Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A fake job offer took down Axie Infinity

theblock.co

Post reply on HN
Print view View original

181–190 of 364 posts

Re: A fake job offer took down Axie Infinity

#181

Post by phphphphp »

CobrastanJorji wrote: post #151
jedberg wrote: post #67

For those that don't want to read the whole thing, (supposedly) the attackers reached out on linkedin to a bunch of employees asking them to apply to a fake company. One of them did it, went through a bunch of fake interviews, and then got a fake offer, in the form of a PDF. They opened the PDF and that installed a keylogger on their system (it doesn't explain how). The attackers then used that engineer's credentials…

I'm trying to imagine a setup at any company whose primary business is controlling extremely valuable digital assets having a security setup that could be entirely undone with keyloggers, and it's difficult. No necessary VPNs, keys on devices, or other non-password authentication? One engineer's password should not be the keys to the kingdom. Sounds like a bad RPG plot. "Because of its danger, we broke the Obsidian K…

I’m of the view that the completely illogical nature of their entire business and the absence of any meaningful security are deeply interwoven.

Rather than think of their primary business as securing digital assets, think of their primary business as convincing people that a perpetual money machine in the shape of a video game is possible. The valuable digital assets are just a narrative tool — and so it follows that they wouldn’t have the expertise in securing digital assets.

Nobody capable of building a secure system for digital assets would waste their time working for a company like Axie, after all, the entire premise of their business is flawed so people with the critical thinking skills necessary to build a secure system would apply that critical thinking to the viability of the company — and, of course, conclude it’s destined for failure and not hitch their wagon to it.

Re: A fake job offer took down Axie Infinity

#182

Post by tialaramex »

labrador wrote: post #164
tialaramex wrote: post #123

Earlier quoted context omitted.

Program and data aren't really different, philosophically. On some level this even applies to people. When someone teaches you French is that program or data? Is it just data? Why can you now understand French then? Or if it's program, how does that work, who taught the teacher how to program you? So, our best effort is to constrain what certain data can do when we process it, in the hope that this prevents surprisin…

Good idea, but WUFFS is written in C

Well, WUFFS the library is C code, but that's because in practice the language implementation is a Go program which emits C rather than machine code. There's no reason you can't compile WUFFS the language into, say, Rust, or PowerPC assembler, or a long series of letters to Princess Celestia [the FiM++ programming language], except that nobody did all that hard work.

Re: A fake job offer took down Axie Infinity

#183

Post by charcircuit »

logifail wrote: post #177
mousetree wrote: post #172

Earlier quoted context omitted.

My understanding of the article was that only 1 person was compromised and that the exploit installed on their computer was then used to access the validator nodes themselves. FWIW, I have no idea what a validator node is but I'm assuming that by compromising one employee's workstation they somehow got access to multiple other machines (which if true is itself a bit of a f* up).

> I'm assuming that by compromising one employee's workstation they somehow got access to multiple other machines (which if true is itself a bit of a f* up) Q: If you assume the bad guys have already compromised your workstation, how sure are you that they won't be able to compromise other machines you connect to?

You can't which is why one person shouldn't have access to more than one.

Re: A fake job offer took down Axie Infinity

#184

Post by mikevin »

jspdown wrote: post #80

They rely on 9 trusted validators, the hacker managed to get access to the private keys of 4 out of the 9 validators. What's the point of using a Blockchain if you end up centralizing validations like that?

'Proof of Authority' sounds an awful lot like the regular banking system.

Re: A fake job offer took down Axie Infinity

#185

Post by stefan_ »

eigenvalue wrote: post #149

Seems like there would be market demand for a super locked down PDF viewer that basically ignores all the silly extensions/additions that Adobe has added to the format over the decades. The vast majority of documents don't need Turing complete code capabilities or embedded videos or interactive 3D models. Something that safely (using sandboxing and other methods) turns the document into totally static pixel data that…

I realized some time ago, not wanting to install drivers, that a lot of office printers now have some janky webinterface that also allows uploading PDFs to submit as print jobs. This will turn a malicious PDF into perfectly safe paper!

Now whatever cursed embedded software on the printer reads the PDF is probably a lot easier to exploit than an updated PDF viewer, but that's not what these people are going for.

Re: A fake job offer took down Axie Infinity

#187

Post by pcthrowaway »

lordnacho wrote: post #63
pcthrowaway wrote: post #8

Curious if anyone has been able to find technical details of how this attack works/worked. I'm under the impression most PDF viewers would prevent this sort of attack (e.g. opening a PDF in your browser should sandbox it to the browsing context), but really keen to know what PDF viewer / OS was used by the dev.

Does it even need to be terribly complicated? Congrats on your new job, here's a script for you to generate a new ssh key with us, just copy/paste it in your terminal and that will sort it out.

Yet according to the article, the malware was introduced by the "candidate" opening a PDF; I'd expect most senior developers to know better than to run a random script from a company they don't have an ongoing relationship with without looking at the source first, especially if they have sensitive credentials on the computer they're using.

But you never know.

Re: A fake job offer took down Axie Infinity

#188

Post by giaour »

hourago wrote: post #68
londons_explore wrote: post #19

The other major cause of the failure was that one dev had access to 5 signing keys. That shouldn't have happened, because than that one dev could have run off with $540 Million... And remember, it wasn't just that one dev - it was everything running on his computer - think of the probably tens of thousands of developers who wrote the code that runs as root on his PC, much of it unreviewed.

> In a post-mortem blog post on the hack, published April 27, Sky Mavis said: “Employees are under constant advanced spear-phishing attacks on various social channels and one employee was compromised. This employee no longer works at Sky Mavis. The attacker managed to leverage that access to penetrate Sky Mavis IT infrastructure and gain access to the validator nodes.” The company fully blames the employee. I wish so…

My takeaway was that Sky Mavis's ops culture is a dumpster fire, something that might be generalizable to a good chunk of the Web3 sector. The tech companies where I have worked (a couple BigTech cos, some smaller orgs, and civil service) have all taken the blameless postmortem approach very seriously.

Re: A fake job offer took down Axie Infinity

#189

Post by burrows »

jedberg wrote: post #95
hn_throwaway_99 wrote: post #4

Two points to highlight from this article: 1. LinkedIn is an absolute godsend for bad guys, allowing easy targeting of everyone in the company with spear phishing emails and texts. I know many security professionals no longer use their real name, and don't list the real name of their company, because they know it's such a great hacking vector. Not sure what/whether LinkedIn can do anything about this. 2. I wish there…

I'm not sure this is Linkedin's problem to solve. They are just a directory. I suppose they could add a phishing warning for messages sent on LinkedIn, but really it's an education problem, teaching people to identify what phishing emails look like and how to avoid them. This is a problem I've been working on since at least 2003, when we realized that the best way to prevent eBay account takeovers was teaching people…

> I'm not sure this is Linkedin's problem to solve. They are just a directory.

If the issue reduces user metrics, then they will want to fix it. Ultimate responsibility seems irrelevant.

> It's ironic that the security professionals are the ones hiding their identity, given that they are the best prepared to identify and avoid phishing emails.

I might have demolitions training, but I’d still rather walk around the minefield.

Re: A fake job offer took down Axie Infinity

#190

Post by charlie0 »

koofdoof wrote: post #18
hn_throwaway_99 wrote: post #4

Two points to highlight from this article: 1. LinkedIn is an absolute godsend for bad guys, allowing easy targeting of everyone in the company with spear phishing emails and texts. I know many security professionals no longer use their real name, and don't list the real name of their company, because they know it's such a great hacking vector. Not sure what/whether LinkedIn can do anything about this. 2. I wish there…

How usable is LinkedIn with a pseudonym? Is that a security industry only practice or could a regular dev get away with that too? I've always been shy about having a profile with my actual name but id consider one with a thin veil of anonymity.

I really wish I could just dump LI and delete my account; it's just spam and another service for those who love to self promote themselves. I won't do it because I'm not sure how it will impact by ability to get a job.

How many of you have gotten jobs with no LI account? YEO?

Post reply on HN