get dinged by that either way since I normally update my bio to include recent projects/tech I've worked with. This way I can hide behind plausible deniability "Oh, I just got around to adding X company to my LinkedIn" if I need to, whereas updating an existing entry is harder to justify (without giving away you are looking). Though I also try not to work for companies that I would need to worry abou…
I doubt they'd actually ask you about it (and thus give you a chance to "explain" yourself), HR would just note you down and you'd be more likely to be laid off, less likely to get promotions approved, etc.
This is not how companies work (at least the ones worth working for). Retention risk is a reflection on their current role, compensation, manager, etc.
We have absolutely promoted high performing employees and/or given them raises even though we knew they were looking at other opportunities.