171–180 of 364 posts
They rely on 9 trusted validators, the hacker managed to get access to the private keys of 4 out of the 9 validators. What's the point of using a Blockchain if you end up centralizing validations like that?
Earlier quoted context omitted.
> The main problem was using a machine that had access to half a billion dollars Going up a level, the main problem was that the company had a system where a single person could irreversibly transfer half a billion dollars away from the company.
The article actually covers that it required 5 out of 9 people to sign off. They got 4 via PDF attacks and 1 via legacy access that was never properly terminated.
Earlier quoted context omitted.
Yup. I'm gonna remove my cynical comment (although I still totally believe it). It's just not helpful. I think people can figure it out, for themselves. Also, people use LI as a way to aggregate information, then send emails that appear to be from LI, but are not. I got one of those, yesterday, and reported it to LI, saying "These guys obviously used your service to construct this honker." And LI's reply was ... enve…
I'd love to hear more about your experience with con artists!
Chrome/Edge PDF viewers are pretty secure. You can reasonably safely open anything in them. Desktop PDF viewers like acrobat are gaping security holes... Don't use them!
Earlier quoted context omitted.
Here's a demonstration of some example attacks using pdf: executing arbitrary js, and connecting to a samba server: https://www.sentinelone.com/blog/malicious-pdfs-revealing-te... I'm not sure about this attack specifically, though, and in Ronin's post mortem they aren't really talking about that: https://roninblockchain.substack.com/p/back-to-building-roni... . To some extent, the PDF viewer/OS doesn't matter. A ded…
The right move here would have been to have separate work/personal computers so that this PDF never landed on a system with access to the Ronin network. I know I'm pushing a boulder uphill with that one but it really is the way to go, better for both the individual and the company.
Earlier quoted context omitted.
Here's a demonstration of some example attacks using pdf: executing arbitrary js, and connecting to a samba server: https://www.sentinelone.com/blog/malicious-pdfs-revealing-te... I'm not sure about this attack specifically, though, and in Ronin's post mortem they aren't really talking about that: https://roninblockchain.substack.com/p/back-to-building-roni... . To some extent, the PDF viewer/OS doesn't matter. A ded…
I know that document-rendering is much more complex than what it appears on the surface, but surely in this day and age there should be document viewers that don't run scripts and are exploit free.
What usually happens is that layers 1 and 2 of 3 are constantly compromised, no one cares to follow up, and one day layer 3 gets compromised, shock of shocks.
Earlier quoted context omitted.
The article actually covers that it required 5 out of 9 people to sign off. They got 4 via PDF attacks and 1 via legacy access that was never properly terminated.
My understanding of the article was that only 1 person was compromised and that the exploit installed on their computer was then used to access the validator nodes themselves. FWIW, I have no idea what a validator node is but I'm assuming that by compromising one employee's workstation they somehow got access to multiple other machines (which if true is itself a bit of a f* up).
Q: If you assume the bad guys have already compromised your workstation, how sure are you that they won't be able to compromise other machines you connect to?
Two points to highlight from this article: 1. LinkedIn is an absolute godsend for bad guys, allowing easy targeting of everyone in the company with spear phishing emails and texts. I know many security professionals no longer use their real name, and don't list the real name of their company, because they know it's such a great hacking vector. Not sure what/whether LinkedIn can do anything about this. 2. I wish there…
Earlier quoted context omitted.
I still can't believe that they opened the PDF on the company computer. I always use my home computer and the poor hacker would get bored of seeing all of my Raspberry Pi projects that I haven't done.
Huh? I've used my company laptops for my personal life for the last 15 years. Why would I want to carry two laptops everywhere? I travel. I barely remember what a personal laptop is.
Counterpoint: I've been completely and utterly allergic to opening anything personal from any company system for longer than that.
Earlier quoted context omitted.
I’m assuming it was an exploit in Adobe reader. The target cloud have even been persuaded to install Adobe reader to “e-sign” the document. PDFs don’t have the best track record when it comes to security
Why do pdfs even allow executing code outside of the pdf env ie why isn't there a sandbox/apis that allow very limited operation?
Some PM in 2006 thought it would be a good idea if PDFs were turing complete. I'm sure the word sandbox wasn't even thought about. 10 years later PDF (and more notably, Flash) became huge attack vectors.
I think a far more interesting hack is when NSO used a PDF to embed a virtual machine inside an iPhone to develop a zero click exploit over iMessage:
https://hothardware.com/news/zero-click-malware-pwns-iphone-...