Coinbase: Responding to Firefox 0-days in the wild(blog.coinbase.com) |
Coinbase: Responding to Firefox 0-days in the wild(blog.coinbase.com) |
HN discussion: https://news.ycombinator.com/item?id=20283922
Any insider shouldn't be able to steal more than the hot wallet, and even that should be hard.
I actually wouldn't put much effort into border security. At coinbases level of risk, evildoers will have no qualms bribing an employee to install a backdoor in their machine.
Insider threat is also really difficult. Working from a point of "I don't trust my employees" is very painful for many reasons.
It’s probably the hardest problem to solve in general, but it’s exactly what a well designed separation of duties is supposed to address.
If you fully trust the system you're building (and that trust is well-placed, meaning you can _prove_ the lack of significant exploits/vulnerabilities) then you should have no issue allowing others to try and poke holes in it
The usual caveat is that untrusted employees with sufficient access could potentially wreak havoc, but I would argue that if you really trust your system, and define the boundaries of your system well enough (i.e. to also encapsulate the issuance and management of all permissions relating to the system), then you can effectively limit the ability of malicious actors to break things or otherwise amass control
At least another time in the last week I read on other threads on HN or related links that vulnerability were found almost the same time by independent people.
Here we have a researcher from Google’s Project Zero and the attacker.
How do you explain these coincidences?
What is the chance that some prominent researchers being targeted and their systems are actually exploited?
Can someone explain what they mean by IOCs?
https://www.newsweek.com/cryptocurrency-traders-abducted-tor...
> The attackers went through a qualification process and multiple rounds of emails with potential victims, making sure they were high-payoff targets before they directed victims to the page containing the exploit payload.
It's a well-prepared plan combining social engineering and technical exploits
Why would that be the case when it is not illegal to sell exploits?
Detecting "arbitrary program + shell" is at least moderately more difficult.
It's the attacker's dilemma though. They only need to trip one alarm to trigger IR.
Notice that they didn't actually have an alert for Firefox+Shell, they detected that later by inspecting the audit logs.
A similar event actually happened with another asset they offer - Ethereum Classic.
https://cointelegraph.com/news/ethereum-classic-51-attack-th...
They can then break out from the browser, but only get to docker with that exploit, and it's unlikely they have a docker exploit too at hand, is it?
They paid some registrar for the domain. Can police request payment details? Can someone buy domain on stolen credit card?
By default, browsers should throttle websites. Throttle their CPU and their ram usage, and websites can then ask for permission to be unthrottled.
We have very capable computers now. But the web feels just as slow. Some negative pressure against bloat is sorely sorely needed.
Far more likely: there is a related cause that made two people think to try the same thing at approximately the same time. Someone publishes a new JIT type confusion bug, someone realizes "oh man it never occurred to me that X could trigger bug type Y", they start digging, and...
Maybe this is not the case but if somebody has powerful means, knowledge on how do successful targeted attacks, and access to the right 0 days, it would make sense that can use their resources to find other 0 days in this way.
At the same time it can be that (b) people in Hollywood talk with each others about stories they want to put on the screen.
Or it can be (c) that studio A has inside intelligence in studio B looking for interesting stories to be made in a movie.
2) It is similar to 2 startup companies starting tackling similar new problems. It may be because of (a) a new enabling technology came up or a change in the landscape that unlocks the new opportunity.
Or because (b) the loop: entrepreneurs talk to investors -> investors talk with each others -> repeat
Or because (c) entrepreneur A knows that entrepreneur B is up to something and find a way to spy on them to find what they are up to.
3) In the case discussed above, it may be (a) a new discovered bug on public forum leads to similar bugs being discovered, (b) researchers talking to each others in their circles, (c) a powerful entity getting access to the researcher's "secrets".
The difference between (a), (b) and (c) causes is that (a) causes happen in public places. (b) causes happen in private circles. (c) it is not a result of deliberate communication, it is stolen IP.
That is already a meaningful distinction. Now the questions is how often a, b, and c happen in the different context and how do they impact the outcome of the projects in the respective fields.
In all examples, timing is one of the keys to be successful.
The difference between (1), (2) and (3) is how legal or ethical the "exploiter" of the IP is abler to get the IP and their tolerance to risk.
It seems that in our case(3) (c) is more likable than in the other cases considering the actors involved and their modus operandi.
Project Zero buys 0days on darknet? Google has unlimited cash, so technically possible.
If you are running Firefox on X11 (which most Linux users probably still do), you do not need to escape Docker. You can make screenshot, capture keystrokes, and send keystrokes, all through the X11 socket.
(Furthermore, you do not need a Docker exploit, a Linux kernel exploit can be enough to break out of a container. This is one of the reasons for e.g. gVisor to implement syscalls in userland and in a safer language.)
Using VMs as e.g. Qubes OS does is probably a bit safer than a Docker container.
Also, this is why Wayland is much more restrictive about these types of operations. People love to complain that "I could do thing with X without special privileges" but the world has moved on since X was designed and it absolutely has not kept up.
It creates boundaries, but, like a typical suburban garden fence, they aren't hardened security boundaries.
Basically what I'm saying is, it's very much a security boundary. It's far from a decorative fence.
Now breaking out of a docker container with --privileged or even just CAP_SYS_ADMIN is much easier.
Since default docker runs linux, running the browser in a linux docker can be enough, because they usually have windows exploits.
Though granted it confuses keys for passwords.
They explicitly state it was one of the behaviors they detected as suspicious.
Not really. If your account is compromised you may indeed get your money back from the bank's insurance (although in some countries that is less likely than others). However, the criminal behind the malware will probably have got at least some of the money.
International transfers are not generally reversible. Cash withdrawals are not reversible. Even electronic transfers to another bank in the same country (maybe this varies by country) are only reversible if the money has not been withdrawn.
And then there have been cases of actual bank systems being compromised so that criminals can just increase the balance of accounts directly.. And cashpoints (atms) being compromised.
Just because it isn’t exceptional doesn’t mean that it isn’t worth looking into. People who are greedy are impulsive and are unlikely to hide an inflow of cash.
Yes.
But things don’t disappear do they?
Docker does do a decent job of setting some sensible defaults - but it isn't a security sandbox and they don't market it as such.
[0] https://blog.dragonsector.pl/2019/02/cve-2019-5736-escape-fr...
But Nintendo didn't pivot from playing cards to guarded stagecoaches, they stayed in the entertainment focus and evolved over a century into electronics. The stakes were always low.
https://www.reddit.com/r/CoinBase/comments/7jtlgz/coinbase_s...
IIRC BCH and ETC forked before BTG. They probably did two of them and then asked themselves "Why are we doing this again?"
And please keep in mind the context of my first comment: I was replying to the assertion that the mere fact that Coinbase continues to let its customers trade in BCH is evidence that Coinbase is run by idiots.
In reality there is nowhere you could rent this hashpower and miners that do have it would never risk the legal, social and monetary consequences to rollback 2 hours of transactions.