And this is why you should separate work machines from private and anything else. Specially when working with something high value.
A fake job offer took down Axie Infinity
191–200 of 364 posts
Re: A fake job offer took down Axie Infinity
#192So they lost half a billion dollars because they forgot to set up Multi Factor Authentication?
Re: A fake job offer took down Axie Infinity
#193Earlier quoted context omitted.
I'm trying to imagine a setup at any company whose primary business is controlling extremely valuable digital assets having a security setup that could be entirely undone with keyloggers, and it's difficult. No necessary VPNs, keys on devices, or other non-password authentication? One engineer's password should not be the keys to the kingdom. Sounds like a bad RPG plot. "Because of its danger, we broke the Obsidian K…
I’m of the view that the completely illogical nature of their entire business and the absence of any meaningful security are deeply interwoven. Rather than think of their primary business as securing digital assets, think of their primary business as convincing people that a perpetual money machine in the shape of a video game is possible. The valuable digital assets are just a narrative tool — and so it follows that…
I understand your argument but this kind of reasoning consistently fails to be predictive. If things worked as you describe, there would be way more consensus amongst skilled engineers on political topics. In practice people are very skilled at selectively turning off their brain, especially when they stand to benefit.
“It's difficult to get a man to understand something when his salary depends on not understanding it." -Upton Sinclair
Re: A fake job offer took down Axie Infinity
#194Earlier quoted context omitted.
The main problem was using a machine that had access to half a billion dollars to also browse the web and do stuff like applying for jobs. If you're gonna have access to such amount of money, it's worth buying a dedicated machine and using it very, very cautiously.
I still can't believe that they opened the PDF on the company computer. I always use my home computer and the poor hacker would get bored of seeing all of my Raspberry Pi projects that I haven't done.
If you're looking for work, you have to interview during the day, which you're probably in office (things are very different now). I know I'm guilty of having my personal emailed signed into my work computer (albeit with a separate browser). I've also done virtual interviews in the office meeting/phone room.
Re: A fake job offer took down Axie Infinity
#195Two points to highlight from this article: 1. LinkedIn is an absolute godsend for bad guys, allowing easy targeting of everyone in the company with spear phishing emails and texts. I know many security professionals no longer use their real name, and don't list the real name of their company, because they know it's such a great hacking vector. Not sure what/whether LinkedIn can do anything about this. 2. I wish there…
Most PDF "attacks" in the real world are very unsophisticated. One of the most common uses of PDFs in a phishing context is just as a way to deliver a link that would likely result in blocking by email security products (many don't inspect inside PDFs, and even for those that do the PDF format is complicated enough that it offers tremendous opportunities for obfuscation). I would wager money that the "PDF attack" inv…
If it's just a javascript link to download an EXE, doesn't the target of the hack still need to run the EXE? Or are you saying that a link in a PDF can install and execute code on its own?
Assuming it can't, then the engineer had to click to run some unknown EXE after downloading it... that should hardly be described as a "PDF attack".
Re: A fake job offer took down Axie Infinity
#196What's the best practice, security-wise, for viewing PDFs?
Re: A fake job offer took down Axie Infinity
#197Earlier quoted context omitted.
I'm trying to imagine a setup at any company whose primary business is controlling extremely valuable digital assets having a security setup that could be entirely undone with keyloggers, and it's difficult. No necessary VPNs, keys on devices, or other non-password authentication? One engineer's password should not be the keys to the kingdom. Sounds like a bad RPG plot. "Because of its danger, we broke the Obsidian K…
I’m of the view that the completely illogical nature of their entire business and the absence of any meaningful security are deeply interwoven. Rather than think of their primary business as securing digital assets, think of their primary business as convincing people that a perpetual money machine in the shape of a video game is possible. The valuable digital assets are just a narrative tool — and so it follows that…
Axie Infinity exploded in popularity overnight. They likely built their infrastructure when they were securing $1M in digital assets and then suddenly found themselves controlling half a billion before they could upgrade their security.
That doesn’t excuse their poor security practices. They shouldn’t have built their asset custody system in-house if they didn’t have the expertise. They could have used Fireblocks or a Gnosis Safe Multisig with hardware wallets and they would be safe.
Re: A fake job offer took down Axie Infinity
#198Seems like there would be market demand for a super locked down PDF viewer that basically ignores all the silly extensions/additions that Adobe has added to the format over the decades. The vast majority of documents don't need Turing complete code capabilities or embedded videos or interactive 3D models. Something that safely (using sandboxing and other methods) turns the document into totally static pixel data that…
This pretty much already exists, it’s called Cloudflare Browser Isolation. They basically render your browser on a remote server and pipe you the visual data.
Re: A fake job offer took down Axie Infinity
#199Earlier quoted context omitted.
Good idea, but WUFFS is written in C
Well, WUFFS the library is C code, but that's because in practice the language implementation is a Go program which emits C rather than machine code. There's no reason you can't compile WUFFS the language into, say, Rust, or PowerPC assembler, or a long series of letters to Princess Celestia [the FiM++ programming language], except that nobody did all that hard work.
It's amazing what people come up with when they have time on their hands for leisure activities. That's why I look forward to robots doing all the work while human subsist on universal basic income.
FiM++ - Esolang
Re: A fake job offer took down Axie Infinity
#200Earlier quoted context omitted.
I’m of the view that the completely illogical nature of their entire business and the absence of any meaningful security are deeply interwoven. Rather than think of their primary business as securing digital assets, think of their primary business as convincing people that a perpetual money machine in the shape of a video game is possible. The valuable digital assets are just a narrative tool — and so it follows that…
I understand your argument but this kind of reasoning consistently fails to be predictive. If things worked as you describe, there would be way more consensus amongst skilled engineers on political topics. In practice people are very skilled at selectively turning off their brain, especially when they stand to benefit. “It's difficult to get a man to understand something when his salary depends on not understanding i…
I completely agree in principle but the nuance here is that I’m leaning on the belief that people joining Axie do not “…stand to benefit…” because the long term prospects of Axie Infinity are not good (and have never been good) and so anybody analysing the benefit of joining them — who has a broad range of opportunities available to them — would immediately see how little they stand to benefit from getting involved with Axie Infinity.
I’m under no illusions about the intelligence of software engineers (of any specialism) — we are all idiots at least some of the time — but I struggle to believe that a competent engineer with lots of opportunities would somehow believe that Axie Infinity is the best opportunity available to them, hence, their system is built by people who don’t have other opportunities and have produced an insecure house of cards (more insecure than the average system anyway — all systems are insecure in some capacity).