If a single person opening a PDF brings down your company, then what brought down your company was not that single guy opening that single pdf, it was the series of failures in leadership, company structure and technology that led you to that bad position that brought down your company.
A fake job offer took down Axie Infinity
351–360 of 364 posts
Re: A fake job offer took down Axie Infinity
#352Earlier quoted context omitted.
A better model than a bridge to sidechain would be a rollup - posting proofs on chain without giving the sequencer the ability to steal or control user funds. What's a "proof" of an event in the outside world? No such thing exists. The OP's point that dependence on real world events is a security flaw remains. No alternative programming method can change this because nothing on the Internet can guarantee a real event…
How do you know that a real world event happened if you didn't perceive it with your own senses? One of the long term goals of blockchains interfacing with the "real world" is to build oracle marketplaces that compete to provide "proof of true events". You can essentially build a reputation by selling valid data. The same way different news outlets and journalists compete for providing the "proof" for events. https:/…
In the context of ordinary contracts, the entire court and legal system exists to determine whether a given event happens.
Moreover, the legal system isn't intended as merely a means to determine whether a contract is fulfilled. It's also intended as a institution for preventing "cheating" and it has a concept of cheating. IE, me just satisfying a proxy for my end of a contact while not fulfilling the actual intent will not result in a judgement that the contract isn't fulfilled but also penalties of various severity if I intended to defraud a customer. If I build a bridge out of cardboard and, say, show pictures as proof of my supposed actions, I may well go to prisoner for fraud rather than prospering, even if it takes a while.
Smart contracts, in contrast, inherent can't distinguish between a proxy-value and a real situation - and their inability to do so is seen by their naive proponents as being their appeal. Equivalently, they have no concept of cheating. Thing considered "Hacks" and "fraud" have been prevent in etherium sure but by the opaque actions of governing boards, much less transparently than the ordinary courts.
And you can't make the problem go away with a reputation system since if the benefit lying gets higher than the cost of losing reputation anyone may lie with no other repercussions. And reputation always leaves the possibility of hacks to systems open - as the article shows.
Re: A fake job offer took down Axie Infinity
#353Earlier quoted context omitted.
Themselves. I'm saying developers (and employees in general) should not do any personal stuff on work machines or any work stuff on personal machines. This has benefits for the employee, not just the company, in that it keeps the employees personal data out of the hands of the IT department.
Nahhhhh, I gotta browse the internet to be effective. That requires me logging into random sites with personal logins. I don't install anything personal on my work computer, but I wouldn't hesitate to open an email or pdf from a seemingly trusted source. I don't really blame the dev here. What you propose is a reasonable solution, but I feel like it slams in the face of actual human behavior. Most people act the way…
I work in conjunction with this segment of the industry. You can do it, but don't be surprised when you can't recover anything in a termination suit.
Re: A fake job offer took down Axie Infinity
#354Earlier quoted context omitted.
https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=PDF+documen... PDFs are "harmless" on their own, but they are user-generated documents that conform to a complex specification. Viewing them requires software that parses them. These parsers are often written in unsafe low level languages. The (in)security of unsafe parsers reading user-generated input is a tale as old as time itself.
> PDFs are "harmless" on their own, but they are user-generated documents that conform to a complex specification. Viewing them requires software that parses them. These parsers are often written in unsafe low level languages. Yes, I understand this, keep in mind I'm a software engineer. Let me re-phrase. It's understood that, in general , document formats are more or less harmless unless they execute macros/code, an…
I understand what you're getting at now; I had thought you were asking the "more obvious" question. I'm unwilling to claim to be a subject matter expert, but I have some thoughts on this based on intuition as someone who's also a software engineer and has some security background.
Both JPEG (or any other ubiquitous image format) and PDFs are nontrivial formats. And both have their fair share of CVEs (the list of JPEG vulnerabilities is also pretty long, based on that CVE database).
Something that sticks out to me is that JPEG (and most other image formats) is basically a header followed by a large blob of compressed image data, whereas PDF is a mixed-media format combining images and other multimedia, fonts, and a PostScript. And of course, we know that PDFs have all sorts of other crazy fancy features like forms and embedded JavaScript and digital signatures. Based on these facts alone, PDF features is a superset of image formats, and certainly by quite a wide margin. And more features means much bigger attack surface.
There's also another practical consideration of how users generally interact with these formats. Users interact with images primarily through browsers (or Electron-based software), which are sandboxed and have very well-funded security teams behind them. User-uploaded images to image hosts are often re-encoded (and sanitized as a side effect). Notable exceptions I can think of are loading images from a camera (generally a trusted source; and certainly there must be plenty of vulnerabilities in RAW parsers, but people almost never share RAWs) and iMessage (...which is a thing). It's very unusual for a user to be forced the view the image outside of a browser.
PDFs are a different situation: while browsers have well-sandboxed PDF viewers these days, they intentionally implement a subset of PDF features (I think forms is a big one left out, and signatures). You can imagine how easy it is to convince a user that need to download the PDF to disk and open it with Adobe Reader so that they can digitally sign a job offer. I'm aware that DocuSign exists, but I don't think it's ubiquitous enough that every user will wonder "hmm why am I being asked to sign with Adobe Reader instead of using DocuSign".
I hope that better answers your question.
Re: A fake job offer took down Axie Infinity
#355Earlier quoted context omitted.
https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=PDF+documen... PDFs are "harmless" on their own, but they are user-generated documents that conform to a complex specification. Viewing them requires software that parses them. These parsers are often written in unsafe low level languages. The (in)security of unsafe parsers reading user-generated input is a tale as old as time itself.
Most people view pdfs now in web browsers built-in viewers. Especially if the job offer comes from a linkedin message, I would imagine most people would default to the browser viewer. While browsers are sure not without security vulnerabilities, I sure trust the PDF viewer within to be way more sandboxed than most standalone desktop PDF viewer applications. If the vulnerability (which I assume was RCE) was in a web b…
As I mentioned in another comment (and I think others have mentioned this as well), browser PDF viewers implement a subset of PDF features, and notably they won't support things like forms (I think?) or signatures. So I can imagine that attacker tricked the user into opening the PDF with separate software by saying something along the lines of "you need Adobe Reader to sign this document" (and I don't think DocuSign is ubiquitous enough that users will second guess that).
Re: A fake job offer took down Axie Infinity
#356Earlier quoted context omitted.
Most people view pdfs now in web browsers built-in viewers. Especially if the job offer comes from a linkedin message, I would imagine most people would default to the browser viewer. While browsers are sure not without security vulnerabilities, I sure trust the PDF viewer within to be way more sandboxed than most standalone desktop PDF viewer applications. If the vulnerability (which I assume was RCE) was in a web b…
As I mentioned in another comment (and I think others have mentioned this as well), browser PDF viewers implement a subset of PDF features, and notably they won't support things like forms (I think?) or signatures. So I can imagine that attacker tricked the user into opening the PDF with separate software by saying something along the lines of "you need Adobe Reader to sign this document" (and I don't think DocuSign…
I think both Firefox and Chrome support forms now, although I know that there are other interactive features that they don't support. But yeah, I can see the attacker convincing the victim to use Adobe regardless.
Re: A fake job offer took down Axie Infinity
#357Earlier quoted context omitted.
I lost nothing, but I can empathies with people who are screwed. It’s not that Bitcoin or any alt coin has X paper value right now, it’s nobody can get out without someone else getting stuck holding the bag. The underlying system is predatory because mining isn’t free so it’s a negative sum game where people have already cashed out. I remember being saddened when it was less than 1/1,000th isn’t current value I reali…
> nobody can get out without someone else getting stuck holding the bag That's true for practically every asset class. If you sold your Netflix stock at $600, someone had to buy it at $600 as well. And now they're out of $430. There's a losing counterparty in every winning trade.
>That's true for practically every asset class
No, this is false. With stocks, the holder can get paid in dividends. With real estate, you gain value from actually using the land. A bond is actually a form of credit. Et cetera. Which other assets are you thinking of?
Edit: You must be conflating it with the funny money private stocks and their buybacks that a lot of startups have. Those are obviously a gamble, they're not really "investments" for most participants. It's no surprise that the same type of companies tried to go deep into ICOs a few years ago which are like the crypto equivalent of a bogus penny stock.
Re: A fake job offer took down Axie Infinity
#358Earlier quoted context omitted.
I lost nothing, but I can empathies with people who are screwed. It’s not that Bitcoin or any alt coin has X paper value right now, it’s nobody can get out without someone else getting stuck holding the bag. The underlying system is predatory because mining isn’t free so it’s a negative sum game where people have already cashed out. I remember being saddened when it was less than 1/1,000th isn’t current value I reali…
> nobody can get out without someone else getting stuck holding the bag That's true for practically every asset class. If you sold your Netflix stock at $600, someone had to buy it at $600 as well. And now they're out of $430. There's a losing counterparty in every winning trade.
it's better to be bit more pedantic.
> There's a losing counterparty in every winning trade
the counterparties are equal in every trade; any winning takes place afterward in the future
and if one party is selling a publicly traded security or commodity at a loss, that doesn't mean it wasn't a good investment, it means it was bought at a fair price and conditions changed
Re: A fake job offer took down Axie Infinity
#359Earlier quoted context omitted.
We had an employee compromised by a similar attack-executable linked in a Pdf. Basic flow was-phisher asked employee to sign a document relating to customs. The phisher had gathered that this employee works with shipping claims and returns, and surmised that they need to deal with customs documents requiring signature. There was a link to an exe hosted on a European cloud service in the PDF titled "install fake signa…
Great write-up. What I don't understand: Why do you let your users run downloaded executables, at all?
This was a bypass of our security process, ideally they shouldn't be able to. However, since it wasn't downloaded through the browser, our security solution didn't intercept it. That was a whole other issue, and I was not at all pleased with the vendor. Unfortunately, I can't name-and-shame, but we also switched vendors after that issue.
And due to a legacy system, we can't rely on windows UAC to prevent these attacks either, this user needed to have a local admin account. Yes, this is a security issue in itself, but needs must.
Re: A fake job offer took down Axie Infinity
#360Earlier quoted context omitted.
That's the only thing it's good for, but that thing actually works. My last three job offers were from LinkedIn (I ultimately rejected one because my employer at the time gave me a counteroffer when I handed my notice, but I did accept the other two). The "content" on LI (feelhgood / motivational BS) is do ridiculous that I sort of contempt-read it ("hateread" would be to strong a word) for the heck of it, but I can'…
When I first signed up for LI I honestly couldn't tell the difference between the actual feed and a what I imagined a parody site would look like. The posts that proclaim themselves to hold controversial ideas, followed by the most banal cliches possible, crack me up. Once in a while I check the feed for kicks and it's always 100% spam, cliches, humble brags, and not-so-humble brags.
And let's not forget those moronic "do you prefer UI #1 or UI #2? Leave heart icon for this one, a thumb up for that one" engagement baits