Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A fake job offer took down Axie Infinity

theblock.co

Post reply on HN
Print view View original

321–330 of 364 posts

Re: A fake job offer took down Axie Infinity

#321

Post by walrus01 »

handoflixue wrote: post #128
PragmaticPulp wrote: post #108

Earlier quoted context omitted.

> The main problem was using a machine that had access to half a billion dollars Going up a level, the main problem was that the company had a system where a single person could irreversibly transfer half a billion dollars away from the company.

The article actually covers that it required 5 out of 9 people to sign off. They got 4 via PDF attacks and 1 via legacy access that was never properly terminated.

What the hell is a system that is 1 out of 9 partial crypto key signers for huge amounts of money doing with even a GUI or a PDF reader on it in the first place. Sounds like people using their personal workstation.

Re: A fake job offer took down Axie Infinity

#322

Post by googlerx »

spaceman_2020 wrote: post #311
Retric wrote: post #249

Earlier quoted context omitted.

I lost nothing, but I can empathies with people who are screwed. It’s not that Bitcoin or any alt coin has X paper value right now, it’s nobody can get out without someone else getting stuck holding the bag. The underlying system is predatory because mining isn’t free so it’s a negative sum game where people have already cashed out. I remember being saddened when it was less than 1/1,000th isn’t current value I reali…

> nobody can get out without someone else getting stuck holding the bag That's true for practically every asset class. If you sold your Netflix stock at $600, someone had to buy it at $600 as well. And now they're out of $430. There's a losing counterparty in every winning trade.

With stock though there's a company associated with the stock that (theoretically) brings in profits. Predicted future profits drive the stock price.

Re: A fake job offer took down Axie Infinity

#325

Post by pph »

elif wrote: post #201
hn_throwaway_99 wrote: post #4

Two points to highlight from this article: 1. LinkedIn is an absolute godsend for bad guys, allowing easy targeting of everyone in the company with spear phishing emails and texts. I know many security professionals no longer use their real name, and don't list the real name of their company, because they know it's such a great hacking vector. Not sure what/whether LinkedIn can do anything about this. 2. I wish there…

I'm so confused by #2 as well. If pdf is compromised, is it fixed? This seems like the kind of vulnerability that would ruin pdf's reputation permanently. It was the safe alternative to sending someone a .doc particularly because of it's limited functionality.

PDF can embed lots of things and is quite hard to scan because there's some many ways to do things..

It is used for sending documents because its function is to have a fixed layout for printing (and look the same on every device), not because it's safer than other document formats.

If you really want a safe PDF, there's a function in Qubes OS that basically opens a PDF in a new VM, makes screenshots and then creates a new PDF from those. You'll lose advanced functions (e.g. forms) as the pages simply become pictures but that's a tradeoff you have to make.

Re: A fake job offer took down Axie Infinity

#326

Post by seoaeu »

spaceman_2020 wrote: post #242
Retric wrote: post #239

Earlier quoted context omitted.

It’s fine for a few people to play with such a system. The issue if it’s absolutely clear crypto is incapable of widespread adoption or just about anything else people hype it up as, then it shouldn’t be hyped as if that stuff is a possibility. I could never tell how much was incompetence vs fraud, but either way without the hype vastly fewer suckers would be holding the bag right now. The crypto ecosystem has been j…

The people holding the bag right now mostly got in because of the allure of quick profits. And if they didn't sell even after making incredible (paper) returns, they have their own greed to blame. Bitcoin was $6,000 in March 2020. It hit $63,000 in April 2021. And if you didn't sell that top, it hit $67,000 again in November 2021. Even now, it has dropped less than Netflix, a supposed bluechip. I don't know what's th…

Most Ponzi scheme victims got in because of greed. That doesn’t absolve the con artist for running one though

Re: A fake job offer took down Axie Infinity

#327

Post by seoaeu »

ltbarcly3 wrote: post #171
jspdown wrote: post #80

They rely on 9 trusted validators, the hacker managed to get access to the private keys of 4 out of the 9 validators. What's the point of using a Blockchain if you end up centralizing validations like that?

The true answer is that it doesn't make sense but investors don't care because BLOCKCHAIN

Or rather, it makes perfect sense to slap on the bare minimum amount of blockchain to your scheme, given that it never had any use for blockchain in the first place but you can’t get funding without the right buzzwords

Re: A fake job offer took down Axie Infinity

#328

Post by journey_16162 »

eigenvalue wrote: post #149

Seems like there would be market demand for a super locked down PDF viewer that basically ignores all the silly extensions/additions that Adobe has added to the format over the decades. The vast majority of documents don't need Turing complete code capabilities or embedded videos or interactive 3D models. Something that safely (using sandboxing and other methods) turns the document into totally static pixel data that…

I run multiple user accounts on Linux for different applications. The main account does not have Internet access obviously (blocked by IPTables), only some sub accounts can access it. I guess that if I open a random PDF downloaded from Internet, it can't do anything without Internet access, can it?

Re: A fake job offer took down Axie Infinity

#329

Post by whatisweb3 »

joe_the_user wrote: post #268
whatisweb3 wrote: post #241

Earlier quoted context omitted.

Oracles that connect to off-chain data are usually understood as points of centralization, I don’t think Ethereum or it’s developers are selling otherwise. Most Ethereum developers are advising against relying on bridges across security zones that would be upheld by multisigs and oracles, they are vulnerable to attacks. A better model than a bridge to sidechain would be a rollup - posting proofs on chain without givi…

A better model than a bridge to sidechain would be a rollup - posting proofs on chain without giving the sequencer the ability to steal or control user funds. What's a "proof" of an event in the outside world? No such thing exists. The OP's point that dependence on real world events is a security flaw remains. No alternative programming method can change this because nothing on the Internet can guarantee a real event…

The article in question relates to an incident with a bridge to a proof-of-authority sidechain that was controlled by a multisig. I have not looked deeply at Axie but it is possible that a rollup could replace their bridge and sidechain tech, and their need to "prove" the authority of validators that were upholding the side chain.

Re: A fake job offer took down Axie Infinity

#330

Post by stef25 »

zrobotics wrote: post #299
noduerme wrote: post #195

Earlier quoted context omitted.

If it's just a javascript link to download an EXE, doesn't the target of the hack still need to run the EXE? Or are you saying that a link in a PDF can install and execute code on its own? Assuming it can't, then the engineer had to click to run some unknown EXE after downloading it... that should hardly be described as a "PDF attack".

We had an employee compromised by a similar attack-executable linked in a Pdf. Basic flow was-phisher asked employee to sign a document relating to customs. The phisher had gathered that this employee works with shipping claims and returns, and surmised that they need to deal with customs documents requiring signature. There was a link to an exe hosted on a European cloud service in the PDF titled "install fake signa…

The employee clicked on a link asking them to install a security certificate and completed the install?
Post reply on HN