Please create an account to participate in the Slashdot moderation system

 


Forgot your password?
Close
typodupeerror
×
Security

In a Remarkable Turn of Events, Hackers -- Not Users -- Lost Money in Attempted Cryptocurrency Exchange Heist (bleepingcomputer.com) 56

Posted by msmash from the check-mate dept.
The hackers who attempted to hack Binance, one of the largest cryptocurrency exchanges on the Internet, have ended up losing money in a remarkable turn of events. It all began on Thursday, when thousands of user accounts started selling their Bitcoin and buying an altcoin named Viacoin (VIA). The incident, BleepingComputer reports, looked like a hack, and users reacted accordingly. But this wasn't a hack, or at least not your ordinary hack. The report adds: According to an incident report published by the Binance team, in preparation for yesterday's attack, the hackers ran a two-month phishing scheme to collect Binance user account credentials. Hackers used a homograph attack by registering a domain identical to binance.com, but spelled with Latin-lookalike Unicode characters. More particularly, hackers registered the [redacted].com domain -- notice the tiny dots under the "i" and "a" characters.

Phishing attacks started in early January, but the Binance team says it detected evidence that operations ramped up around February 22, when the campaign reached its peak. Binance tracked down this phishing campaign because the phishing pages would immediately redirect phished users to the real Binance login page. This left a forensic trail in referral logs that Binance developers detected. After getting access to several accounts, instead of using the login credentials to empty out wallets, hackers created "trading API keys" for each account. With the API keys in hand, hackers sprung their main attack yesterday. Crooks used the API keys to automate transactions that sold Bitcoin held in compromised Binance accounts and automatically bought Viacoin from 31 other Binance accounts that hackers created beforehand, and where they deposited Viacoin, ready to be bought. But hackers didn't know one thing -- Binance's secret weapon -- an internal risk management system that detected the abnormal amount of Bitcoin-Viacoin sale orders within the span of two minutes and blocked all transactions on the platform. Hackers tried to cash out the 31 Binance accounts, but by that point, Binance had blocked all withdrawals.
This discussion has been archived. No new comments can be posted.

In a Remarkable Turn of Events, Hackers -- Not Users -- Lost Money in Attempted Cryptocurrency Exchange Heist More

In a Remarkable Turn of Events, Hackers -- Not Users -- Lost Money in Attempted Cryptocurrency Exchange Heist

Comments Filter:

  • So, it is kind of a Unicode hack?

    Unicode wasn't allowed initially in domain names if I recall correctly.

    • Re: (Score:3)

      by mysidia ( 191772 )

      PUNYCODE. Which was INITIALLY only allowed under Non-Latin Country Code TLDs.

      If you think about it.... it makes no sense to have (NON-LATIN BLOB).com or (NON-LATIN BLOB).net

      I'm not sure exactly who is to blame for PunyCode suddenly being enabled under additional Latin TLDs such as .COM,
      but I suspect it is either ICANN or Verisign we should blame for this stupid shit, And of course.... the browser makers such as Google and Firefox had to be complicit in changing from the original defaults whi

      • Re:Unicode hack? (Score:5, Interesting)

        by Train0987 ( 1059246 ) on Friday March 09, 2018 @02:55PM (#56235077)

        They allow it for the same reason we have 100 new TLD's. Profits. Now there are many new variant domains that a company must register in order to avoid squatters.

        • Re:Unicode hack? (Score:5, Interesting)

          by Tom ( 822 ) on Friday March 09, 2018 @03:40PM (#56235263) Homepage Journal

          They would never do such a thing! The new TLDs are all for the purpose of users and convenience and helpful to Internet users. That is why we got .aero as one of the first ones...

          The real sad part is that nobody stopped them. The good part is that the new TLDs are largely ignored. There was a short period where you would see people advertising their .biz addresses, then it stopped and went back to normal.

          So the world was telling ICANN to go and fuck themselves. Allowing Unicode and the entire attacks possible with it was their spiteful revenge.

          • Well, you can reach me via email at firstname.lastname@comsoft.aero ... I like that email address. The job is cool, too.

          • The good part is that the new TLDs are largely ignored

            Not by everyone. Some of us actively block them.

      • Re:Unicode hack? (Score:4, Informative)

        by tattood ( 855883 ) on Friday March 09, 2018 @03:45PM (#56235285)

        And of course.... the browser makers such as Google and Firefox had to be complicit in changing from the original defaults which was to Refuse to interpret Punycode under Latin TLDs.

        Brian Krebs wrote punycode yesterday [krebsonsecurity.com]. Chrome and Microsoft Edge and IE will not display the punycode, but rather the ascii representation of it. Firefox does show the punycode by default, but you can change it in settings.

        • Wrong on all counts. Krebs wrote *about* the method yesterday, but Punycode is far older: https://tools.ietf.org/html/rf... [ietf.org] (A. Costello, March 2003).

          Furthermore, you have it exactly backward: Chrome/IE/Edge DO display the non-Latin URL as Punycode (that is, rendered into normal ASCII gibberish). Firefox just displays it straight.

      • Re:Unicode hack? - English only Please! (Score:4, Informative)

        by anon mouse-cow-aard ( 443646 ) on Friday March 09, 2018 @03:49PM (#56235299) Journal
        I bet you only speak English. For people who speak other languages, Unicode is rather useful. Yes, different languages use different character sets that can resemble each other. Yes, people can be fooled, but security doesnt trump the ability to have natural looking URLs in the native languages of most of the planet. télétoon.com (doesnt work) is much more natural than teletoon.com to a French speaker. At least vidéotron.com works (it gets rewritten to canonical videotron.com) There are plenty of legitimate uses for that feature. Add to that that most western european language speakers are completely used to accented characters, so usually the only ones likely to be fooled are the English only speakers. So you want to limit the web to English DNS entries because English speaking people dont notice accented characters. Sorry, world wont comply.

        • Which is precisely why the GP suggested restricting website character sets by TLD. If you want to have télétoon as your website address, make it télétoon.fr (or télétoon.com.fr), not télétoon.com, as .com is (in practice) a US-centric TLD. This isn't hard and it isn't discriminatory, but the registrars a) want to blackmail website owners into registering more addresses, b) don't give two shits about security, and to top it off c) like virtue-signaling about how open a

          • The companies given above are in North America, not .fr, and use of .com for commercial enterprises is pretty universal in Canada, and a lot of their clients are English speaking. Also, there is McGill.edu .net, .org, and dw.com (which is German.) There are many many non-us uses of these domains, and that suited people well for a long time. Like it or not. .com is not American. .com means a business, and is generally used as a multi-national domain, not U.S. specific. Endless examples: seat.com (Spanish

      • Re: (Score:3)

        by amorsen ( 7485 )

        The silly thing is that punycode solves exactly zero problems that simply making whitelists of utf-8 characters in domains would not have solved equally well, and every problem caused by whitelisted utf-8 characters also plagues punycode. Plus of course punycode adds its own set of problems.

    • Redacted? (Score:4, Funny)

      by bigwheel ( 2238516 ) on Friday March 09, 2018 @02:55PM (#56235075)

      Good thing TFS redacted the domain name. Now a person has to read TFA to see the text, and we know that will never happen.

  • What the other cryptocurrency? (Score:1)

    by Anonymous Coward

    How is the 2LipBulb cryptocurrency? Folks in the Netherlands swear by it.

  • Browser alert on Unicode urls (Score:3)

    by enriquevagu ( 1026480 ) on Friday March 09, 2018 @04:16PM (#56235463)

    I almost never visit (legit) sites using unicode characters. I'd love my browser warning me whenever I visit one -- just in case.

  • Not A.I. but B.I. as in Binance Intelligence.

    I will wait for the movie version on Netflix, but Kevin Spacey can pass on this role.

  • I had a job installing security systems many years ago. There was a grocery store in a slightly isolated area, it had an alarm hooked up with an outside siren and connected to the phone line. It was the 1980s, there were no cellular backups. The would be safe cracker pulled the outside siren off the wall with his vehicle and cut all of the phone lines, then he broke in and started working on the safe ignoring the inside siren. He had about $1000 worth of power tools in to the back office and started to drill the safe. He didn't count on the baker coming in early to get a start on the day. When the baker showed up, the robber bugged out the back door. He left behind all of his nice tools. He did cause the business some hardship, they couldn't access the contents of the safe for about 3 days until the locksmith could replace the parts he had ruined. Insurance paid to fix his safe and alarm system, after that they had their phone lines buried so they couldn't be cut as easily.

    • I remember a story in Australia where a guy robbed a petrol station at night. He left the car running. Another customer saw what was happening and took the car keys and walked away. The guy made off with like $200 but had to abandon his far more expensive car when he heard sirens.

  • Hehehehehehehe. But seriously, why the hell would they keep their stolen coins in accounts on the same site they're stealing from?! THAT'S INSANE!

Slashdot Top Deals

Put your Nose to the Grindstone! -- Amalgamated Plastic Surgeons and Toolmakers, Ltd.

Close