The Looting of ShapeShift • Hacker News Board

Re: The Looting of ShapeShift

#21

Post by srdev » Fri, Apr 22, 2016, 7:53 PM UTC

danielvf wrote: post #2

This is certainly the worst case scenario - your security officer installing remote access software on developers machines, stealing bitcoins from production, then selling the company source code, access credentials and access to the internal network to a Russian hacker. Building a security system to handle this level of attack is a whole level beyond stopping even determined external attackers. Are there any best pr…

> Are there any best practices guides on this?

I'm not aware of any, but we did have quite a lot of procedures meant to mitigate this sort of things when I worked in banking. For one, none of the developers had any sort of access to production machines.

Re: The Looting of ShapeShift

#22

Post by randomfool » Fri, Apr 22, 2016, 7:54 PM UTC

cloudjacker wrote: post #6

quanticle wrote: post #4

We learn some more things. Bob has prior police records in Florida, where he’s from. So they didn't even do a background check before hiring "Bob"? For a position where he would have access to systems that handled financial data? That's just grossly incompetent, in my book. I've worked for 5-man startups and Fortune 500 companies. In every case, the offer letter has stated that the offer is conditional on the success…

They don't do the background check.

They do- one company found a warrant on me that I didn't know I had for an unpaid traffic ticket.

Re: The Looting of ShapeShift

#23

Post by cloudjacker » Fri, Apr 22, 2016, 8:02 PM UTC

cortesoft wrote: post #13

Man, calling a social security number a "social serfdom number" is really dumb and off putting. So is the continual reference to 'fiat money' constantly. I always love the irony of people so against the basic social contract are always so quick to turn to authorities when things predictably go wrong.

You might appreciate

http://www.newyorker.com/humor/daily-shouts/l-p-d-libertaria...

Re: The Looting of ShapeShift

#24

Post by joe_the_user » Fri, Apr 22, 2016, 8:10 PM UTC

danielvf wrote: post #2

This is certainly the worst case scenario - your security officer installing remote access software on developers machines, stealing bitcoins from production, then selling the company source code, access credentials and access to the internal network to a Russian hacker. Building a security system to handle this level of attack is a whole level beyond stopping even determined external attackers. Are there any best pr…

I am not sure why those who essentially believe in utopia through an organized "war of all against all" wouldn't expect that anyone in position of trust wouldn't try to rip them off as much as possible.

"Damn you, you've betrayed our trust and prevented us from building a world where we didn't have to trust people..."

Re: The Looting of ShapeShift

#25

Post by RangerScience » Fri, Apr 22, 2016, 8:11 PM UTC

fasteo wrote: post #18

pavel_lishin wrote: post #12

Earlier quoted context omitted.

Are you suggesting that the criminal should not be blamed for his criminal actions or the losses that he knowingly and willingly incurred?

Not quite. I suggest that a CEO should assume his responsibilities. He is quick to trash Bob[1] several times, but I see assumption of any responsibility at all. [1] Despite our note to all employees to come into the office urgently, Bob, our head IT guy, the one responsible for security and infrastructure, arrives at 11:30am. Soon after, Bob decides it’s time for his lunch break, and we don’t see him for an hour, du…

It's the difference between heroic responsibility and actual causality.

"Of course it's my fault. There's no-one else here who could possibly be responsible for anything".

The whole subtext of this was "Here's how I fucked up in leading this company", but then the actual text is causality. It is his responsibility to make sure employees are trustworth? Yes. Is he the cause of employees abusing trust? No.

He then also determined that his responsibility was to let people know what had happened, so that's what he did. He told us the things they used to figure out what happened in order to attempt (and fail, and then attempt again...) to prevent it from recurring.

Re: The Looting of ShapeShift

#26

Post by moron4hire » Fri, Apr 22, 2016, 8:18 PM UTC

TAForObvReasons wrote: post #15

jessaustin wrote: post #7

Earlier quoted context omitted.

That's sort of boilerplate though, isn't it? They reserve the right to do all sorts of terrible shit, but because most of that shit costs money they don't actually do it.

There are few positions that merit a hiring background check more than ones directly involving the financial transactions of a company. Even if it costs a lot of money, it is absolutely money well spent.

Background checks definitely do not cost a lot of money. I think it's in the $15 range.

Re: The Looting of ShapeShift

#27

Post by koolba » Fri, Apr 22, 2016, 8:34 PM UTC

Not the best writing but it reads like a modern hardboiled[1]. Fun piece.

[1]: https://en.wikipedia.org/wiki/Hardboiled

Re: The Looting of ShapeShift

#28

Post by ikeboy » Fri, Apr 22, 2016, 8:42 PM UTC

cloudjacker wrote: post #23

cortesoft wrote: post #13

Man, calling a social security number a "social serfdom number" is really dumb and off putting. So is the continual reference to 'fiat money' constantly. I always love the irony of people so against the basic social contract are always so quick to turn to authorities when things predictably go wrong.

You might appreciate http://www.newyorker.com/humor/daily-shouts/l-p-d-libertaria...

http://www.theatlantic.com/politics/archive/2014/04/nlpd-non...

Re: The Looting of ShapeShift

#29

Post by raesene9 » Fri, Apr 22, 2016, 8:44 PM UTC

danielvf wrote: post #2

This is certainly the worst case scenario - your security officer installing remote access software on developers machines, stealing bitcoins from production, then selling the company source code, access credentials and access to the internal network to a Russian hacker. Building a security system to handle this level of attack is a whole level beyond stopping even determined external attackers. Are there any best pr…

Well the traditional banks have been dealing with exactly this kind of threat for a long time.

There's a load of practices that are designed to stop this kind of problem in that world.

Things like :-

- Enforced holidays. Frauds are hard to maintain when you're not there to keep cooking the books. - Audit reviews. an independant function with the ability and authority to review key processes - split authority. Key actions need multiple people to complete (statistically fraud incidence drops a lot when you need multiple people involved) - Strong background checking. When I worked at a bank they went back 10 years of employment history and required accounting for any gaps. + credit checking + criminal record checking etc.

It's all possible, just quite expensive...

Re: The Looting of ShapeShift

#30

Post by neurobuddha » Fri, Apr 22, 2016, 8:47 PM UTC

cloudjacker wrote: post #23

cortesoft wrote: post #13

Man, calling a social security number a "social serfdom number" is really dumb and off putting. So is the continual reference to 'fiat money' constantly. I always love the irony of people so against the basic social contract are always so quick to turn to authorities when things predictably go wrong.

You might appreciate http://www.newyorker.com/humor/daily-shouts/l-p-d-libertaria...

I was thinking more along these lines: http://www.theatlantic.com/politics/archive/2014/04/dont-swe...