Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Coinbase: Responding to Firefox 0-days in the wild

blog.coinbase.com

Post reply on HN
Print view View original

51–60 of 97 posts

Re: Coinbase: Responding to Firefox 0-days in the wild

#51

Post by nostrademons »

grubles wrote: post #44
ceejayoz wrote: post #5

Earlier quoted context omitted.

"We're not run by idiots"?

That doesn't explain listing Bitcoin Cash (Bcash) - an altcoin that shares its mining algorithm with Bitcoin but only has a very small amount of hash rate backing it. Any small Bitcoin miner can decide at any moment to switch to mining Bitcoin Cash and cause block reorgs or mine blocks with no transactions at all. A similar event actually happened with another asset they offer - Ethereum Classic. https://cointelegrap…

Much of this is because of forks - since they offered Bitcoin before the BCH fork (and presumably ETH before the ETC fork), all of their customers who owned one of these before the fork also own the new currency. So they have to support custody for the currencies anyway (unless they want to deal with angry customers saying "What happened to my BCH! Rightfully I own it"), and if they don't support trading they'll get angry customers that say "Why can't I sell my BCH?!?". (This is aggravated by potentially needing to send that BCH off to another exchange, potentially not in the U.S, with worse regulatory compliance, in order to sell.) So most of the work needed to support it has to be done anyway to remain in legal compliance, and it's a small amount of additional work for a large benefit to support trading.

Re: Coinbase: Responding to Firefox 0-days in the wild

#53

Post by tptacek »

AmericanChopper wrote: post #38
staticassertion wrote: post #31

Earlier quoted context omitted.

Given how quickly coinbase managed to respond to an advanced attacker I think they know what they're doing. Insider threat is also really difficult. Working from a point of "I don't trust my employees" is very painful for many reasons.

> Working from a point of "I don't trust my employees" is very painful for many reasons. It’s probably the hardest problem to solve in general, but it’s exactly what a well designed separation of duties is supposed to address.

I have never even heard of an internal site-wide pentest that failed.

Re: Coinbase: Responding to Firefox 0-days in the wild

#54

Post by hollerith »

wmf wrote: post #50
hollerith wrote: post #46

Earlier quoted context omitted.

Huh, I would've thought that since people will pay over 300 usd for one Bitcoin Cash coin (according to 3 web sites I just sampled), there would always be plenty of miners competing for them.

BCH is and will be mined proportionately to its price; since its price is far lower than BTC it also has far lower security.

OK, but I would've guessed that the reward for hijacking BCH's blockchain would be proportionally lower.

And please keep in mind the context of my first comment: I was replying to the assertion that the mere fact that Coinbase continues to let its customers trade in BCH is evidence that Coinbase is run by idiots.

Re: Coinbase: Responding to Firefox 0-days in the wild

#55

Post by kccqzy »

dragonwriter wrote: post #37
dmortin wrote: post #9

Does it a help in this case if one runs the browser in a sandbox? E.g. in docker? They can then break out from the browser, but only get to docker with that exploit, and it's unlikely they have a docker exploit too at hand, is it?

As I understand it, Docker isn't intended to be, and shouldn't be relied on as, a security sandbox. It creates boundaries, but, like a typical suburban garden fence, they aren't hardened security boundaries.

Breaking out of a docker container with default settings is hard. You would be making the headlines if you could do so.

Now breaking out of a docker container with --privileged or even just CAP_SYS_ADMIN is much easier.

Re: Coinbase: Responding to Firefox 0-days in the wild

#56

Post by viraptor »

dragonwriter wrote: post #37
dmortin wrote: post #9

Does it a help in this case if one runs the browser in a sandbox? E.g. in docker? They can then break out from the browser, but only get to docker with that exploit, and it's unlikely they have a docker exploit too at hand, is it?

As I understand it, Docker isn't intended to be, and shouldn't be relied on as, a security sandbox. It creates boundaries, but, like a typical suburban garden fence, they aren't hardened security boundaries.

You've got two cases here: breaking out of default Docker config, or breaking out of kernel namespaces. The first one is very common now and really well tested. The second one is definitely security sandbox worthy. Docker also integrates with selinux and seccomp.

Basically what I'm saying is, it's very much a security boundary. It's far from a decorative fence.

Re: Coinbase: Responding to Firefox 0-days in the wild

#57

Post by dmix »

tptacek wrote: post #53
AmericanChopper wrote: post #38

Earlier quoted context omitted.

> Working from a point of "I don't trust my employees" is very painful for many reasons. It’s probably the hardest problem to solve in general, but it’s exactly what a well designed separation of duties is supposed to address.

I have never even heard of an internal site-wide pentest that failed.

I'm guessing Coinbase hiring a pentester and giving them 'employee level access' would be a needless formality?

Re: Coinbase: Responding to Firefox 0-days in the wild

#58

Post by ALittleLight »

ryacko wrote: post #20
bravoetch wrote: post #19

Earlier quoted context omitted.

To follow through on that though, what makes you think that would be anything noticeable? Suddenly a coinbase employee buys a cool car or other new toy... So what? Nobody would think that was exceptional.

I think this is why investigations require low levels of evidence to start, but high levels of evidence to end. Just because it isn’t exceptional doesn’t mean that it isn’t worth looking into. People who are greedy are impulsive and are unlikely to hide an inflow of cash.

Theft isn't restricted to impulsive people though. It's mostly restricted to people who think they'll get away with it. Clever and cautious people may actually be able to.

Re: Coinbase: Responding to Firefox 0-days in the wild

#59

Post by grubles »

nostrademons wrote: post #51
grubles wrote: post #44

Earlier quoted context omitted.

That doesn't explain listing Bitcoin Cash (Bcash) - an altcoin that shares its mining algorithm with Bitcoin but only has a very small amount of hash rate backing it. Any small Bitcoin miner can decide at any moment to switch to mining Bitcoin Cash and cause block reorgs or mine blocks with no transactions at all. A similar event actually happened with another asset they offer - Ethereum Classic. https://cointelegrap…

Much of this is because of forks - since they offered Bitcoin before the BCH fork (and presumably ETH before the ETC fork), all of their customers who owned one of these before the fork also own the new currency. So they have to support custody for the currencies anyway (unless they want to deal with angry customers saying "What happened to my BCH! Rightfully I own it"), and if they don't support trading they'll get…

That doesn't explain the favoritism for BCH over the multitude of other forks (some worth $50-$100 per token) though. Why no Bitcoin Gold listing?

Re: Coinbase: Responding to Firefox 0-days in the wild

#60

Post by shakna »

kccqzy wrote: post #55
dragonwriter wrote: post #37

Earlier quoted context omitted.

As I understand it, Docker isn't intended to be, and shouldn't be relied on as, a security sandbox. It creates boundaries, but, like a typical suburban garden fence, they aren't hardened security boundaries.

Breaking out of a docker container with default settings is hard. You would be making the headlines if you could do so. Now breaking out of a docker container with --privileged or even just CAP_SYS_ADMIN is much easier.

There was a CVE in February [0][1] that escaped out of Docker's default settings. runc has a few of these over the last few years, it isn't inconceivable that there are more to be found.

Docker does do a decent job of setting some sensible defaults - but it isn't a security sandbox and they don't market it as such.

[0] https://blog.dragonsector.pl/2019/02/cve-2019-5736-escape-fr...

[1] https://seclists.org/oss-sec/2019/q1/119

Post reply on HN