Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A fake job offer took down Axie Infinity

theblock.co

Post reply on HN
Print view View original

291–300 of 364 posts

Re: A fake job offer took down Axie Infinity

#291

Post by h4waii »

hn_throwaway_99 wrote: post #4

Two points to highlight from this article: 1. LinkedIn is an absolute godsend for bad guys, allowing easy targeting of everyone in the company with spear phishing emails and texts. I know many security professionals no longer use their real name, and don't list the real name of their company, because they know it's such a great hacking vector. Not sure what/whether LinkedIn can do anything about this. 2. I wish there…

This is hilarious.

People on LinkedIn, using a name sufficiently far enough away from their real name so as to not be able to be easily found, listing their security jobs with again, sufficiently far enough away org names.

Turtles all the way down.

Re: A fake job offer took down Axie Infinity

#292

Post by hydroplane »

hn_throwaway_99 wrote: post #4

Two points to highlight from this article: 1. LinkedIn is an absolute godsend for bad guys, allowing easy targeting of everyone in the company with spear phishing emails and texts. I know many security professionals no longer use their real name, and don't list the real name of their company, because they know it's such a great hacking vector. Not sure what/whether LinkedIn can do anything about this. 2. I wish there…

One thing about LinkedIn that profoundly bothered me when it got popular was the fact that you were expected to share a photo on your profile. Back in the day, in the US, attaching a photo to a resume was a big no-no, but here was a new way of recruiting that circumvented that principle. I found it shocking how readily and eagerly people threw that convention out.

Re: A fake job offer took down Axie Infinity

#293

Post by jjfoooo4 »

CobrastanJorji wrote: post #267
phphphphp wrote: post #200

Earlier quoted context omitted.

I completely agree in principle but the nuance here is that I’m leaning on the belief that people joining Axie do not “…stand to benefit…” because the long term prospects of Axie Infinity are not good (and have never been good) and so anybody analysing the benefit of joining them — who has a broad range of opportunities available to them — would immediately see how little they stand to benefit from getting involved w…

I disagree. Competent engineers go where they will be paid, and crypto startups are often one of the few places that can pay our frankly insane compensation requirements. I had a recruiter contact me just recently for some crypto game that was offering something like $600k/year (which I unfortunately assume was at least partly stock) for one of them, and that would certainly have been enough to attract real security…

I think examining the incentives of the managers is far more likely to be informative than looking at IC engineers. The best security engineer in the world probably couldn’t have prevented this hack if management doesn’t listen to what they say.

Re: A fake job offer took down Axie Infinity

#294

Post by LASR »

8note wrote: post #229
handoflixue wrote: post #128

Earlier quoted context omitted.

The article actually covers that it required 5 out of 9 people to sign off. They got 4 via PDF attacks and 1 via legacy access that was never properly terminated.

I think it's worth noting that the people did not sign off, only the keys did. The system does not require people to sign off, but for the keys to sign off. I don't think it's worth calling this a hack, the keys are what owned the moneies, and it's the keys that decided what to do with it. People have access to keys, they don't own them

Ok. So by your logic, my house keys owns my house?

But don’t I own my house keys too?

Re: A fake job offer took down Axie Infinity

#295

Post by kibibyte »

the_af wrote: post #282
abirch wrote: post #106

Earlier quoted context omitted.

I still can't believe that they opened the PDF on the company computer. I always use my home computer and the poor hacker would get bored of seeing all of my Raspberry Pi projects that I haven't done.

I open all sorts of PDFs, all the time, regardless of which computer I'm using. Is PDF as an attack vector such a widespread threat? I never payed much attention to them, assuming it's a document format that is relatively harmless even if it can include javascript. This is an honest question, by the way.

https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=PDF+documen...

PDFs are "harmless" on their own, but they are user-generated documents that conform to a complex specification. Viewing them requires software that parses them. These parsers are often written in unsafe low level languages.

The (in)security of unsafe parsers reading user-generated input is a tale as old as time itself.

Re: A fake job offer took down Axie Infinity

#296

Post by LASR »

logifail wrote: post #179
da39a3ee wrote: post #140

Earlier quoted context omitted.

Huh? I've used my company laptops for my personal life for the last 15 years. Why would I want to carry two laptops everywhere? I travel. I barely remember what a personal laptop is.

> I've used my company laptops for my personal life for the last 15 years. Counterpoint: I've been completely and utterly allergic to opening anything personal from any company system for longer than that.

Same here.

I get MDM profile updates from IT on my work machine. One time they auto-installed a cloud backup service and sent out a company-wide email after they already did it. Something like: “Now nobody has to deal with lost data. You’re welcome!”

Huge backlash from employees on that move. But I get both perspectives. These are work machines, and a mundane accident with the equipment shouldn’t incur significant losses to the business.

But apart from the potential loss of personal privacy, it feels wrong. Especially so, when you’re looking for other jobs.

Re: A fake job offer took down Axie Infinity

#297

Post by [deleted] »

samstave wrote: post #137
hn_throwaway_99 wrote: post #4

Two points to highlight from this article: 1. LinkedIn is an absolute godsend for bad guys, allowing easy targeting of everyone in the company with spear phishing emails and texts. I know many security professionals no longer use their real name, and don't list the real name of their company, because they know it's such a great hacking vector. Not sure what/whether LinkedIn can do anything about this. 2. I wish there…

Speaking of spear phishing: When I was at lockheed we had an incident whereby a bunch of folks had attended some defense conference, and after the fact received emails from folks they had 'met' at the conference, something along the lines of "Hey Bob, we met at the [defense] conference this last week and I wanted to be sure you had my contact info: malware-contact.vcf" or some other payload. This installed a very slo…

[deleted]

Re: A fake job offer took down Axie Infinity

#298

Post by sacrosancty »

Retric wrote: post #249
spaceman_2020 wrote: post #242

Earlier quoted context omitted.

The people holding the bag right now mostly got in because of the allure of quick profits. And if they didn't sell even after making incredible (paper) returns, they have their own greed to blame. Bitcoin was $6,000 in March 2020. It hit $63,000 in April 2021. And if you didn't sell that top, it hit $67,000 again in November 2021. Even now, it has dropped less than Netflix, a supposed bluechip. I don't know what's th…

I lost nothing, but I can empathies with people who are screwed. It’s not that Bitcoin or any alt coin has X paper value right now, it’s nobody can get out without someone else getting stuck holding the bag. The underlying system is predatory because mining isn’t free so it’s a negative sum game where people have already cashed out. I remember being saddened when it was less than 1/1,000th isn’t current value I reali…

Wait a minute. You decided not to invest early, despite expecting it to be massively profitable because you were worried about the morality of allowing less competent people to try the same thing in future? Are you sure that's really the truth and you weren't just too hesitant and now you regret missing out so you've gone all salty?

Re: A fake job offer took down Axie Infinity

#299

Post by zrobotics »

noduerme wrote: post #195
jcrawfordor wrote: post #133

Earlier quoted context omitted.

Most PDF "attacks" in the real world are very unsophisticated. One of the most common uses of PDFs in a phishing context is just as a way to deliver a link that would likely result in blocking by email security products (many don't inspect inside PDFs, and even for those that do the PDF format is complicated enough that it offers tremendous opportunities for obfuscation). I would wager money that the "PDF attack" inv…

If it's just a javascript link to download an EXE, doesn't the target of the hack still need to run the EXE? Or are you saying that a link in a PDF can install and execute code on its own? Assuming it can't, then the engineer had to click to run some unknown EXE after downloading it... that should hardly be described as a "PDF attack".

We had an employee compromised by a similar attack-executable linked in a Pdf.

Basic flow was-phisher asked employee to sign a document relating to customs. The phisher had gathered that this employee works with shipping claims and returns, and surmised that they need to deal with customs documents requiring signature. There was a link to an exe hosted on a European cloud service in the PDF titled "install fake signature certificate company to sign this document". This directed to a download of a basic ransomware executable. This did get past our AV to the point of encrypting the employee's machine, but thankfully was blocked from spreading to the rest of the network.

The employee's machine was toast, but I was able to restore from the prior day's backup and no major harm occurred. I was able to see the phishing attack since we use gsuite email so the ransom ware didn't erase the employee's inbox, but they did lose a half-day work and I updated our training. The attack itself was clever from a social engineering perspective, but the technical exploit was something any script kiddy could have downloaded from the open web, nothing advanced at all. But Gmail doesn't always scan links in PDFs, so a clever ruse was able to bypass Google's scanning as well as our local scanning.

Re: A fake job offer took down Axie Infinity

#300

Post by searchableguy »

_fat_santa wrote: post #57
hn_throwaway_99 wrote: post #4

Two points to highlight from this article: 1. LinkedIn is an absolute godsend for bad guys, allowing easy targeting of everyone in the company with spear phishing emails and texts. I know many security professionals no longer use their real name, and don't list the real name of their company, because they know it's such a great hacking vector. Not sure what/whether LinkedIn can do anything about this. 2. I wish there…

I think one shouldn't discount the attack vector that is just working in the Crypto industry, especially when you're someone who works with startups rather than the big guys. In the "Web2 Sector", it would be very easy IMO to snuff out a fictitious company. I've gotten a handful of "offers" in the past and you can see straight through them, because the company doesn't exist in real life and you can't find any info on…

Many teams may be pseudo-anonymous as well.

So you may not find much about the founder or team beyond their public handles.

Post reply on HN