Coinbase: Responding to Firefox 0-days in the wild • Hacker News Board

Re: Coinbase: Responding to Firefox 0-days in the wild

#91

Post by ufmace » Sat, Aug 10, 2019, 7:23 PM UTC

mnbvkhgvmj wrote: post #85

fsh wrote: post #76

Earlier quoted context omitted.

Banking has insurance against fraud and transactions are generally reversible.

> transactions are generally reversible Not really. If your account is compromised you may indeed get your money back from the bank's insurance (although in some countries that is less likely than others). However, the criminal behind the malware will probably have got at least some of the money. International transfers are not generally reversible. Cash withdrawals are not reversible. Even electronic transfers to an…

At the very least, it's a lot harder for criminals to cash out of compromised bank accounts in a way that doesn't lead law enforcement directly to them.

Re: Coinbase: Responding to Firefox 0-days in the wild

#92

Post by gnufx » Sat, Aug 10, 2019, 8:31 PM UTC

microtonal wrote: post #13

dmortin wrote: post #9

Does it a help in this case if one runs the browser in a sandbox? E.g. in docker? They can then break out from the browser, but only get to docker with that exploit, and it's unlikely they have a docker exploit too at hand, is it?

They can then break out from the browser, but only get to docker with that exploit, and it's unlikely they have a docker exploit too at hand, is it? If you are running Firefox on X11 (which most Linux users probably still do), you do not need to escape Docker. You can make screenshot, capture keystrokes, and send keystrokes, all through the X11 socket. (Furthermore, you do not need a Docker exploit, a Linux kernel ex…

I don't know how effective it is, but firejail can use xpra or xephyr to firewall X.

Re: Coinbase: Responding to Firefox 0-days in the wild

#93

Post by AmericanChopper » Sat, Aug 10, 2019, 9:49 PM UTC

tptacek wrote: post #89

dmix wrote: post #57

Earlier quoted context omitted.

I'm guessing Coinbase hiring a pentester and giving them 'employee level access' would be a needless formality?

People do internal pentests even though everyone knows the pentesters will win; you still learn something from the experience.

You’ll never be able to prevent privileged insiders, or their accounts, from being able to cause damage. But I have worked with organisations where internal tests were not able to compromise the most critical assets, and where the outcome of the tests was those assets become even more well protected. Which is really the best outcome you could be hoping for with these kinds of engagements, imo.

Re: Coinbase: Responding to Firefox 0-days in the wild

#94

Post by ryacko » Sat, Aug 10, 2019, 11:20 PM UTC

ALittleLight wrote: post #58

ryacko wrote: post #20

Earlier quoted context omitted.

I think this is why investigations require low levels of evidence to start, but high levels of evidence to end. Just because it isn’t exceptional doesn’t mean that it isn’t worth looking into. People who are greedy are impulsive and are unlikely to hide an inflow of cash.

Theft isn't restricted to impulsive people though. It's mostly restricted to people who think they'll get away with it. Clever and cautious people may actually be able to.

Uh.

Yes.

But things don’t disappear do they?

Re: Coinbase: Responding to Firefox 0-days in the wild

#95

Post by wmf » Sun, Aug 11, 2019, 2:54 AM UTC

hollerith wrote: post #54

wmf wrote: post #50

Earlier quoted context omitted.

BCH is and will be mined proportionately to its price; since its price is far lower than BTC it also has far lower security.

OK, but I would've guessed that the reward for hijacking BCH's blockchain would be proportionally lower. And please keep in mind the context of my first comment: I was replying to the assertion that the mere fact that Coinbase continues to let its customers trade in BCH is evidence that Coinbase is run by idiots.

Yeah, it's cheap to attack BCH but there's little benefit to doing so. Whether that makes BCH safe to trade or a reckless shitcoin is a matter of opinion.

Re: Coinbase: Responding to Firefox 0-days in the wild

#96

Post by vbezhenar » Mon, Aug 12, 2019, 5:58 PM UTC

oehpr wrote: post #87

aitchnyu wrote: post #81

Earlier quoted context omitted.

I see my colleague making a web app that forces the browser into 100% CPU on scroll, just to animate a shrinking nav bar. Also a page that wont settle in for 15 seconds until assets from Google Fonts downloaded and all scripts have run. So I secretly pray for a draconian anti-js order imposed on us, even though my minimal Vue scripts will go away.

This was mentioned in a previous HN thread and I thought it was a brilliant idea. By default, browsers should throttle websites. Throttle their CPU and their ram usage, and websites can then ask for permission to be unthrottled. We have very capable computers now. But the web feels just as slow. Some negative pressure against bloat is sorely sorely needed.

No sane man will hurt his users intentionally. It won't happen.

Re: Coinbase: Responding to Firefox 0-days in the wild

#97

Post by vageli » Mon, Aug 12, 2019, 11:22 PM UTC

rocqua wrote: post #83

vageli wrote: post #48

Earlier quoted context omitted.

> This point to an actual use of the cryptocurrency - exploiting a 0 day against someone who might have a crypto wallet means you can actually directly make money off exploits. Prior to crypto, having a 0 day wasn't equal with ability to make blackhat money with it... Why would that be the case when it is not illegal to sell exploits?

Selling exploits requires credibility, escrow, and deep contacts. Selling bitcoin is a lot easier.

Ah so you mean leveraging the exploit for financial gain by using it (ransomware) versus selling. That makes a ton of sense!