TRANSCRIPTION 🔗
1
00:00:00,000 --> 00:00:04,840
This hack, if no other hack has done it, this hack,
2
00:00:04,840 --> 00:00:07,880
should at least do something to stop the,
3
00:00:07,880 --> 00:00:10,460
well, if I just buy another tool,
4
00:00:10,460 --> 00:00:12,160
I'll be able to solve the problem.
5
00:00:12,160 --> 00:00:14,520
Ooh, picture this.
6
00:00:14,520 --> 00:00:17,000
You think you're doing a job interview,
7
00:00:17,000 --> 00:00:21,580
the coding exercise is not a test, but it's a trap.
8
00:00:21,580 --> 00:00:25,560
Binance says attackers used a fake recruiting process
9
00:00:25,560 --> 00:00:28,520
and malicious software to compromise engineers
10
00:00:28,600 --> 00:00:31,320
and then used a third engineer's computer
11
00:00:31,320 --> 00:00:36,320
in the report theft of roughly 6.3 billion in cryptocurrency.
12
00:00:37,080 --> 00:00:41,040
Now, this isn't just a crypto got hacked story.
13
00:00:41,040 --> 00:00:44,040
It's a nasty game of corporate dominoes,
14
00:00:44,040 --> 00:00:47,440
recruiter lure, infected laptop, trusted tools,
15
00:00:47,440 --> 00:00:49,880
powerful permissions and a transfer path
16
00:00:49,880 --> 00:00:51,960
that should have had a lot more breaks.
17
00:00:51,960 --> 00:00:55,120
Plus, the FBI has now attributed the theft
18
00:00:55,120 --> 00:00:57,160
to a North Korean hacking group.
19
00:00:57,200 --> 00:00:59,840
So today, we are going to discuss
20
00:00:59,840 --> 00:01:04,120
how does a fake interview become a billion dollar incident
21
00:01:04,120 --> 00:01:07,280
and what stops one compromised endpoint
22
00:01:07,280 --> 00:01:11,560
from turning into the biggest cryptocurrency breach to date?
23
00:01:11,560 --> 00:01:13,880
And joining me to discuss this topic
24
00:01:13,880 --> 00:01:17,600
are my co-hosts, Scott Wright and Kevin Tackett.
25
00:01:17,600 --> 00:01:18,640
Hello, gentlemen.
26
00:01:18,640 --> 00:01:19,920
Uh-oh, now we're gentlemen.
27
00:01:19,920 --> 00:01:24,920
Yes, you are the finest gentleman to ever be on a podcast.
28
00:01:25,040 --> 00:01:26,440
Yes, yes.
29
00:01:26,720 --> 00:01:29,480
I am the finest gentleman in these shoes.
30
00:01:29,480 --> 00:01:30,320
You're right.
31
00:01:30,320 --> 00:01:31,640
Right, right.
32
00:01:31,640 --> 00:01:34,240
Well, it's the funniest guy in these shoes.
33
00:01:34,240 --> 00:01:35,480
Yes.
34
00:01:35,480 --> 00:01:40,480
So largest cryptocurrency breach in history to date.
35
00:01:40,480 --> 00:01:41,320
It's not real money, right?
36
00:01:41,320 --> 00:01:43,320
So far, it's not real money.
37
00:01:43,320 --> 00:01:44,880
It's not real, so don't worry about it.
38
00:01:44,880 --> 00:01:45,720
It's not real.
39
00:01:45,720 --> 00:01:48,080
Yeah, yeah, no one invests in this stuff.
40
00:01:48,080 --> 00:01:49,560
No, no.
41
00:01:49,560 --> 00:01:50,520
This is one of those ones
42
00:01:50,520 --> 00:01:52,640
that I'm getting a little bit of a kick out of.
43
00:01:52,640 --> 00:01:53,480
Yeah.
44
00:01:53,480 --> 00:01:55,760
I don't mean that it's in, I'm enjoying it.
45
00:01:55,800 --> 00:01:56,640
Okay, yeah.
46
00:01:56,640 --> 00:01:57,720
Yeah, I don't mean it that way.
47
00:01:57,720 --> 00:02:01,400
I just like the sheer amount of noise around.
48
00:02:01,400 --> 00:02:02,440
Oh, a lot of noise.
49
00:02:02,440 --> 00:02:06,400
Like, look, expensive crypto, all cool buzzwords,
50
00:02:06,400 --> 00:02:07,400
everything else like that.
51
00:02:07,400 --> 00:02:09,840
But my understanding is, and correct me
52
00:02:09,840 --> 00:02:11,960
if I'm misunderstanding, my understanding is
53
00:02:11,960 --> 00:02:15,120
this is simply somebody's end point got hacked
54
00:02:15,120 --> 00:02:18,640
and somebody abused the access they had with that hack.
55
00:02:18,640 --> 00:02:22,480
There's nothing special about what happened here.
56
00:02:22,480 --> 00:02:26,520
And that to me is actually the really interesting part of this
57
00:02:26,520 --> 00:02:29,760
is that, yeah, really big damage, you know,
58
00:02:29,760 --> 00:02:32,240
all of that, all that's interesting.
59
00:02:32,240 --> 00:02:34,120
Definitely a company, like to me,
60
00:02:34,120 --> 00:02:36,520
this is where we go to definitely a company
61
00:02:36,520 --> 00:02:39,880
that if it was possible to secure all the things
62
00:02:39,880 --> 00:02:41,920
they could afford, right?
63
00:02:41,920 --> 00:02:42,760
Oh, yeah.
64
00:02:42,760 --> 00:02:44,480
I make the joke all the time
65
00:02:44,480 --> 00:02:47,080
when I'm on stage at conferences and stuff like that,
66
00:02:47,080 --> 00:02:48,560
like, hey, if you have an unlimited budget,
67
00:02:48,560 --> 00:02:49,920
stop by my booth.
68
00:02:49,960 --> 00:02:53,480
This company pretty much has an unlimited budget, right?
69
00:02:53,480 --> 00:02:54,280
It's like a bank.
70
00:02:54,280 --> 00:02:58,160
Yeah, but more so, right?
71
00:02:58,160 --> 00:03:01,840
Like, I mean, it's just math.
72
00:03:01,840 --> 00:03:05,560
They can math more, but what I want to,
73
00:03:05,560 --> 00:03:10,560
my point is this hack, if no other hack has done it,
74
00:03:10,560 --> 00:03:15,560
this hack should at least do something to stop the,
75
00:03:15,560 --> 00:03:18,120
well, if I just buy another tool,
76
00:03:18,120 --> 00:03:19,800
I'll be able to solve the problem.
77
00:03:20,680 --> 00:03:21,520
That's a good thing.
78
00:03:21,520 --> 00:03:22,360
Yeah.
79
00:03:22,360 --> 00:03:24,560
That's the point I wish more people were getting
80
00:03:24,560 --> 00:03:25,560
from this hack.
81
00:03:25,560 --> 00:03:29,200
Like, look, they had the controls,
82
00:03:29,200 --> 00:03:31,040
at least according to everything I've read.
83
00:03:31,040 --> 00:03:32,680
I mean, not a customer, right?
84
00:03:32,680 --> 00:03:34,280
I don't know anything about them.
85
00:03:34,280 --> 00:03:35,400
I'm not a customer of theirs.
86
00:03:35,400 --> 00:03:36,840
They're not a customer of mine.
87
00:03:36,840 -->
Load full transcript
00:03:39,920
I don't know a fraud except what I've read.
88
00:03:39,920 --> 00:03:41,920
And everything I've read says,
89
00:03:41,920 --> 00:03:44,920
here is a company that had the ability
90
00:03:44,920 --> 00:03:49,680
and the interest in doing all the right thing.
91
00:03:50,480 --> 00:03:52,440
And they still got popped.
92
00:03:52,440 --> 00:03:55,800
Maybe we could switch where we focus our attention
93
00:03:55,800 --> 00:03:56,920
on our own stuff.
94
00:03:56,920 --> 00:03:59,440
Well, it's also, I mean,
95
00:03:59,440 --> 00:04:03,120
this is going back to the interview,
96
00:04:03,120 --> 00:04:06,760
the North Korea fake interviews, right?
97
00:04:06,760 --> 00:04:08,680
Which have hit several companies.
98
00:04:08,680 --> 00:04:09,520
No before.
99
00:04:09,520 --> 00:04:11,800
Yeah, a lot of companies have been hit with this.
100
00:04:11,800 --> 00:04:15,040
And to your point, Kevin, like it's not,
101
00:04:15,040 --> 00:04:19,120
I mean, of course you get on a system of a developer,
102
00:04:19,120 --> 00:04:21,440
of course you're going to be able to replicate
103
00:04:21,440 --> 00:04:23,440
the settings of that developer
104
00:04:23,440 --> 00:04:25,720
and the access that that developer has,
105
00:04:25,720 --> 00:04:27,280
which is exactly what happened here.
106
00:04:27,280 --> 00:04:28,880
Of course they had access to the source code
107
00:04:28,880 --> 00:04:32,280
and coding repositories, that's what a developer does.
108
00:04:33,480 --> 00:04:36,280
The answer isn't, oh, remove the access.
109
00:04:36,280 --> 00:04:37,920
That developer needs that access.
110
00:04:37,920 --> 00:04:40,760
This is an actual business case
111
00:04:40,760 --> 00:04:45,240
where I think it's interesting that North Korea did this.
112
00:04:45,240 --> 00:04:47,920
If you're a crypto company
113
00:04:47,960 --> 00:04:52,360
and you don't realize nation states are coming after you,
114
00:04:52,360 --> 00:04:55,360
you probably aren't that good of a crypto companies.
115
00:04:55,360 --> 00:04:59,360
Yeah, I hope I don't have high hopes.
116
00:04:59,360 --> 00:05:01,880
I would not put, what is it?
117
00:05:01,880 --> 00:05:03,200
Polymarket money.
118
00:05:03,200 --> 00:05:04,040
Oh gosh.
119
00:05:06,040 --> 00:05:08,320
No, but this is one of those cases
120
00:05:08,320 --> 00:05:10,960
where I hope that people just look at it and go,
121
00:05:10,960 --> 00:05:14,280
damn, maybe we should be thinking about,
122
00:05:15,160 --> 00:05:18,480
how do we, how do we evaluate access?
123
00:05:18,480 --> 00:05:22,040
How do we evaluate what is okay and what isn't okay?
124
00:05:22,040 --> 00:05:25,640
How do we monitor for the inbound stuff, right?
125
00:05:25,640 --> 00:05:27,720
What was it, Gatelik?
126
00:05:27,720 --> 00:05:31,600
That, he did the egress detection was his book.
127
00:05:31,600 --> 00:05:32,720
Yeah.
128
00:05:32,720 --> 00:05:36,240
Right, or 20 years ago or something like that, right?
129
00:05:36,240 --> 00:05:38,600
The idea was good, right?
130
00:05:38,600 --> 00:05:40,880
Like, hey, we know they're gonna get in.
131
00:05:42,080 --> 00:05:43,560
Like, we don't like it.
132
00:05:43,560 --> 00:05:47,640
We'll do everything we can to stop them from being in, right?
133
00:05:47,640 --> 00:05:49,400
But if we work from the assumption
134
00:05:49,400 --> 00:05:52,280
that we know they'll get in ultimately,
135
00:05:52,280 --> 00:05:54,800
how do we reduce the damage they can do?
136
00:05:54,800 --> 00:05:56,520
Detection and response, yeah.
137
00:05:56,520 --> 00:05:57,600
Right, incident response.
138
00:05:57,600 --> 00:05:59,920
This is where this goes back to because, yeah,
139
00:05:59,920 --> 00:06:02,720
we can't stop the fake job interview,
140
00:06:02,720 --> 00:06:05,320
the malicious software downloads,
141
00:06:05,320 --> 00:06:07,440
like that's all going to happen.
142
00:06:07,440 --> 00:06:08,800
I mean, these are the attack vectors
143
00:06:08,800 --> 00:06:10,880
that are being leveraged.
144
00:06:10,880 --> 00:06:13,240
But I think the one thing to call out in this incident
145
00:06:13,240 --> 00:06:17,720
is that there was a four-hour response window.
146
00:06:17,720 --> 00:06:22,280
So there was a period of time that detection
147
00:06:22,280 --> 00:06:26,280
and other things were probably starting to happen,
148
00:06:26,280 --> 00:06:29,560
but it took them four hours to basically shut this down.
149
00:06:29,560 --> 00:06:31,600
And four hours is a long time.
150
00:06:32,560 --> 00:06:33,400
I mean.
151
00:06:34,280 --> 00:06:36,640
Yeah, anybody who's ridden in a car
152
00:06:36,640 --> 00:06:39,140
for four hours with toddlers knows that.
153
00:06:40,240 --> 00:06:41,080
Yeah, right.
154
00:06:41,960 --> 00:06:44,560
But I think that is,
155
00:06:44,560 --> 00:06:46,160
it's like what we always talk about, right?
156
00:06:46,160 --> 00:06:48,720
Eventually, an organization is going to get hacked.
157
00:06:48,720 --> 00:06:52,000
It's just a matter of when, right?
158
00:06:52,000 --> 00:06:54,000
And it's how we prepare
159
00:06:54,000 --> 00:06:56,440
and how we handle incident response.
160
00:06:56,440 --> 00:06:59,440
And in this case, I'm glad that they were transparent
161
00:06:59,440 --> 00:07:02,240
about the process, like what happened,
162
00:07:02,240 --> 00:07:04,880
and that's why the community right now
163
00:07:04,880 --> 00:07:06,040
is talking about this.
164
00:07:06,040 --> 00:07:07,680
But the fact that, of course,
165
00:07:07,680 --> 00:07:09,120
they're going after cryptocurrency
166
00:07:09,160 --> 00:07:12,160
because you can make transactions very quickly
167
00:07:12,160 --> 00:07:15,400
and then the traceability piece debatable
168
00:07:15,400 --> 00:07:17,840
through the blockchain or what have you, right?
169
00:07:17,840 --> 00:07:19,480
And the reason I think North Korea
170
00:07:19,480 --> 00:07:22,040
is targeting cryptocurrency organizations
171
00:07:22,040 --> 00:07:23,360
and companies like Binance
172
00:07:23,360 --> 00:07:25,920
is because this is how they're funding their government.
173
00:07:25,920 --> 00:07:29,680
Like I read an article about this of how,
174
00:07:29,680 --> 00:07:33,840
well, why is North Korea so good at hacking right now?
175
00:07:33,840 --> 00:07:36,680
And it's because this is how they are funding
176
00:07:36,680 --> 00:07:38,640
their government from, you know,
177
00:07:38,640 --> 00:07:40,840
like they have no other means of making money.
178
00:07:40,840 --> 00:07:42,160
So do it this way, right?
179
00:07:42,160 --> 00:07:44,880
And crypto has always been presented
180
00:07:44,880 --> 00:07:48,280
as an unstoppable money, right?
181
00:07:48,280 --> 00:07:50,360
Like if I grab it, it's mine.
182
00:07:50,360 --> 00:07:51,920
You can't not be proud.
183
00:07:51,920 --> 00:07:54,760
Now, obviously systems have been put in place
184
00:07:54,760 --> 00:07:56,680
and yeah, now what have you, but...
185
00:07:56,680 --> 00:07:58,640
So one question I have though,
186
00:07:58,640 --> 00:07:59,840
I'm interested in your take,
187
00:07:59,840 --> 00:08:02,120
but I didn't see anywhere where now
188
00:08:02,120 --> 00:08:05,880
this job interview where the developers at Binance,
189
00:08:05,880 --> 00:08:09,000
were they interviewing like a candidate?
190
00:08:09,000 --> 00:08:10,080
I don't think they were, right?
191
00:08:10,080 --> 00:08:12,360
Because they were actually interviewing themselves
192
00:08:12,360 --> 00:08:17,360
because they were asked to download essentially code
193
00:08:17,440 --> 00:08:19,120
a package to look at.
194
00:08:19,120 --> 00:08:22,040
But then there was an advertisement
195
00:08:22,040 --> 00:08:27,040
that was basically the malware delivery piece.
196
00:08:27,400 --> 00:08:29,360
And then the source code I'm assuming
197
00:08:29,360 --> 00:08:31,640
or the code whatever ran, you know,
198
00:08:31,640 --> 00:08:34,720
that the exercise that they had to do
199
00:08:34,720 --> 00:08:39,040
initiated the attack and created that C2 channel.
200
00:08:39,040 --> 00:08:41,040
That's how I'm kind of...
201
00:08:41,040 --> 00:08:41,880
But though I understand it.
202
00:08:41,880 --> 00:08:44,080
The way I imagine it when you said
203
00:08:44,080 --> 00:08:47,760
that the company wasn't advertising for jobs,
204
00:08:47,760 --> 00:08:50,340
it would have likely been, I think, the other way around.
205
00:08:50,340 --> 00:08:53,280
One of the engineers might have been looking for a job.
206
00:08:53,280 --> 00:08:54,600
That's what I'm thinking, yeah.
207
00:08:54,600 --> 00:08:57,960
And somebody, he saw an ad exactly like you said.
208
00:08:57,960 --> 00:09:01,360
And they were using their Binance work computer.
209
00:09:01,360 --> 00:09:02,600
Yes, yeah.
210
00:09:02,600 --> 00:09:04,000
Which is a big no-no.
211
00:09:04,640 --> 00:09:06,040
But never have it.
212
00:09:06,040 --> 00:09:07,960
Yeah, I mean,
it's, yes,
213
00:09:07,960 --> 00:09:09,520
I'm sure this happens all the time,
214
00:09:09,520 --> 00:09:11,880
but if you're interviewing for a job,
215
00:09:11,880 --> 00:09:14,080
I mean, I guess this gets back to
216
00:09:14,080 --> 00:09:17,800
personal versus business, right?
217
00:09:17,800 --> 00:09:21,960
And we've talked about why you should have
218
00:09:21,960 --> 00:09:23,800
a personal device for personal things
219
00:09:23,800 --> 00:09:27,760
and it's not the best idea to do your personal work
220
00:09:27,760 --> 00:09:28,780
on your work laptop,
221
00:09:28,780 --> 00:09:31,160
even though it happens all the time.
222
00:09:31,160 --> 00:09:33,520
And yeah, yeah, of course.
223
00:09:34,080 --> 00:09:36,960
But it's how, you know,
224
00:09:36,960 --> 00:09:39,680
if you're interviewing and you're running code
225
00:09:39,680 --> 00:09:43,760
on your work computer, I don't know.
226
00:09:43,760 --> 00:09:46,660
Mobile apps are just part of everyday life now.
227
00:09:46,660 --> 00:09:49,860
Banking, healthcare, shopping, entertainment, you name it.
228
00:09:49,860 --> 00:09:52,360
And with that comes a lot of trust
229
00:09:52,360 --> 00:09:54,540
because users are putting their personal data
230
00:09:54,540 --> 00:09:56,600
directly into your app.
231
00:09:56,600 --> 00:09:57,720
But here's the reality.
232
00:09:57,720 --> 00:09:59,920
Mobile apps are a growing target.
233
00:09:59,920 --> 00:10:03,100
A recent survey found that 72% of organizations
234
00:10:03,100 --> 00:10:06,700
experienced a mobile app security incident last year
235
00:10:06,700 --> 00:10:10,420
and 92% say threats are only increasing.
236
00:10:10,420 --> 00:10:12,420
And the way attackers are going after apps
237
00:10:12,420 --> 00:10:14,000
is pretty sophisticated.
238
00:10:14,000 --> 00:10:16,780
They're reverse engineering them, modifying them
239
00:10:16,780 --> 00:10:20,260
and redistributing fake versions through phishing campaigns,
240
00:10:20,260 --> 00:10:23,660
side loading and even third party app stores.
241
00:10:23,660 --> 00:10:25,580
So from a user's perspective,
242
00:10:25,580 --> 00:10:28,300
everything can look completely legitimate.
243
00:10:28,300 --> 00:10:30,000
That's why taking a proactive approach
244
00:10:30,000 --> 00:10:32,460
to mobile app security really matters.
245
00:10:32,460 --> 00:10:34,020
You wanna stay ahead of these threats,
246
00:10:34,020 --> 00:10:36,740
not react after the damage is done.
247
00:10:36,740 --> 00:10:38,700
This is where Guard Square comes in.
248
00:10:38,700 --> 00:10:41,180
They provide advanced protection for both Android
249
00:10:41,180 --> 00:10:44,740
and iOS apps, along with automated security testing
250
00:10:44,740 --> 00:10:47,060
to catch vulnerabilities early
251
00:10:47,060 --> 00:10:48,980
and real-time threat monitoring
252
00:10:48,980 --> 00:10:51,620
so you can actually see what's happening out there.
253
00:10:51,620 --> 00:10:54,060
If your mobile app is critical to your business,
254
00:10:54,060 --> 00:10:55,620
and it probably is,
255
00:10:55,620 --> 00:10:58,020
this is something worth paying attention to.
256
00:10:58,020 --> 00:11:00,860
You can learn more at guardsquare.com.
257
00:11:00,860 --> 00:11:05,080
That's guardsquare.com.
258
00:11:05,080 --> 00:11:06,600
On the consumer side,
259
00:11:06,600 --> 00:11:09,800
I'm gonna wade into a little bit of dangerous water here.
260
00:11:09,800 --> 00:11:11,680
Make the podcast interesting.
261
00:11:11,680 --> 00:11:12,520
Let's do it.
262
00:11:12,520 --> 00:11:15,800
I recall a few, let me start it this way.
263
00:11:16,640 --> 00:11:20,720
Why are they not putting as many things in place
264
00:11:20,720 --> 00:11:22,240
as we would expect they might,
265
00:11:22,240 --> 00:11:24,840
even though they've got the interest in the means,
266
00:11:24,840 --> 00:11:27,160
they're not being required to
267
00:11:27,160 --> 00:11:30,480
by any regulatory organization.
268
00:11:30,600 --> 00:11:33,600
This takes us back to weeks or months ago
269
00:11:33,600 --> 00:11:35,080
when we were talking about something
270
00:11:35,080 --> 00:11:36,760
and the obvious question was,
271
00:11:36,760 --> 00:11:38,960
why isn't there regulation?
272
00:11:38,960 --> 00:11:40,600
I remember Kevin saying,
273
00:11:40,600 --> 00:11:42,640
somebody tell me in a situation
274
00:11:42,640 --> 00:11:46,080
where regulation actually saved money
275
00:11:46,080 --> 00:11:48,880
or I can't remember the exact wording you used,
276
00:11:48,880 --> 00:11:52,600
but this could be an inverse or a corollary of that
277
00:11:52,600 --> 00:11:55,920
to say the guys didn't have the stuff in place,
278
00:11:55,920 --> 00:12:00,080
partly because there was no regulation on it.
279
00:12:00,760 --> 00:12:02,480
That's possible.
280
00:12:02,480 --> 00:12:03,600
Can I throw a question at you?
281
00:12:03,600 --> 00:12:04,640
Yeah.
282
00:12:04,640 --> 00:12:06,000
What did they not have in place?
283
00:12:06,000 --> 00:12:07,640
Well, they could have had procedures, right?
284
00:12:07,640 --> 00:12:09,600
They could have had...
285
00:12:09,600 --> 00:12:11,920
Why don't you think they have procedures?
286
00:12:11,920 --> 00:12:13,520
Well, because there was,
287
00:12:13,520 --> 00:12:18,520
who was there to authorize two threshold accounting levels
288
00:12:19,360 --> 00:12:23,120
for payments or whatever happened?
289
00:12:23,120 --> 00:12:25,120
So, and I'm not saying this is right.
290
00:12:25,120 --> 00:12:27,240
I'm just, I'm throwing it out there is,
291
00:12:27,280 --> 00:12:31,600
one, the whole model of crypto
292
00:12:31,600 --> 00:12:33,840
is it's your money to transfer where you want to.
293
00:12:33,840 --> 00:12:34,680
Right.
294
00:12:34,680 --> 00:12:36,960
But the crypto exchanges, it happens there, right?
295
00:12:36,960 --> 00:12:39,880
So somehow they do have potentially controls,
296
00:12:39,880 --> 00:12:40,720
like
you said.
297
00:12:40,720 --> 00:12:41,560
I'm just...
298
00:12:41,560 --> 00:12:42,400
I'm not saying...
299
00:12:42,400 --> 00:12:44,320
I know this is dangerous place for me to go.
300
00:12:44,320 --> 00:12:46,160
So I don't know enough about the story
301
00:12:46,160 --> 00:12:48,480
and I'm just thinking one of the reasons
302
00:12:48,480 --> 00:12:51,560
why crypto seems risky is it is not regulated.
303
00:12:51,560 --> 00:12:52,720
And you're right, Kevin,
304
00:12:52,720 --> 00:12:56,040
that technologically there may be no way to do it.
305
00:12:56,040 --> 00:12:57,400
I'm not saying there's no way.
306
00:12:57,400 --> 00:13:00,520
I'm saying I don't know any control
307
00:13:00,520 --> 00:13:02,920
they didn't have in place that they should have.
308
00:13:02,920 --> 00:13:04,680
And the reason I say that is,
309
00:13:04,680 --> 00:13:08,880
okay, so one of the pros or cons,
310
00:13:08,880 --> 00:13:12,760
depending on which side you're on of the problem
311
00:13:12,760 --> 00:13:14,800
is that crypto is supposed to be able
312
00:13:14,800 --> 00:13:19,640
to be as completely and totally anonymous, right?
313
00:13:19,640 --> 00:13:22,060
So if it's completely and totally anonymous,
314
00:13:22,060 --> 00:13:25,040
then we can't limit transfers
315
00:13:25,040 --> 00:13:26,200
just because we don't know who's doing it.
316
00:13:26,200 --> 00:13:28,520
Yeah, I mean, that's an idealistic way to look at it though, right?
317
00:13:28,520 --> 00:13:29,360
Because...
318
00:13:29,360 --> 00:13:31,520
No, no, but it's not an idealistic way.
319
00:13:31,520 --> 00:13:34,080
It is the model of crypto,
320
00:13:34,080 --> 00:13:36,400
is that it's supposed to be anonymous.
321
00:13:36,400 --> 00:13:38,800
So do people not get tracked or traced
322
00:13:38,800 --> 00:13:41,560
as they make transactions between exchanges?
323
00:13:41,560 --> 00:13:43,320
That was the entire point of Bitcoin,
324
00:13:43,320 --> 00:13:44,320
was that you were...
325
00:13:44,320 --> 00:13:46,400
It was one of the points of Bitcoin,
326
00:13:46,400 --> 00:13:48,040
is that you were supposed to be able
327
00:13:48,040 --> 00:13:50,640
to make a purchase without...
328
00:13:50,640 --> 00:13:51,480
I understand.
329
00:13:51,480 --> 00:13:52,320
That's the ideal way,
330
00:13:52,320 --> 00:13:54,000
but that's not really the way it happens
331
00:13:54,000 --> 00:13:54,840
in a lot of cases.
332
00:13:54,840 --> 00:13:55,800
It is the way it happens.
333
00:13:55,800 --> 00:13:57,200
But otherwise, you wouldn't be able
334
00:13:57,200 --> 00:13:59,160
to trace anything anywhere and recover any,
335
00:13:59,160 --> 00:14:02,080
because a lot of times when you hear incidents,
336
00:14:02,080 --> 00:14:04,600
you hear, oh, we got 30 or 40% of the time.
337
00:14:04,600 --> 00:14:06,200
We got this much bad, whatever.
338
00:14:06,200 --> 00:14:09,200
So there were some ways to actually track
339
00:14:09,200 --> 00:14:10,480
what was going
on.
340
00:14:10,480 --> 00:14:13,680
No, no, no, it's not that you can't track the transaction.
341
00:14:13,680 --> 00:14:17,320
It's that you can't track who did the transaction.
342
00:14:17,320 --> 00:14:20,760
Until it reaches a place where there are footprints,
343
00:14:20,760 --> 00:14:22,680
right, or there's evidence.
344
00:14:22,680 --> 00:14:24,640
But that's why reversing the transaction
345
00:14:24,640 --> 00:14:27,440
is possible even if the transaction was anonymous.
346
00:14:27,440 --> 00:14:30,640
The transaction is still recorded, right?
347
00:14:30,640 --> 00:14:35,040
So what I'm saying is my understanding
348
00:14:35,040 --> 00:14:37,120
is that the technical controls
349
00:14:37,120 --> 00:14:40,160
that could have stopped this were all in place.
350
00:14:40,160 --> 00:14:44,720
And the business controls were all in place.
351
00:14:44,720 --> 00:14:48,960
This is an example of somebody got access to a machine
352
00:14:48,960 --> 00:14:50,760
and because they got access to the machine.
353
00:14:50,760 --> 00:14:51,760
Now that...
354
00:14:51,760 --> 00:14:54,080
I'm not saying that there absolutely should be
355
00:14:54,160 --> 00:14:58,080
or could have been in the interest of trying to create
356
00:14:58,080 --> 00:15:01,440
a robust system, maybe there's...
357
00:15:01,440 --> 00:15:03,040
The way it was designed, that's true.
358
00:15:03,040 --> 00:15:05,600
All I'm saying is from a consumer point of view,
359
00:15:05,600 --> 00:15:07,120
if I want to invest in something
360
00:15:08,160 --> 00:15:11,360
and risk is one of the things I want to minimize,
361
00:15:12,320 --> 00:15:13,600
I think you...
362
00:15:13,600 --> 00:15:14,960
Yeah, exactly, right?
363
00:15:14,960 --> 00:15:16,160
Period, yeah, yeah.
364
00:15:16,160 --> 00:15:17,520
It is risky.
365
00:15:17,520 --> 00:15:18,000
Oh, yeah.
366
00:15:18,000 --> 00:15:23,360
Right, but that's my point is I'm not disagreeing with you
367
00:15:23,440 --> 00:15:27,040
that we can do something around regulation and things like that.
368
00:15:27,040 --> 00:15:30,240
I personally don't believe regulation solves most things,
369
00:15:30,240 --> 00:15:35,760
but fructo is an unregulated risky area on this.
370
00:15:35,760 --> 00:15:37,920
I think that was the point of what I was trying to get to here.
371
00:15:39,920 --> 00:15:43,120
So as a consumer, if you're worried about risk, don't do it.
372
00:15:43,120 --> 00:15:43,920
Yeah, exactly.
373
00:15:43,920 --> 00:15:47,760
Yeah, it's a risk acceptance, just like everything.
374
00:15:47,760 --> 00:15:50,240
Whether you choose to invest in the stock market
375
00:15:50,320 --> 00:15:55,200
versus cryptocurrency versus sports betting,
376
00:15:55,200 --> 00:15:56,880
I mean, all kinds of things, right?
377
00:15:56,880 --> 00:15:58,880
Like, they all become risk decisions.
378
00:15:58,880 --> 00:16:02,880
Yeah, there is no help desk or customer service desk for the crypto.
379
00:16:02,880 --> 00:16:07,600
And I think the biggest issue is that crypto is presented as not risky
380
00:16:07,600 --> 00:16:11,680
by so many people who have a vetted interest
381
00:16:11,680 --> 00:16:13,920
in making you put money in it, right?
382
00:16:13,920 --> 00:16:14,560
Yeah.
383
00:16:14,560 --> 00:16:18,080
Like, biased people will convince you there's no risk.
384
00:16:18,160 --> 00:16:20,480
Oh, no, I mean, it's easy.
385
00:16:20,480 --> 00:16:22,720
People who the risk doesn't really impact, right?
386
00:16:22,720 --> 00:16:24,800
I mean, if you've got a billion dollars
387
00:16:24,800 --> 00:16:26,960
and you put a hundred thousand in crypto,
388
00:16:26,960 --> 00:16:28,400
it's not going to impact you if it gets...
389
00:16:28,400 --> 00:16:32,400
Or by the people who are benefit by you investing, right?
390
00:16:32,400 --> 00:16:34,720
If I can sell you crypto,
391
00:16:34,720 --> 00:16:36,400
it doesn't matter if I have a billion or not,
392
00:16:37,280 --> 00:16:40,720
I have a vested interest in convincing you it's not risky, right?
393
00:16:40,720 --> 00:16:42,720
It's to me versus to say now.
394
00:16:42,720 --> 00:16:43,360
Kevin O'Leary.
395
00:16:44,480 --> 00:16:46,080
Yeah, yeah, exactly.
396
00:16:46,080 --> 00:16:47,120
I'll tell you right now,
397
00:16:47,120 --> 00:16:54,160
this is the same thing to me as the Mary Kay lady
398
00:16:54,160 --> 00:16:56,880
who has thousands of dollars of inventory
399
00:16:56,880 --> 00:17:00,720
that tries to convince their friend that it's an amazing way to do it, right?
400
00:17:00,720 --> 00:17:01,040
Like...
401
00:17:01,040 --> 00:17:01,440
Amway.
402
00:17:01,440 --> 00:17:03,200
Oh, Amway.
403
00:17:05,520 --> 00:17:06,080
Whatever the...
404
00:17:07,040 --> 00:17:10,560
I always use Mary Kay because I have personal experience with...
405
00:17:11,200 --> 00:17:15,200
Having done that, but all of them are the same way.
406
00:17:15,200 --> 00:17:19,280
You have somebody, you know, and somebody who is living in a trailer park
407
00:17:19,280 --> 00:17:23,120
tells you that the way to riches is by signing up for this thing.
408
00:17:23,120 --> 00:17:25,440
There's nothing wrong with living in a trailer park,
409
00:17:26,480 --> 00:17:29,440
but I'm going to assume that you don't have the riches.
410
00:17:30,240 --> 00:17:33,520
And if you did, then you wouldn't do that.
411
00:17:33,520 --> 00:17:35,600
And they're not even driving a pink Cadillac or whatever.
412
00:17:35,600 --> 00:17:37,280
I know, how disappointing.
413
00:17:38,880 --> 00:17:39,920
I was sad.
414
00:17:39,920 --> 00:17:40,480
Yeah.
415
00:17:40,480 --> 00:17:42,880
Well, interesting story nonetheless,
416
00:17:42,880 --> 00:17:46,960
and I think we'll continue to see breaches with crypto.
417
00:17:47,760 --> 00:17:50,240
This is a very, very hot target,
418
00:17:50,240 --> 00:17:54,080
especially for nation states like North Korea and others.
419
00:17:54,080 --> 00:17:57,120
But yeah, I
think that, you know, lesson here,
420
00:17:57,120 --> 00:18:01,200
I think for listeners is obviously be aware of what you invest in
421
00:18:01,200 --> 00:18:04,240
and the risks associated with that for organizations.
422
00:18:04,240 --> 00:18:07,280
It's do the best you can with the security controls
423
00:18:07,280 --> 00:18:09,360
and procedures that you're putting in place
424
00:18:09,360 --> 00:18:13,520
and look at your incident response process and detection
425
00:18:13,520 --> 00:18:16,400
and, you know, all the things that the security basics
426
00:18:16,400 --> 00:18:16,800
that we always talk about.
427
00:18:16,800 --> 00:18:18,320
Yeah, especially when you can't prevent stuff.
428
00:18:18,960 --> 00:18:19,280
Right.
429
00:18:19,280 --> 00:18:21,600
So because I still go back to that four hour window,
430
00:18:22,160 --> 00:18:24,000
right, money was leaving the company.
431
00:18:24,560 --> 00:18:28,320
And then they finally were like, oh, something's going on here, guys.
432
00:18:28,320 --> 00:18:30,640
We got to, you know, stop the transactions.
433
00:18:31,200 --> 00:18:33,440
So, you know, there's probably things that Binance
434
00:18:33,440 --> 00:18:36,080
is going to do better alerting, better whatever, right?
435
00:18:36,080 --> 00:18:37,440
But again, instant results.
436
00:18:37,440 --> 00:18:38,480
I hoped.
437
00:18:38,480 --> 00:18:39,360
Yeah, right.
438
00:18:39,360 --> 00:18:40,240
Exactly.
439
00:18:40,240 --> 00:18:42,640
And then I think least privilege access,
440
00:18:42,640 --> 00:18:44,880
all of the things that we talk about, right?
441
00:18:44,880 --> 00:18:46,640
But like the other thing we talked about too
442
00:18:46,640 --> 00:18:49,120
is that once you get access to a system
443
00:18:49,120 --> 00:18:52,880
that has privileged access to code repositories
444
00:18:52,880 --> 00:18:55,200
and other systems, it's pretty much game over.
445
00:18:55,200 --> 00:18:56,720
Once lateral movement starts.
446
00:18:56,720 --> 00:18:59,920
So it becomes a detection game at that point.
447
00:18:59,920 --> 00:19:00,400
Yeah.
448
00:19:00,400 --> 00:19:01,280
Interesting.
449
00:19:01,280 --> 00:19:02,160
All right.
450
00:19:02,160 --> 00:19:04,800
Well, I think that's all we have time for today.
451
00:19:05,440 --> 00:19:09,840
I want to thank you both for joining me this week.
452
00:19:09,840 --> 00:19:11,680
I want to thank everyone for listening.
453
00:19:11,680 --> 00:19:16,160
And until next time, stay safe, stay secure, and stay private.
454
00:19:16,160 --> 00:19:17,840
Thank you for listening or watching.
455
00:19:17,840 --> 00:19:20,720
If you liked this episode, hit subscribe,
456
00:19:20,720 --> 00:19:22,480
share it with your friends and colleagues,
457
00:19:22,480 --> 00:19:25,840
or jump into our community at sharedsecurity.net
458
00:19:25,840 --> 00:19:28,560
slash supporter to keep the conversation going.
459
00:19:28,560 --> 00:19:30,720
Thanks again, and we'll see you next week
460
00:19:30,720 --> 00:19:33,280
for another episode of Shared Security.