alt Hacker NewsNorth Korean fake job interview led to $6.3B Binance heist
Comments
I love these guys!
Anybody who thinks this can be prevented from happening again is deluding themselves. I'm looking forward to the MSTR heist writeup when it happens.
A lot of detail on what Engineer A, B and C did. But this would've been prevented if Engineer A didn't have "a container deployment permission token on his computer".
What the fuck? On a target as big as Binance? Every developer should be treated as a liability and never be able to deploy by themselves.
This is insane. The first engineer ran some curl bash, which gave the hackers access to his Slack, and then they set up an interview for him at a fake company and during that interview, they convinced an engineer to download and install some code they had written? This is just clown world.
[dead]
[flagged]
[flagged]
[dead]
[flagged]
Move fast and break things. 4-eyes principle is for brick-and-mortar banks stuck in the prehistoric past of paper money. /s
[dead]
Guy probably skipped his "mandatory" KnowBe4 training... see HR actually does serve a purpose! /s
It's strange companies haven't cracked something as basic as remote hiring checks yet.
There are tools available to stop AI screen recording tools, fake candidate tools yet many companies keep getting hit..
If she hadn't done it on her work laptop, her personal would have been pwned anyway. It's not clear to me how to protect oneself while also looking for work.
I think we need to implement a new handshake protocol for job interviews.
Both candidate and recruiter have to call Kim Jong Un a big fat tosser (other swearwords are available) on a recorded video before the interview continues.
>> "...and is working with law enforcement, blockchain intel firms, and security researchers to trace and freeze the assets. The crypto exchange has also hired independent cybersecurity experts to conduct a cybersecurity review of the incident, and recommend additional protective measures."
>> trace and freeze the assets
It has gotten to the point where the advertised permanence of cryptocoin transactions is a serous national security threat, literally funneling $6+billion to a nation-state whose publicly avowed statements is to destroy the US to fund its nuclear weapons program.
The party is ending. The house lights are flashing. Crypto will either become controlled so illegitimate transactions will be roll-back-able (presumably with proper court or NatSec orders), or it will be banned.