Hacker News Reader

Comment by jedberg | Hacker News Reader

For those that don't want to read the whole thing, (supposedly) the attackers reached out on linkedin to a bunch of employees asking them to apply to a fake company. One of them did it, went through a bunch of fake interviews, and then got a fake offer, in the form of a PDF.

They opened the PDF and that installed a keylogger on their system (it doesn't explain how).

The attackers then used that engineer's credentials to take over 4 of the 9 validators on the blockchain which they then used for their heist.

View on HN

I'm trying to imagine a setup at any company whose primary business is controlling extremely valuable digital assets having a security setup that could be entirely undone with keyloggers, and it's difficult. No necessary VPNs, keys on devices, or other non-password authentication? One engineer's password should not be the keys to the kingdom.

Sounds like a bad RPG plot. "Because of its danger, we broke the Obsidian Key into 9 pieces and divided them across the realm, each protected by a powerful, mystic dungeon. Also, Dave can access them any time he says the secret word."

Agreed. The article doesn't mention keylogger at all. I was definitely picturing a remote control exploit.

They must have updated it. When I read it it specifically said keylogger.

I’m of the view that the completely illogical nature of their entire business and the absence of any meaningful security are deeply interwoven.

Rather than think of their primary business as securing digital assets, think of their primary business as convincing people that a perpetual money machine in the shape of a video game is possible. The valuable digital assets are just a narrative tool — and so it follows that they wouldn’t have the expertise in securing digital assets.

Nobody capable of building a secure system for digital assets would waste their time working for a company like Axie, after all, the entire premise of their business is flawed so people with the critical thinking skills necessary to build a secure system would apply that critical thinking to the viability of the company — and, of course, conclude it’s destined for failure and not hitch their wagon to it.

I understand your argument but this kind of reasoning consistently fails to be predictive. If things worked as you describe, there would be way more consensus amongst skilled engineers on political topics. In practice people are very skilled at selectively turning off their brain, especially when they stand to benefit.

“It's difficult to get a man to understand something when his salary depends on not understanding it." -Upton Sinclair

I completely agree in principle but the nuance here is that I’m leaning on the belief that people joining Axie do not “…stand to benefit…” because the long term prospects of Axie Infinity are not good (and have never been good) and so anybody analysing the benefit of joining them — who has a broad range of opportunities available to them — would immediately see how little they stand to benefit from getting involved with Axie Infinity.

I’m under no illusions about the intelligence of software engineers (of any specialism) — we are all idiots at least some of the time — but I struggle to believe that a competent engineer with lots of opportunities would somehow believe that Axie Infinity is the best opportunity available to them, hence, their system is built by people who don’t have other opportunities and have produced an insecure house of cards (more insecure than the average system anyway — all systems are insecure in some capacity).

I disagree. Competent engineers go where they will be paid, and crypto startups are often one of the few places that can pay our frankly insane compensation requirements.

I had a recruiter contact me just recently for some crypto game that was offering something like $600k/year (which I unfortunately assume was at least partly stock) for one of them, and that would certainly have been enough to attract real security talent.

I think examining the incentives of the managers is far more likely to be informative than looking at IC engineers. The best security engineer in the world probably couldn’t have prevented this hack if management doesn’t listen to what they say.

Axie Infinity exploded in popularity overnight. They likely built their infrastructure when they were securing $1M in digital assets and then suddenly found themselves controlling half a billion before they could upgrade their security.

That doesn’t excuse their poor security practices. They shouldn’t have built their asset custody system in-house if they didn’t have the expertise. They could have used Fireblocks or a Gnosis Safe Multisig with hardware wallets and they would be safe.

> Nobody capable of building a secure system for digital assets would waste their time working for a company like Axie

Someone with low ethics interested in a very good paycheck?

It’s honestly impressive. I work in security in fintech and it can be frustrating to have our work deprioritized against product features. These examples help underscore why having robust security controls is existential.

Reply on news.ycombinator.com