News for hackers. Stuff that matters.

A comment on Coinbase: Responding to Firefox 0-days in the wild. Parent comment

Re:Coinbase: Responding to Firefox 0-days in the wild by staticassertion on Friday August 09, 2019 @06:02PM (#20658565)
Yeah, they could have moved processes before execing the shell. Detecting "Firefox + Shell" is quite easy and standard, even in existing SIEMs.

Detecting "arbitrary program + shell" is at least moderately more difficult.

It's the attacker's dilemma though. They only need to trip one alarm to trigger IR.

[ Parent | on HN ]
Re:Coinbase: Responding to Firefox 0-days in the wild by notathing on Friday August 09, 2019 @06:44PM (#20658808)
The biggest fail here was that 32 bit program warning, which probably alerted the employee.

Notice that they didn't actually have an alert for Firefox+Shell, they detected that later by inspecting the audit logs.

[ Parent | on HN ]
Re:Coinbase: Responding to Firefox 0-days in the wild by staticassertion on Friday August 09, 2019 @07:06PM (#20658929)
> We detected the attacker at this stage, based on a number of behaviors (e.g. Firefox shouldn’t spawn a shell).

They explicitly state it was one of the behaviors they detected as suspicious.

[ Parent | on HN ]