Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Coinbase says hackers bribed staff to steal customer data, demanding $20M ransom

cnbc.com

Post reply on HN
Print view View original

251–260 of 550 posts

Re: Coinbase says hackers bribed staff to steal customer data, demanding $20M ransom

#251

Post by [deleted] »

sumeno wrote: post #243
voidspark wrote: post #170

Earlier quoted context omitted.

I don't really care about crypto personally (volatile shitcoins) but I think that's a straw man argument. They all know it gets troublesome when it comes to dealing with fiat transactions. The hardcore crypto enthusiasts want to avoid fiat entirely.

If only hardcore crypto enthusiasts who didn't want any fiat had cryptocurrency bitcoin would be worth a couple dollars a piece and 99% of other cryptocurrencies wouldn't exist. The vast vast majority of people who have crypto are doing it because they think they can get rich from it and that's why anytime it's talked about it's talked about in terms of fiat values

[deleted]

Re: Coinbase says hackers bribed staff to steal customer data, demanding $20M ransom

#252

Post by lxgr »

J0nL wrote: post #238

I'm having de ja vu here. If they only found out when they attempted to extort them does it mean they don't even bother to log employee access? Is there any means for accountability at all internally? It would be so simple to have access tracking and flag or lock out rogue employees... I look forward to seeing what the golden parachutes look like.

Logging and retroactive auditing seems like the very least they should do. Even asking the customer service agent to first provide identifying details of the customer they can't easily know or guess by themselves doesn't seem excessive, given the sensitivity of the information.

It won't work for 100% of all calls (what if the customer is locked out themselves etc.), but those calls can then be handled by even more closely monitored agents.

"Less than 1% of monthly transacting customers" means up to 1% were accessed – that seems very high, i.e. much higher than the number of customer service contacts I'd expect.

Re: Coinbase says hackers bribed staff to steal customer data, demanding $20M ransom

#253

Post by ClumsyPilot »

panarky wrote: post #194
modeless wrote: post #179

I have been receiving regular spear phishing calls from these guys, or someone who bought the leaked data, with classic tactics like claiming that I need to confirm a potentially fraudulent transaction. They speak perfect English with an American accent, sound very friendly, and have knowledge of your account balance. Thankfully on the first call I realized it was a scam right away, and Google's call screening featur…

If you had any significant assets on Coinbase at any time prior to this breach, spear phishing is the least of your worries. Coinbase not only leaked your full name and address, they also gave up your balances, your transaction history, and images of your government identification. People with "significant" crypto balances are being assaulted on the street and in their own homes, and family members are being kidnappe…

> will never be forced to reimburse all the damage they've done because the true cost would bankrupt the company

This story keeps repeating. Maybe we should try it and see if it works as a deterrent.

Re: Coinbase says hackers bribed staff to steal customer data, demanding $20M ransom

#254

Post by wepple »

wat10000 wrote: post #147
wepple wrote: post #141

Earlier quoted context omitted.

> better training and more monitoring. That’s very load-bearing. It won’t help. The CS reps are based in a LCOL country so the opportunity for theft is simply incredibly lucrative. What is really needed, is customer-in-the-loop for access to their data. The problem is, not all accesses would make sense. Doing analytics over the data of the top 1% of customers, for example, requires some level of access, but would fre…

If it would freak out the customers, maybe they shouldn’t be doing it.

That’s a nice thought, but naive.

What about, for example, a higher-tier support person performing QA over someone else’s work? What about DFIR teams doing research on potential abuse? Etc etc.

Re: Coinbase says hackers bribed staff to steal customer data, demanding $20M ransom

#255

Post by coolcase »

VectorLock wrote: post #190
modeless wrote: post #179

I have been receiving regular spear phishing calls from these guys, or someone who bought the leaked data, with classic tactics like claiming that I need to confirm a potentially fraudulent transaction. They speak perfect English with an American accent, sound very friendly, and have knowledge of your account balance. Thankfully on the first call I realized it was a scam right away, and Google's call screening featur…

I just switched to iPhone from a pixel device and I’m shook by all the spam calls. How do iPhone users deal with this?

"Yeah yeah... installing your app now... oh there is an error... will try again..."

Re: Coinbase says hackers bribed staff to steal customer data, demanding $20M ransom

#256

Post by HWR_14 »

VectorLock wrote: post #190
modeless wrote: post #179

I have been receiving regular spear phishing calls from these guys, or someone who bought the leaked data, with classic tactics like claiming that I need to confirm a potentially fraudulent transaction. They speak perfect English with an American accent, sound very friendly, and have knowledge of your account balance. Thankfully on the first call I realized it was a scam right away, and Google's call screening featur…

I just switched to iPhone from a pixel device and I’m shook by all the spam calls. How do iPhone users deal with this?

You turn off the notifications from unknown callers? How does Android handle it?

Re: Coinbase says hackers bribed staff to steal customer data, demanding $20M ransom

#257

Post by ClumsyPilot »

thepasswordis wrote: post #56

The problem is that it seems like the data that leaked is also the data that would be used to do account recovery. And what that means is that 1) If you lose access to your account (through either your own fault, or coinbases fault) that the process of recovering it may not be so straightforward anymore. 2) Hackers can try to “recover” accounts now using this leaked info. This is a huge problem. What coinbase needs a…

> The only solution here is: hardware 2 factor like yubikeys.

And when that’s lost, what do you do? Aren’t you back to account recovery step?

Re: Coinbase says hackers bribed staff to steal customer data, demanding $20M ransom

#258

Post by cyanydeez »

modeless wrote: post #179

I have been receiving regular spear phishing calls from these guys, or someone who bought the leaked data, with classic tactics like claiming that I need to confirm a potentially fraudulent transaction. They speak perfect English with an American accent, sound very friendly, and have knowledge of your account balance. Thankfully on the first call I realized it was a scam right away, and Google's call screening featur…

its a shame it'll never stop, and the criminal element is now a legal capitalism

Re: Coinbase says hackers bribed staff to steal customer data, demanding $20M ransom

#259

Post by w-ll »

modeless wrote: post #244
w-ll wrote: post #241

Earlier quoted context omitted.

Was this the general "Important Notice" email that went out this morning, or something more specific.

The "Important Notice" I got says "This included information related to your account". Also I got an email earlier on April 1 about a breach that sounds very similar if it's not the same one.

Sorry to pester, that exact wording?

I see "We wanted to let you know that we detected activity suggesting that information related to your account may have been accessed in a way that did not align with our internal policies." in the email i got this morning

Re: Coinbase says hackers bribed staff to steal customer data, demanding $20M ransom

#260

Post by ClumsyPilot »

johnisgood wrote: post #220
lovich wrote: post #148

Earlier quoted context omitted.

Watching crypto enthusiasts run into every problem that society already tackled with in the past when developing currency and its controls, and then coming up with solutions that look exactly the same as what dirty fiat currency uses, has been a source of much entertainment the past few years

As others have said, it has nothing to do with crypto, it is an exchange problem, and a government intervention problem.

Spherical cow in a vacuum
Post reply on HN