And today, children, I will tell you a horror story of $6.3 billion. A short introduction…

And today, children, I will tell you a horror story of $6.3 billion.

A short introduction and let's go. Today is Halloween. I have already said more than once that I love the atmosphere of this holiday, although our people and the state have a very “special” attitude towards it. The holiday itself is not prohibited, butpublic display of certain symbolsyou can get under the article (and what such symbolism is will be decided by those who are offended🥰). In general, horror stories are different. Today I brought one in my specialty

Let's imagine a safe with the door firmly closed. Now you are absolutely sure of this. But at some point you check it and... it turns out to be empty. Scary?

So here you go ⤵️

On October 29, about $6.3 billion was stolen from Binance wallets.However, the exchange has not yet found evidence of leakage of private keys. The keys could remain in place while the stranger disposed of the contents

According to the preliminary version of Binance, the attackers compromised the laptop of a DevOps engineer, through it they gained access to the service container and the ability to send unauthorized transactions. The words “DevOps engineer’s laptop” made my eye twitch a little 🤌

I note that this is still a preliminary version. The full chain is still under investigation

But on Ethereum you can see a specific mechanism.EIP-7702allows the wallet to execute the code of the selected smart contract after signing a special permission. The attacker used pre-signed permissions to force the Binance wallet to execute code under his control

A few minutes later the money was withdrawn. Then new receipts were also written off: the permit continued to be valid

That's how f... I am, doggy 😏

Binance suspended withdrawals and promised to cover the losses. By October 31, the company announced that 90% of the stolen assets had been replaced using its own funds and funds.

The horror story is over. Now let's try to draw conclusions about how we could have avoided all this altogether.

Well, for starters, Zero Trust. Yeah, yeah, he's still relevant. Minimum rights, separate administrative access and independent audits of transactions. Hacking one component should have limited consequences. This way we can reduce the spread further

Specifically for wallets, I would advise checking the contents of signed permissions, limiting the amounts and automatically stopping abnormal outflows

Well, I simply advise users not to keep everything in one place. This is really important if you don’t want to lose everything you have at some point.

Happy pumpkin savior to everyone 🎃

🫡Website| 🤔Habr

#information_security