A fake job offer took down Axie Infinity

Re:A fake job offer took down Axie Infinity by mousetree on Wednesday July 06, 2022 @03:02PM (#32005327)

My understanding of the article was that only 1 person was compromised and that the exploit installed on their computer was then used to access the validator nodes themselves. FWIW, I have no idea what a validator node is but I'm assuming that by compromising one employee's workstation they somehow got access to multiple other machines (which if true is itself a bit of a f* up).

[ Parent | on HN ]

Re:A fake job offer took down Axie Infinity by logifail on Wednesday July 06, 2022 @03:13PM (#32005442)

> I'm assuming that by compromising one employee's workstation they somehow got access to multiple other machines (which if true is itself a bit of a f* up)

Q: If you assume the bad guys have already compromised your workstation, how sure are you that they won't be able to compromise other machines you connect to?

[ Parent | on HN ]

Re:A fake job offer took down Axie Infinity by fsckboy on Wednesday July 06, 2022 @04:47PM (#32006621)

because the workstation was compromised by opening a corrupted pdf, but that vector wouldn't compromise the other machines unless users on them could be induced to open the same pdf.

not to say it can't be done, but it was unexplained

[ Parent | on HN ]

Re:A fake job offer took down Axie Infinity by sangnoir on Wednesday July 06, 2022 @05:24PM (#32007004)

It doesn't have to be the same pdf, it could have been an attachments from compromised machine via email/slack. "Hey, can you help me figure this unusual log/transaction summary". How many wouldn't open such an attachment from a "colleague"?

[ Parent | on HN ]

Re:A fake job offer took down Axie Infinity by emmelaich on Wednesday July 06, 2022 @07:43PM (#32008286)

Yep, internal security is brittle. The initial pdf vector would be only the start of a long sequence of hacks, including social engineering. e.g. sending email from managers -- or slack messages as you mention.

[ Parent | on HN ]

Re:A fake job offer took down Axie Infinity by DelightOne on Thursday July 07, 2022 @07:06AM (#32012481)

How do you defend against getting email from internal people, especially from people you expect email from?

[ Parent | on HN ]

Re:A fake job offer took down Axie Infinity by mavhc on Thursday July 07, 2022 @07:37AM (#32012684)

Don't keep your security keys capable of root access on anything that's not a hardware token locked in a safe.

Of course if you can access the software running the blockchain and get everyone to install an update, that works too

[ Parent | on HN ]

Re:A fake job offer took down Axie Infinity by JacobThreeThree on Wednesday July 13, 2022 @01:52PM (#32086290)

You can call your colleague on the phone to confirm they sent the email asking you to open an attachment.

[ Parent | on HN ]

Re:A fake job offer took down Axie Infinity by mannykannot on Thursday July 07, 2022 @07:34AM (#32012666)

It does not have to be via the same method; what the attackers discover from the first compromised machine may give them access to other machines. It seems clear this is what happened here:

Employees are under constant advanced spear-phishing attacks on various social channels and one employee was compromised... The attacker managed to leverage that access to penetrate Sky Mavis IT infrastructure and gain access to the validator nodes.

[ Parent | on HN ]

Re:A fake job offer took down Axie Infinity by charcircuit on Wednesday July 06, 2022 @03:20PM (#32005531)

You can't which is why one person shouldn't have access to more than one.

[ Parent | on HN ]