原文参照
続き
9. 定期的にセキュリティを確認し、標準的な運用手順を確立することを習慣にしてください。攻撃者は休眠状態のまま、非常に長い時間待機した後、攻撃する適切な瞬間を待つことができます。
参考までに、私はハードウェア ウォレットを持っていますが、これは侵害されていません。もちろん、ハードウェア ウォレットはできる限り使用する必要があります。また、これが税金逃れのためだと主張する人たちには、盗難やハッキングによる税金は 2017 年以降控除できなくなったことを知っておいてください。
最終的な合計は約 677,000 ドルです。残念ながら、ユーザーは Tornado を開始しました。攻撃者に関する追加の手がかりはいくつかありますが、ユーザーの身元を特定し続けるために、現時点では秘密にしておきます。その後、警察に報告し、攻撃者が私の資金の一部を CEX に送金したことを報告しました。
可能性は低いですが、質問も調査もせずに資金を返還するために 150,000 ドルの賞金を出すつもりです。報奨金ベースのフォレンジック サービスも検討します (前払いのサービスなので、気にしないでください)。 高価な教訓ですが、私はまだここにいます。 痛い後退ですが、ショーは続けなければなりません。
上記の調査は、次の投稿によって促されました:
(@sell9000
46 時間前に複数のウォレット アプリから 50 万ドルが流出したことに気付きました
拡張機能攻撃を受けたと思います。Chrome ブラウザーに 2 つの疑わしい拡張機能が表示されました
気分は良くありません
まだ調査中です)
LIVEkaymyg
--
(@sell9000 )
PSA re: an expensive opsec lesson
At this time I have confirmed that it was a Google login that caused this compromise. An unknown Windows machine gained access about half a day before the attack. It also spoofed the device name, so the notification of the new activity alert (which occurred early morning while I was asleep) appeared similar to devices I normally use (it may have been a calculated gamble for a common device name unless I was specifically targeted).
Upon further investigation, this device is a VPS hosted by #KaopuCloud as a global edge cloud provider that is shared among hacker circles in Telegram, and has been used in the past for #phishing and other malicious activities by shared users.
I do have 2FA enabled, which the user managed to bypass. I have yet to determine exactly how this was achieved, but possibly attack vectors were OAuth phishing, cross site scripting, or man-in-the-middle attack on a compromised site, followed by possible additional #Malware . In fact, apparently #OAuth endpoint attack recently has been reported to hijack user cookie session (https://darkreading.com/cloud-security/attackers-abuse-google-oauth-endpoint-hijack-user-sessions…). Be extremely careful if you have to use Sign In From Google.
Takeaways:
1. Bitdefender sucks, it caught nothing while Malwarebytes caught a bunch of vulnerabilities after the fact.
2. Do not become complacent just because you were moving large figures for years without issues.
3. Never enter a seed, period, no matter what reasonable excuse you give yourself. Not worth the risk, just nuke the computer and start fresh.
4. I'm done with Chrome, stick with a better browser like Brave.
5. Preferably never mix devices, and have an isolated device for crypto activities.
6. Always check the Google Activity alert if you are continuing to use Google based devices or authentication.
7. Turn off extension sync'ing. Or just turn off sync'ing period for your isolated crypto machine.
8. 2FA is clearly not bulletproof, don't become complacent to it.
PSA re: an expensive opsec lesson
At this time I have confirmed that it was a Google login that caused this compromise. An unknown Windows machine gained access about half a day before the attack. It also spoofed the device name, so the notification of the new activity alert (which occurred early morning while I was asleep) appeared similar to devices I normally use (it may have been a calculated gamble for a common device name unless I was specifically targeted).
Upon further investigation, this device is a VPS hosted by #KaopuCloud as a global edge cloud provider that is shared among hacker circles in Telegram, and has been used in the past for #phishing and other malicious activities by shared users.
I do have 2FA enabled, which the user managed to bypass. I have yet to determine exactly how this was achieved, but possibly attack vectors were OAuth phishing, cross site scripting, or man-in-the-middle attack on a compromised site, followed by possible additional #Malware . In fact, apparently #OAuth endpoint attack recently has been reported to hijack user cookie session (https://darkreading.com/cloud-security/attackers-abuse-google-oauth-endpoint-hijack-user-sessions…). Be extremely careful if you have to use Sign In From Google.
Takeaways:
1. Bitdefender sucks, it caught nothing while Malwarebytes caught a bunch of vulnerabilities after the fact.
2. Do not become complacent just because you were moving large figures for years without issues.
3. Never enter a seed, period, no matter what reasonable excuse you give yourself. Not worth the risk, just nuke the computer and start fresh.
4. I'm done with Chrome, stick with a better browser like Brave.
5. Preferably never mix devices, and have an isolated device for crypto activities.
6. Always check the Google Activity alert if you are continuing to use Google based devices or authentication.
7. Turn off extension sync'ing. Or just turn off sync'ing period for your isolated crypto machine.
8. 2FA is clearly not bulletproof, don't become complacent to it.
免責事項：第三者の意見を含みます。当社による財務上の助言ではありません。 利用規約をご覧ください。
クォート 1