Re:How a hacker's typo helped stop a billion dollar bank heist
by FlyingLawnmower on Friday March 11, 2016 @01:05AM
(#11264925)
As someone totally ignorant in this space, how does opening a .PDF document allow for email hijacking (assuming it was actually a PDF)?
I think I'm stuck at how code is able to execute when opening a document inside a PDF viewer or something of the sort. Thanks for sharing your story!
Re:How a hacker's typo helped stop a billion dollar bank heist
by CiPHPerCoder on Friday March 11, 2016 @01:35AM
(#11265016)
Usually some variant of: The PDF file contains binary data somewhere within it that will cause a particular PDF reader to misallocate memory. Because data and code are jammed next to each other when you run a program, a clever memory misallocation can be used to rewrite the program (the PDF reader) as it executes in order to execute whatever malicious commands the author of said PDF file intends.
The typical defenses against these attacks include:
* Exploit mitigation tools, such as EMET
* Writing applications to be more memory-safe
* Various other tactics, many of them disingenuous.
Re:How a hacker's typo helped stop a billion dollar bank heist
by aaronbasssett on Friday March 11, 2016 @01:32AM
(#11265001)
PDFs support scripting as well as the ability to embed other media such as Flash files.
The subject of the email was "Please see attached documens" in which a PDF was attached that upon opening would hijack your email account and send the same. Over the first day, I had about 100 emails from coworkers in my inbox. After our "IT Security" team sent out an email claiming they stopped the threat, the following day more emails came from coworkers that was a slight variant but had more typos.
I still wonder what sort of breach occurred and whether our internal teams performed a true investigation... obviously a foreign intrusion and they managed to at least gain control of quite a few internal machines.
I still get a laugh out of using the same subject in an occasional email to coworkers...