Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A fake job offer took down Axie Infinity

theblock.co

Post reply on HN
Print view View original

161–170 of 364 posts

Re: A fake job offer took down Axie Infinity

#161

Post by wombatpm »

ChrisMarshallNY wrote: post #84
djbusby wrote: post #82

Earlier quoted context omitted.

Isn't LI owned by MS?

Yup. I'm gonna remove my cynical comment (although I still totally believe it). It's just not helpful. I think people can figure it out, for themselves. Also, people use LI as a way to aggregate information, then send emails that appear to be from LI, but are not. I got one of those, yesterday, and reported it to LI, saying "These guys obviously used your service to construct this honker." And LI's reply was ... enve…

I recently had some try the CEO/boss needs something right away for a customer ruse via text. I know LI was the source, because it referenced my previous job and LI still had the incorrect information. I played along that I was ready to purchase with my corporate card. Then after wasting more of their time, I sprung that they were fishing with old bait. Good times

Re: A fake job offer took down Axie Infinity

#162

Post by WorldMaker »

ineptech wrote: post #92
hn_throwaway_99 wrote: post #4

Two points to highlight from this article: 1. LinkedIn is an absolute godsend for bad guys, allowing easy targeting of everyone in the company with spear phishing emails and texts. I know many security professionals no longer use their real name, and don't list the real name of their company, because they know it's such a great hacking vector. Not sure what/whether LinkedIn can do anything about this. 2. I wish there…

> I wish there were more information about what the vulnerability was in the PDF in the first place. Agreed, I thought that opening a read-only PDF was GRAS regardless of the application.

PostScript is a Turing Complete language (always has been), and an over-simplified description of PDF is that it "just" wraps PostScript in a single Virtual Machine to target (versus PostScript has a lot of subtly different physical machines it was built for/targeted).

That "PDF VM" has had many 0-day RCE bugs over the years. Thankfully though the VM is standardized with the format it does have multiple implementations still in different applications and many exploits are application-specific implementation bugs.

Re: A fake job offer took down Axie Infinity

#163

Post by labrador »

Hamuko wrote: post #121
labrador wrote: post #38

Can someone explain to me how a pdf can execute code?

https://opensource.adobe.com/dc-acrobat-sdk-docs/standards/p... Page 414 and forwards. And if you're generally interested in PDF feature bloat, go to page 511 to find out how to embed 3D art, including the manipulation of the virtual camera, in your PDF document.

> 12.6.3 An annotation, page object or... that can trigger the execution of an action Page 415

What could go wrong?

Re: A fake job offer took down Axie Infinity

#164

Post by labrador »

tialaramex wrote: post #123
labrador wrote: post #66

Earlier quoted context omitted.

I see, much like Unicode exploits. I use Chrome to view PDFs which I assume to be safe.

Program and data aren't really different, philosophically. On some level this even applies to people. When someone teaches you French is that program or data? Is it just data? Why can you now understand French then? Or if it's program, how does that work, who taught the teacher how to program you? So, our best effort is to constrain what certain data can do when we process it, in the hope that this prevents surprisin…

Good idea, but WUFFS is written in C

Re: A fake job offer took down Axie Infinity

#165

Post by WorldMaker »

Sebguer wrote: post #115
hourago wrote: post #68

Earlier quoted context omitted.

> In a post-mortem blog post on the hack, published April 27, Sky Mavis said: “Employees are under constant advanced spear-phishing attacks on various social channels and one employee was compromised. This employee no longer works at Sky Mavis. The attacker managed to leverage that access to penetrate Sky Mavis IT infrastructure and gain access to the validator nodes.” The company fully blames the employee. I wish so…

Airlines would behave the same way if there wasn't an aggressive government regulatory body forcing them to learn from failures.

Government regulatory body and a pilot's union.

Re: A fake job offer took down Axie Infinity

#166

Post by WorldMaker »

alexk307 wrote: post #11
schemescape wrote: post #2

They say that a worker downloading (and presumably viewing) a PDF (fake job offer) allowed spyware in. Which PDF viewer was exploited?

You can easily embed arbitrary javascript into any PDF, and you can obfuscate it pretty well enough to get past most endpoint security tools on the market.

You don't even need JS in a PDF. PostScript remains a Turing Complete language on its own.

Re: A fake job offer took down Axie Infinity

#168

Post by rideontime »

cbsks wrote: post #71
esseti wrote: post #10

Did he get the job? because i guess he was fired from the previous one.

It’s also possible that he quit instead. If I interviewed for a new job, accepted an offer, and then everything blew up in my face… I’d probably not want to stick around.

Yeah, I wouldn't want to work for a company that designed a system that allowed this sort of thing to happen either.

Re: A fake job offer took down Axie Infinity

#169

Post by xmprt »

hourago wrote: post #68
londons_explore wrote: post #19

The other major cause of the failure was that one dev had access to 5 signing keys. That shouldn't have happened, because than that one dev could have run off with $540 Million... And remember, it wasn't just that one dev - it was everything running on his computer - think of the probably tens of thousands of developers who wrote the code that runs as root on his PC, much of it unreviewed.

> In a post-mortem blog post on the hack, published April 27, Sky Mavis said: “Employees are under constant advanced spear-phishing attacks on various social channels and one employee was compromised. This employee no longer works at Sky Mavis. The attacker managed to leverage that access to penetrate Sky Mavis IT infrastructure and gain access to the validator nodes.” The company fully blames the employee. I wish so…

I don't think you can generalize Web3 companies to all software companies. Web3 companies have shown time and time again that they don't care much about security or good software development practices. I'm not sure if it's because the industry is so nascent or because the people joining are simply incompetent or because they don't care (or a combination of all three) but it's clear that Web3 companies have major incidents at higher rates than most other software companies.

Re: A fake job offer took down Axie Infinity

#170

Post by jedberg »

SV_BubbleTime wrote: post #160
CobrastanJorji wrote: post #151

Earlier quoted context omitted.

I'm trying to imagine a setup at any company whose primary business is controlling extremely valuable digital assets having a security setup that could be entirely undone with keyloggers, and it's difficult. No necessary VPNs, keys on devices, or other non-password authentication? One engineer's password should not be the keys to the kingdom. Sounds like a bad RPG plot. "Because of its danger, we broke the Obsidian K…

Agreed. The article doesn't mention keylogger at all. I was definitely picturing a remote control exploit.

They must have updated it. When I read it it specifically said keylogger.
Post reply on HN