Subscribe
Share
Share
Embed
A fake job interview reportedly helped attackers compromise Binance engineers, turning a familiar endpoint compromise into a roughly $6.3 billion theft and a hard lesson in identity, privilege, transaction controls, and fast containment.
Shared Security is the the longest-running cybersecurity and privacy podcast where industry veterans Tom Eston, Scott Wright, and Kevin Tackett break down the week’s security WTF moments, privacy fails, human mistakes, and “why is this still a problem?” stories — with humor, honesty, and hard-earned real-world experience. Whether you’re a security pro, a privacy advocate, or just here to hear Kevin yell about vendor nonsense, this podcast delivers insights you’ll actually use — and laughs you probably need. Real security talk from people who’ve lived it.
This hack, if no other hack has done it, this hack,
should at least do something to stop the,
well, if I just buy another tool,
I'll be able to solve the problem.
Ooh, picture this.
You think you're doing a job interview,
the coding exercise is not a test, but it's a trap.
Binance says attackers used a fake recruiting process
and malicious software to compromise engineers
and then used a third engineer's computer
in the report theft of roughly 6.3 billion in cryptocurrency.
Now, this isn't just a crypto got hacked story.
It's a nasty game of corporate dominoes,
recruiter lure, infected laptop, trusted tools,
powerful permissions and a transfer path
that should have had a lot more breaks.
Plus, the FBI has now attributed the theft
to a North Korean hacking group.
So today, we are going to discuss
how does a fake interview become a billion dollar incident
and what stops one compromised endpoint
from turning into the biggest cryptocurrency breach to date?
And joining me to discuss this topic
are my co-hosts, Scott Wright and Kevin Tackett.
Hello, gentlemen.
Uh-oh, now we're gentlemen.
Yes, you are the finest gentleman to ever be on a podcast.
Yes, yes.
I am the finest gentleman in these shoes.
You're right.
Right, right.
Well, it's the funniest guy in these shoes.
Yes.
So largest cryptocurrency breach in history to date.
It's not real money, right?
So far, it's not real money.
It's not real, so don't worry about it.
It's not real.
Yeah, yeah, no one invests in this stuff.
No, no.
This is one of those ones
that I'm getting a little bit of a kick out of.
Yeah.
I don't mean that it's in, I'm enjoying it.
Okay, yeah.
Yeah, I don't mean it that way.
I just like the sheer amount of noise around.
Oh, a lot of noise.
Like, look, expensive crypto, all cool buzzwords,
everything else like that.
But my understanding is, and correct me
if I'm misunderstanding, my understanding is
this is simply somebody's end point got hacked
and somebody abused the access they had with that hack.
There's nothing special about what happened here.
And that to me is actually the really interesting part of this
is that, yeah, really big damage, you know,
all of that, all that's interesting.
Definitely a company, like to me,
this is where we go to definitely a company
that if it was possible to secure all the things
they could afford, right?
Oh, yeah.
I make the joke all the time
when I'm on stage at conferences and stuff like that,
like, hey, if you have an unlimited budget,
stop by my booth.
This company pretty much has an unlimited budget, right?
It's like a bank.
Yeah, but more so, right?
Like, I mean, it's just math.
They can math more, but what I want to,
my point is this hack, if no other hack has done it,
this hack should at least do something to stop the,
well, if I just buy another tool,
I'll be able to solve the problem.
That's a good thing.
Yeah.
That's the point I wish more people were getting
from this hack.
Like, look, they had the controls,
at least according to everything I've read.
I mean, not a customer, right?
I don't know anything about them.
I'm not a customer of theirs.
They're not a customer of mine.
I don't know a fraud except what I've read.
And everything I've read says,
here is a company that had the ability
and the interest in doing all the right thing.
And they still got popped.
Maybe we could switch where we focus our attention
on our own stuff.
Well, it's also, I mean,
this is going back to the interview,
the North Korea fake interviews, right?
Which have hit several companies.
No before.
Yeah, a lot of companies have been hit with this.
And to your point, Kevin, like it's not,
I mean, of course you get on a system of a developer,
of course you're going to be able to replicate
the settings of that developer
and the access that that developer has,
which is exactly what happened here.
Of course they had access to the source code
and coding repositories, that's what a developer does.
The answer isn't, oh, remove the access.
That developer needs that access.
This is an actual business case
where I think it's interesting that North Korea did this.
If you're a crypto company
and you don't realize nation states are coming after you,
you probably aren't that good of a crypto companies.
Yeah, I hope I don't have high hopes.
I would not put, what is it?
Polymarket money.
Oh gosh.
No, but this is one of those cases
where I hope that people just look at it and go,
damn, maybe we should be thinking about,
how do we, how do we evaluate access?
How do we evaluate what is okay and what isn't okay?
How do we monitor for the inbound stuff, right?
What was it, Gatelik?
That, he did the egress detection was his book.
Yeah.
Right, or 20 years ago or something like that, right?
The idea was good, right?
Like, hey, we know they're gonna get in.
Like, we don't like it.
We'll do everything we can to stop them from being in, right?
But if we work from the assumption
that we know they'll get in ultimately,
how do we reduce the damage they can do?
Detection and response, yeah.
Right, incident response.
This is where this goes back to because, yeah,
we can't stop the fake job interview,
the malicious software downloads,
like that's all going to happen.
I mean, these are the attack vectors
that are being leveraged.
But I think the one thing to call out in this incident
is that there was a four-hour response window.
So there was a period of time that detection
and other things were probably starting to happen,
but it took them four hours to basically shut this down.
And four hours is a long time.
I mean.
Yeah, anybody who's ridden in a car
for four hours with toddlers knows that.
Yeah, right.
But I think that is,
it's like what we always talk about, right?
Eventually, an organization is going to get hacked.
It's just a matter of when, right?
And it's how we prepare
and how we handle incident response.
And in this case, I'm glad that they were transparent
about the process, like what happened,
and that's why the community right now
is talking about this.
But the fact that, of course,
they're going after cryptocurrency
because you can make transactions very quickly
and then the traceability piece debatable
through the blockchain or what have you, right?
And the reason I think North Korea
is targeting cryptocurrency organizations
and companies like Binance
is because this is how they're funding their government.
Like I read an article about this of how,
well, why is North Korea so good at hacking right now?
And it's because this is how they are funding
their government from, you know,
like they have no other means of making money.
So do it this way, right?
And crypto has always been presented
as an unstoppable money, right?
Like if I grab it, it's mine.
You can't not be proud.
Now, obviously systems have been put in place
and yeah, now what have you, but...
So one question I have though,
I'm interested in your take,
but I didn't see anywhere where now
this job interview where the developers at Binance,
were they interviewing like a candidate?
I don't think they were, right?
Because they were actually interviewing themselves
because they were asked to download essentially code
a package to look at.
But then there was an advertisement
that was basically the malware delivery piece.
And then the source code I'm assuming
or the code whatever ran, you know,
that the exercise that they had to do
initiated the attack and created that C2 channel.
That's how I'm kind of...
But though I understand it.
The way I imagine it when you said
that the company wasn't advertising for jobs,
it would have likely been, I think, the other way around.
One of the engineers might have been looking for a job.
That's what I'm thinking, yeah.
And somebody, he saw an ad exactly like you said.
And they were using their Binance work computer.
Yes, yeah.
Which is a big no-no.
But never have it.
Yeah, I mean, it's, yes,
I'm sure this happens all the time,
but if you're interviewing for a job,
I mean, I guess this gets back to
personal versus business, right?
And we've talked about why you should have
a personal device for personal things
and it's not the best idea to do your personal work
on your work laptop,
even though it happens all the time.
And yeah, yeah, of course.
But it's how, you know,
if you're interviewing and you're running code
on your work computer, I don't know.
Mobile apps are just part of everyday life now.
Banking, healthcare, shopping, entertainment, you name it.
And with that comes a lot of trust
because users are putting their personal data
directly into your app.
But here's the reality.
Mobile apps are a growing target.
A recent survey found that 72% of organizations
experienced a mobile app security incident last year
and 92% say threats are only increasing.
And the way attackers are going after apps
is pretty sophisticated.
They're reverse engineering them, modifying them
and redistributing fake versions through phishing campaigns,
side loading and even third party app stores.
So from a user's perspective,
everything can look completely legitimate.
That's why taking a proactive approach
to mobile app security really matters.
You wanna stay ahead of these threats,
not react after the damage is done.
This is where Guard Square comes in.
They provide advanced protection for both Android
and iOS apps, along with automated security testing
to catch vulnerabilities early
and real-time threat monitoring
so you can actually see what's happening out there.
If your mobile app is critical to your business,
and it probably is,
this is something worth paying attention to.
You can learn more at guardsquare.com.
That's guardsquare.com.
On the consumer side,
I'm gonna wade into a little bit of dangerous water here.
Make the podcast interesting.
Let's do it.
I recall a few, let me start it this way.
Why are they not putting as many things in place
as we would expect they might,
even though they've got the interest in the means,
they're not being required to
by any regulatory organization.
This takes us back to weeks or months ago
when we were talking about something
and the obvious question was,
why isn't there regulation?
I remember Kevin saying,
somebody tell me in a situation
where regulation actually saved money
or I can't remember the exact wording you used,
but this could be an inverse or a corollary of that
to say the guys didn't have the stuff in place,
partly because there was no regulation on it.
That's possible.
Can I throw a question at you?
Yeah.
What did they not have in place?
Well, they could have had procedures, right?
They could have had...
Why don't you think they have procedures?
Well, because there was,
who was there to authorize two threshold accounting levels
for payments or whatever happened?
So, and I'm not saying this is right.
I'm just, I'm throwing it out there is,
one, the whole model of crypto
is it's your money to transfer where you want to.
Right.
But the crypto exchanges, it happens there, right?
So somehow they do have potentially controls,
like you said.
I'm just...
I'm not saying...
I know this is dangerous place for me to go.
So I don't know enough about the story
and I'm just thinking one of the reasons
why crypto seems risky is it is not regulated.
And you're right, Kevin,
that technologically there may be no way to do it.
I'm not saying there's no way.
I'm saying I don't know any control
they didn't have in place that they should have.
And the reason I say that is,
okay, so one of the pros or cons,
depending on which side you're on of the problem
is that crypto is supposed to be able
to be as completely and totally anonymous, right?
So if it's completely and totally anonymous,
then we can't limit transfers
just because we don't know who's doing it.
Yeah, I mean, that's an idealistic way to look at it though, right?
Because...
No, no, but it's not an idealistic way.
It is the model of crypto,
is that it's supposed to be anonymous.
So do people not get tracked or traced
as they make transactions between exchanges?
That was the entire point of Bitcoin,
was that you were...
It was one of the points of Bitcoin,
is that you were supposed to be able
to make a purchase without...
I understand.
That's the ideal way,
but that's not really the way it happens
in a lot of cases.
It is the way it happens.
But otherwise, you wouldn't be able
to trace anything anywhere and recover any,
because a lot of times when you hear incidents,
you hear, oh, we got 30 or 40% of the time.
We got this much bad, whatever.
So there were some ways to actually track
what was going on.
No, no, no, it's not that you can't track the transaction.
It's that you can't track who did the transaction.
Until it reaches a place where there are footprints,
right, or there's evidence.
But that's why reversing the transaction
is possible even if the transaction was anonymous.
The transaction is still recorded, right?
So what I'm saying is my understanding
is that the technical controls
that could have stopped this were all in place.
And the business controls were all in place.
This is an example of somebody got access to a machine
and because they got access to the machine.
Now that...
I'm not saying that there absolutely should be
or could have been in the interest of trying to create
a robust system, maybe there's...
The way it was designed, that's true.
All I'm saying is from a consumer point of view,
if I want to invest in something
and risk is one of the things I want to minimize,
I think you...
Yeah, exactly, right?
Period, yeah, yeah.
It is risky.
Oh, yeah.
Right, but that's my point is I'm not disagreeing with you
that we can do something around regulation and things like that.
I personally don't believe regulation solves most things,
but fructo is an unregulated risky area on this.
I think that was the point of what I was trying to get to here.
So as a consumer, if you're worried about risk, don't do it.
Yeah, exactly.
Yeah, it's a risk acceptance, just like everything.
Whether you choose to invest in the stock market
versus cryptocurrency versus sports betting,
I mean, all kinds of things, right?
Like, they all become risk decisions.
Yeah, there is no help desk or customer service desk for the crypto.
And I think the biggest issue is that crypto is presented as not risky
by so many people who have a vetted interest
in making you put money in it, right?
Yeah.
Like, biased people will convince you there's no risk.
Oh, no, I mean, it's easy.
People who the risk doesn't really impact, right?
I mean, if you've got a billion dollars
and you put a hundred thousand in crypto,
it's not going to impact you if it gets...
Or by the people who are benefit by you investing, right?
If I can sell you crypto,
it doesn't matter if I have a billion or not,
I have a vested interest in convincing you it's not risky, right?
It's to me versus to say now.
Kevin O'Leary.
Yeah, yeah, exactly.
I'll tell you right now,
this is the same thing to me as the Mary Kay lady
who has thousands of dollars of inventory
that tries to convince their friend that it's an amazing way to do it, right?
Like...
Amway.
Oh, Amway.
Whatever the...
I always use Mary Kay because I have personal experience with...
Having done that, but all of them are the same way.
You have somebody, you know, and somebody who is living in a trailer park
tells you that the way to riches is by signing up for this thing.
There's nothing wrong with living in a trailer park,
but I'm going to assume that you don't have the riches.
And if you did, then you wouldn't do that.
And they're not even driving a pink Cadillac or whatever.
I know, how disappointing.
I was sad.
Yeah.
Well, interesting story nonetheless,
and I think we'll continue to see breaches with crypto.
This is a very, very hot target,
especially for nation states like North Korea and others.
But yeah, I think that, you know, lesson here,
I think for listeners is obviously be aware of what you invest in
and the risks associated with that for organizations.
It's do the best you can with the security controls
and procedures that you're putting in place
and look at your incident response process and detection
and, you know, all the things that the security basics
that we always talk about.
Yeah, especially when you can't prevent stuff.
Right.
So because I still go back to that four hour window,
right, money was leaving the company.
And then they finally were like, oh, something's going on here, guys.
We got to, you know, stop the transactions.
So, you know, there's probably things that Binance
is going to do better alerting, better whatever, right?
But again, instant results.
I hoped.
Yeah, right.
Exactly.
And then I think least privilege access,
all of the things that we talk about, right?
But like the other thing we talked about too
is that once you get access to a system
that has privileged access to code repositories
and other systems, it's pretty much game over.
Once lateral movement starts.
So it becomes a detection game at that point.
Yeah.
Interesting.
All right.
Well, I think that's all we have time for today.
I want to thank you both for joining me this week.
I want to thank everyone for listening.
And until next time, stay safe, stay secure, and stay private.
Thank you for listening or watching.
If you liked this episode, hit subscribe,
share it with your friends and colleagues,
or jump into our community at sharedsecurity.net
slash supporter to keep the conversation going.
Thanks again, and we'll see you next week
for another episode of Shared Security.