Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The $1.5B Bybit Hack

blog.trailofbits.com

Post reply on HN
Print view View original

111–120 of 140 posts

Re: The $1.5B Bybit Hack

#111

Post by celticninja »

acdha wrote: post #68
decimalenough wrote: post #65

Earlier quoted context omitted.

A normal bank was robbed of $1B back in 2016, likely by North Korea, and the global reaction was pretty much a collective shrug: https://en.wikipedia.org/wiki/Bangladesh_Bank_robbery

According to that page, the global reaction was to block most ($850M) of the fraudulent payments, recover a third of the remainder, add additional security to the SWIFT network and raise standards for banks, and push for penalties for the criminals who participated. That seems like more than a shrug.

And we are likely to see the same response here. Those coins are easily tracked, so the attacker is going to be lucky to get 25% of the value by selling them to someone prepared to take the risk of laundering them.

Re: The $1.5B Bybit Hack

#112

Post by celticninja »

fc417fc802 wrote: post #101
qqqult wrote: post #79

Earlier quoted context omitted.

They did. This was a multisig - meaning M out of N signatures from different signing devices were needed to sign a transaction. The attacker infected enough signer devices to go unnoticed and the signers failed to verify what they were signing on air-gapped devices

> the signers failed to verify what they were signing on air-gapped devices This is the part that really surprises me given the amount of money involved.

But they didn't know the amount because the UI showed them a different value, so if it's for 50ETH and you regular sign tx for 100-200ETH you may be a little less thorough.

Re: The $1.5B Bybit Hack

#114

Post by acdha »

celticninja wrote: post #111
acdha wrote: post #68

Earlier quoted context omitted.

According to that page, the global reaction was to block most ($850M) of the fraudulent payments, recover a third of the remainder, add additional security to the SWIFT network and raise standards for banks, and push for penalties for the criminals who participated. That seems like more than a shrug.

And we are likely to see the same response here. Those coins are easily tracked, so the attacker is going to be lucky to get 25% of the value by selling them to someone prepared to take the risk of laundering them.

That’s not a given, and it wouldn’t be the same in any case since the victim is still out 100% of the loss as opposed to 10-15%.

Re: The $1.5B Bybit Hack

#115

Post by acdha »

celticninja wrote: post #113
jongjong wrote: post #72

Wild to think that North Korea could assign whole teams of people working 24/7 to trick just one person into clicking a couple of buttons.

Not one person. The multi in mukti-sig means multiple.

Multi-sig means multiple signatures, by multiple private keys. Nothing about that means that they have to be by multiple people - this isn’t secure like a bank - or that they aren’t vulnerable to the same attack.

Re: The $1.5B Bybit Hack

#116

Post by celticninja »

acdha wrote: post #115
celticninja wrote: post #113

Earlier quoted context omitted.

Not one person. The multi in mukti-sig means multiple.

Multi-sig means multiple signatures, by multiple private keys. Nothing about that means that they have to be by multiple people - this isn’t secure like a bank - or that they aren’t vulnerable to the same attack.

ok but in practice having multiple signatures but one signer is pointless, so multi-sig pretty much does mean multiple signers(people)

Re: The $1.5B Bybit Hack

#117

Post by fc417fc802 »

celticninja wrote: post #112
fc417fc802 wrote: post #101

Earlier quoted context omitted.

> the signers failed to verify what they were signing on air-gapped devices This is the part that really surprises me given the amount of money involved.

But they didn't know the amount because the UI showed them a different value, so if it's for 50ETH and you regular sign tx for 100-200ETH you may be a little less thorough.

If the setup you are using has the ability to perform large transactions then you must verify all transactions regardless of size as though they are large.

It's a security domain issue. A highly secure system involves highly secure controls. Bypassing those controls for lower risk activities will typically reduce the security of the entire system. You need an entirely independent low or medium risk system.

The software development practices of banks are probably a good example here.

Re: The $1.5B Bybit Hack

#118

Post by celticninja »

acdha wrote: post #114
celticninja wrote: post #111

Earlier quoted context omitted.

And we are likely to see the same response here. Those coins are easily tracked, so the attacker is going to be lucky to get 25% of the value by selling them to someone prepared to take the risk of laundering them.

That’s not a given, and it wouldn’t be the same in any case since the victim is still out 100% of the loss as opposed to 10-15%.

true, unless Lazarus group follow the path of Omar, then victim could be out only 75%.

Re: The $1.5B Bybit Hack

#119

Post by acdha »

celticninja wrote: post #116
acdha wrote: post #115

Earlier quoted context omitted.

Multi-sig means multiple signatures, by multiple private keys. Nothing about that means that they have to be by multiple people - this isn’t secure like a bank - or that they aren’t vulnerable to the same attack.

ok but in practice having multiple signatures but one signer is pointless, so multi-sig pretty much does mean multiple signers(people)

Sure, but I mention it because it’s not a 1:1 mapping and if they aren’t rigorously auditing their behaviour it wouldn’t exactly be unheard of for people to know coworkers passwords or, more likely, for most of them to just trust someone saying it’s legit. If the tweet about it being a smart contract update is accurate, it’d be especially plausible that people shirked their responsibility and just approved it without review. The multiple part really doesn’t help enough if people aren’t independently verifying requests.

The main takeaway I have is that their “cold” wallet wasn’t very cold and they’d messed up a lot of their diligence, so I’d also read any statements from them as the products of damage control similar to how companies talk about “nation-state threat actors” trying to make it sound like you have to be the Mossad to exploit a Citrix patch which wasn’t installed for most of a year.

Re: The $1.5B Bybit Hack

#120

Post by acdha »

fc417fc802 wrote: post #108
acdha wrote: post #107

Earlier quoted context omitted.

The ideology I was referring to was more of the trust-less design and “be your own bank” philosophy: many of these problems become easier if you have a third party who can do things like reverse transactions, but then you’re not getting rid of banks and are acknowledging that governments have power over the system. They do anyway, but there’s been a lot of desire to say otherwise.

An algorithmically enforced settlement period where the final result of the entire transaction is visible on the chain but reversible by either party doesn't seem like it would run against that ideology.

No, but it’s a lot more work and it undercuts the marketing claims about being faster. If the industry grows up, I’d expect to see things like that happen.
Post reply on HN