Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Social engineering scam that nearly cost me all of my ETH

twitter.com

Post reply on HN
Print view View original

221–230 of 423 posts

Re: Social engineering scam that nearly cost me all of my ETH

#221

Post by djur »

samarama wrote: post #166
Grim-444 wrote: post #137

Earlier quoted context omitted.

As a thought experiment, replace crypto in this situation for beanie babies. You managed to buy a bunch of beanie babies before a beanie baby craze started, and sold them at exorbitant prices to other people coming in that were convinced that beanie baby prices would only keep skyrocketing. You took their money, and now I guess as long as they're the bag holders still holding beanie babies when it all falls apart and…

Except beanie babies have no inherent value, but ETH has vast inherent value in numerous ways 1. Immutability 2. Decentralization 3. Cheap, fast, secure cross-country money transfers 4. Protection against inflation 5. Independence of banks or arbitrary freezes of your funds 6. Access to a vast variety of financials services 7. Is quite likely the replacement of money The fact that people still don’t get that in 2022…

1 is questionably valuable and arguably harmful, 2 is increasingly untrue, 3 and 6 aren't inherent benefits of Ethereum, 4 and 5 aren't true, and 7 is speculative and begs the question.

Re: Social engineering scam that nearly cost me all of my ETH

#222

Post by Qub3d »

TacticalCoder wrote: post #149
MereInterest wrote: post #118

Earlier quoted context omitted.

I like the takeaways, though I'd also add an additional one, that you should use systems that have reversible transactions. That way, when you fall victim to fraud, you can use the court system to recover your losses.

> that you should use systems that have reversible transactions. OTH I'm pretty sure that if the mark had been using such systems years ago, he wouldn't have $100m+ worth of ETH now ; )

If the last lottery ticket winner hadn't bought a powerball ticket, they also wouldn't be worth millions.

Beware the survivorship bias: https://xkcd.com/1827/

Re: Social engineering scam that nearly cost me all of my ETH

#223

Post by tedunangst »

maneesh wrote: post #215
skim_milk wrote: post #182

Earlier quoted context omitted.

How would one "accidentally" wire transfer millions of dollars? At $10k in America, KYC and AML laws force banks to step through extra layers of verification to wire such amount. It's virtually impossible for someone to accidentally wire millions, which would likely involve a mandatory in-person meeting with the bank customer to verify their credentials and purpose. If somehow you get through an in-person meeting wit…

https://www.google.com/amp/s/amp.cnn.com/cnn/2021/02/16/busi...

So now for the fun question: who do I have to tweet at to get Citi to wire me millions of dollars?

Re: Social engineering scam that nearly cost me all of my ETH

#224

Post by herodotus »

So I don't know anything about crypto, but stories like this make me think that crypto can never become mainstream. I have been programming since 1970; I worked for major computer companies; I was a computer science professor; I have apps on the App Store. In spite of all of this, I have not the foggiest idea, even after reading the thread, how someone who offers to give me something can use the gift to steal from me. Surely this says that the world at least of ETH (whatever that is) is really really broken!

Re: Social engineering scam that nearly cost me all of my ETH

#225

Post by dlubarov »

herodotus wrote: post #224

So I don't know anything about crypto, but stories like this make me think that crypto can never become mainstream. I have been programming since 1970; I worked for major computer companies; I was a computer science professor; I have apps on the App Store. In spite of all of this, I have not the foggiest idea, even after reading the thread, how someone who offers to give me something can use the gift to steal from me…

I don't think the NFT is very important here; basically the scammer's website asked the victim's wallet to sign a message, using the private key that holds their ETH.

It looks like the message in this case would have given the attacker permission to transfer the victim's aWETH, which represents ETH that has been deposited into an Aave lending pool. These transfer permissions are something all ERC-20 tokens support.

Typically users will only sign messages sent from trusted websites, just as they would only install software from trusted sources. Or they can sign a questionable message from a separate wallet which doesn't hold much value, as the victim did here.

Granted, this isn't a great situation. It can be hard to know which websites to trust, and even trusted websites can be hacked and then send malicious messages to unsuspecting users.

Re: Social engineering scam that nearly cost me all of my ETH

#226

Post by labrador »

herodotus wrote: post #224

So I don't know anything about crypto, but stories like this make me think that crypto can never become mainstream. I have been programming since 1970; I worked for major computer companies; I was a computer science professor; I have apps on the App Store. In spite of all of this, I have not the foggiest idea, even after reading the thread, how someone who offers to give me something can use the gift to steal from me…

According to this talk about NFTs, an NFT can contain code and the execution of that code can be triggered to do unsafe things.

at 1:22:50 Smart contracts are just code, they’re software, there’s no reason they can’t be viruses or worms, the primary limitation is processing power. But, also, it’s a virus that someone can drop directly into your bankless bank account and just wait for you to activate it. And, yeah, that’s right, there’s no offer/confirmation step in sending tokens back and forth, someone who knows your wallet can just drop stuff right into it, so, like, pin that somewhere in your brain.

Line Goes Up – The Problem With NFTs

https://youtu.be/YQ_xWvX1n9g?t=4970

Re: Social engineering scam that nearly cost me all of my ETH

#227

Post by djur »

raverbashing wrote: post #12

"extremely thorough social engineering" Not really, it seems like the usual being extra flattering to earn favours (or worse). The first two messages would have raised several red flags with me. > He's currently working at Ubisoft and offers to help with 3D design and animation Like if I worked for Ubisoft I'd have time to do 3D design for free for some other company.

The social aspects of the crypto community are very interesting. The "WAGMI" mindset encourages a kind of freewheeling magnanimity where strangers will offer to help people get involved, give away free coin, bail out people who got scammed, etc.

No doubt this is often genuine goodwill, but it's also an effective technique for recruitment (it's longstanding practice for evangelical religions and MLMs), and it creates a situation where a lot of self-interested people looking to get rich quick are mingling in an environment where it's perfectly common to make generous offers with no expectation of return.

It's like going to a tech meetup where there are a lot of people working on startups, and who might buy a few rounds at the bar afterwards in exchange for maybe attracting an interested investor or cofounder, but where there's a chance that drinking a seemingly normal beer might give them access to your bank account.

Re: Social engineering scam that nearly cost me all of my ETH

#228

Post by lanstin »

PretzelPirate wrote: post #36
ajross wrote: post #10

I still fail to understand how the smart contract metaphor of "here is some obfuscated code from a third party, please give it access to all your money, kthx" has managed to survive at all. I mean, really, no one saw this coming? It's just the Trust Problem all over again. Decentralized reliance on automatic software still requires trust that the authors of the software won't scam you. It all comes down to trust. And…

> Who in their right mind trusts contracts someone sends you on Discord? No one. > It's just the Trust Problem all over again. Decentralized reliance on automatic software still requires trust that the authors of the software won't scam you. It all comes down to trust. It does, but you get to decide who you trust rather than being forced to trust one of a small number of large institutions. If you want, you can deleg…

To be honest i don’t really trust banks to value my economic well-being so I have almost all my money in a credit union. But as a software engineer I really don’t see how you can trust code, even stuff developed under NASA style care has bugs. Especially where the framework isn’t doing any rate limiting or safety checks.

Re: Social engineering scam that nearly cost me all of my ETH

#229

Post by hypertele-Xii »

whatshisface wrote: post #136
Grustaf wrote: post #131

Earlier quoted context omitted.

How would it work and what aspect would it improve?

The NFT part keeps track of who owns what domain. It would improve the situation by getting rid of the questionable organization running things presently. (See: the .org scandal)

My domain is secured by the ministry of telecommunications of my local government. To transfer ownership of my domain requires a hard copy of a random code snail-mailed to me by the ministry. It's literally tied to my legal citizenship. That's the opposite of "questionable."

Re: Social engineering scam that nearly cost me all of my ETH

#230

Post by lanstin »

ajross wrote: post #64
PretzelPirate wrote: post #36

Earlier quoted context omitted.

> Who in their right mind trusts contracts someone sends you on Discord? No one. > It's just the Trust Problem all over again. Decentralized reliance on automatic software still requires trust that the authors of the software won't scam you. It all comes down to trust. It does, but you get to decide who you trust rather than being forced to trust one of a small number of large institutions. If you want, you can deleg…

> but you get to decide who you trust And if you trust the wrong people? Per the linked twitter thread, the author trusted the scammers! They only avoided the scam because they were competent to read the contract code for themselves . Is that the standard you want applied to all transactions? Does that seem likely to lead to good outcomes?

Yeah it isn’t trusting people so much as trusting code written by people. Generally something you want to do only very carefully and when you have no other choice. Or have some proper centralized framework of safety engineering to make mistakes harder.
Post reply on HN