Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A fake job offer took down Axie Infinity

theblock.co

Post reply on HN
Print view View original

331–340 of 364 posts

Re: A fake job offer took down Axie Infinity

#331

Post by stef25 »

pph wrote: post #325
elif wrote: post #201

Earlier quoted context omitted.

I'm so confused by #2 as well. If pdf is compromised, is it fixed? This seems like the kind of vulnerability that would ruin pdf's reputation permanently. It was the safe alternative to sending someone a .doc particularly because of it's limited functionality.

PDF can embed lots of things and is quite hard to scan because there's some many ways to do things.. It is used for sending documents because its function is to have a fixed layout for printing (and look the same on every device), not because it's safer than other document formats. If you really want a safe PDF, there's a function in Qubes OS that basically opens a PDF in a new VM, makes screenshots and then creates…

Sounds like https://dangerzone.rocks/

Re: A fake job offer took down Axie Infinity

#332

Post by andrewprock »

PragmaticPulp wrote: post #108
rmbyrro wrote: post #99

Earlier quoted context omitted.

The main problem was using a machine that had access to half a billion dollars to also browse the web and do stuff like applying for jobs. If you're gonna have access to such amount of money, it's worth buying a dedicated machine and using it very, very cautiously.

> The main problem was using a machine that had access to half a billion dollars Going up a level, the main problem was that the company had a system where a single person could irreversibly transfer half a billion dollars away from the company.

But that is one of the underlying features of crypto, the ability to transfer coins without accountability.

Re: A fake job offer took down Axie Infinity

#333

Post by secretsatan »

spaceman_2020 wrote: post #242
Retric wrote: post #239

Earlier quoted context omitted.

It’s fine for a few people to play with such a system. The issue if it’s absolutely clear crypto is incapable of widespread adoption or just about anything else people hype it up as, then it shouldn’t be hyped as if that stuff is a possibility. I could never tell how much was incompetence vs fraud, but either way without the hype vastly fewer suckers would be holding the bag right now. The crypto ecosystem has been j…

The people holding the bag right now mostly got in because of the allure of quick profits. And if they didn't sell even after making incredible (paper) returns, they have their own greed to blame. Bitcoin was $6,000 in March 2020. It hit $63,000 in April 2021. And if you didn't sell that top, it hit $67,000 again in November 2021. Even now, it has dropped less than Netflix, a supposed bluechip. I don't know what's th…

> The people holding the bag right now mostly got in because of the allure of quick profits. And if they didn't sell even after making incredible (paper) returns, they have their own greed to blame.

Isn't that how fraudsters justify their tactics?

Re: A fake job offer took down Axie Infinity

#334

Post by secretsatan »

spaceman_2020 wrote: post #226
empraptor wrote: post #211

Earlier quoted context omitted.

and this is part of why i think cryptocurrencies should have died before large number of people wasted their money on it. for the average user without the time/knowledge/patience to handle cryptos "properly", the choice is between losing money while handling this shit yourself or losing money while trusting someone else to do it right.

Its an entirely free market. Just because one person doesn't understand the tech and loses his money doesn't mean that everyone else shouldn't be allowed to use it either. Even if you don't buy into the crypto vision (I don't), a digital-only currency that isn't tied to any nation-state does deserve to exist.

I mean, this very much sounds like there's no such thing as fraud in a free market

Re: A fake job offer took down Axie Infinity

#335

Post by chinathrow »

zrobotics wrote: post #299
noduerme wrote: post #195

Earlier quoted context omitted.

If it's just a javascript link to download an EXE, doesn't the target of the hack still need to run the EXE? Or are you saying that a link in a PDF can install and execute code on its own? Assuming it can't, then the engineer had to click to run some unknown EXE after downloading it... that should hardly be described as a "PDF attack".

We had an employee compromised by a similar attack-executable linked in a Pdf. Basic flow was-phisher asked employee to sign a document relating to customs. The phisher had gathered that this employee works with shipping claims and returns, and surmised that they need to deal with customs documents requiring signature. There was a link to an exe hosted on a European cloud service in the PDF titled "install fake signa…

Great write-up.

What I don't understand: Why do you let your users run downloaded executables, at all?

Re: A fake job offer took down Axie Infinity

#336

Post by chinathrow »

stef25 wrote: post #330
zrobotics wrote: post #299

Earlier quoted context omitted.

We had an employee compromised by a similar attack-executable linked in a Pdf. Basic flow was-phisher asked employee to sign a document relating to customs. The phisher had gathered that this employee works with shipping claims and returns, and surmised that they need to deal with customs documents requiring signature. There was a link to an exe hosted on a European cloud service in the PDF titled "install fake signa…

The employee clicked on a link asking them to install a security certificate and completed the install?

The way I read it, the employee installed/ran an .exe.

Re: A fake job offer took down Axie Infinity

#337

Post by ikt »

seoaeu wrote: post #326
spaceman_2020 wrote: post #242

Earlier quoted context omitted.

The people holding the bag right now mostly got in because of the allure of quick profits. And if they didn't sell even after making incredible (paper) returns, they have their own greed to blame. Bitcoin was $6,000 in March 2020. It hit $63,000 in April 2021. And if you didn't sell that top, it hit $67,000 again in November 2021. Even now, it has dropped less than Netflix, a supposed bluechip. I don't know what's th…

Most Ponzi scheme victims got in because of greed. That doesn’t absolve the con artist for running one though

> That doesn’t absolve the con artist for running one though

Who are you going to prosecute in this case? The developers of Ethereum who are making a digital peer2peer smart contract system and have no interest in running a ponzi scheme?

Are you going to arrest Bram Cohen for inventing Bittorrent for what happens on it? What about the people behind Tor?

Re: A fake job offer took down Axie Infinity

#338

Post by planede »

kibibyte wrote: post #295
the_af wrote: post #282

Earlier quoted context omitted.

I open all sorts of PDFs, all the time, regardless of which computer I'm using. Is PDF as an attack vector such a widespread threat? I never payed much attention to them, assuming it's a document format that is relatively harmless even if it can include javascript. This is an honest question, by the way.

https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=PDF+documen... PDFs are "harmless" on their own, but they are user-generated documents that conform to a complex specification. Viewing them requires software that parses them. These parsers are often written in unsafe low level languages. The (in)security of unsafe parsers reading user-generated input is a tale as old as time itself.

Most people view pdfs now in web browsers built-in viewers. Especially if the job offer comes from a linkedin message, I would imagine most people would default to the browser viewer.

While browsers are sure not without security vulnerabilities, I sure trust the PDF viewer within to be way more sandboxed than most standalone desktop PDF viewer applications.

If the vulnerability (which I assume was RCE) was in a web browser, then it's a major bug.

Re: A fake job offer took down Axie Infinity

#339

Post by saagarjha »

kibibyte wrote: post #295
the_af wrote: post #282

Earlier quoted context omitted.

I open all sorts of PDFs, all the time, regardless of which computer I'm using. Is PDF as an attack vector such a widespread threat? I never payed much attention to them, assuming it's a document format that is relatively harmless even if it can include javascript. This is an honest question, by the way.

https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=PDF+documen... PDFs are "harmless" on their own, but they are user-generated documents that conform to a complex specification. Viewing them requires software that parses them. These parsers are often written in unsafe low level languages. The (in)security of unsafe parsers reading user-generated input is a tale as old as time itself.

This describes webpages just as well.

Re: A fake job offer took down Axie Infinity

#340

Post by DelightOne »

emmelaich wrote: post #264
sangnoir wrote: post #227

Earlier quoted context omitted.

It doesn't have to be the same pdf, it could have been an attachments from compromised machine via email/slack. "Hey, can you help me figure this unusual log/transaction summary". How many wouldn't open such an attachment from a "colleague"?

Yep, internal security is brittle. The initial pdf vector would be only the start of a long sequence of hacks, including social engineering. e.g. sending email from managers -- or slack messages as you mention.

How do you defend against getting email from internal people, especially from people you expect email from?
Post reply on HN