Banksy Was Warned About Website Flaw Before NFT Hack Scam (bbc.com) 29
Artist Banksy's team was warned his website had a security weakness seven days before a hacker scammed a fan out of $336,000. The BBC reports: On Tuesday a piece of art was advertised on Banksy's official website as the world-renowned graffiti artist's first NFT (non-fungible token). A British collector won the auction to buy it, before realizing it was a fake. A cyber-security expert warned Banksy that the website could be hacked, but was ignored. Sam Curry, a professional ethical hacker from the US and founder of security consultancy Palisade, said he first heard that the site could have a weakness on the social network Discord, last month.
"I was in a security forum and multiple people were posting links to the site. I'd clicked one and immediately saw it was vulnerable, so I reached out to Banksy's team via email as I wasn't sure if anyone else had. "They didn't respond over email, so I tried a few other ways to contact them including their Instagram, but never received a response." Mr Curry's disclosure, first reported by rekt.news was made initially by email on 25 August. The BBC was shown the email thread and has tried to contact Banksy's team several times, with no response.
Mr Curry says the website flaw -- which has now been fixed -- "allowed you to create arbitrary files on the website" and post your own pages and content. The new page, called 'Banksy.co.uk/NFT,' was deleted shortly after the auction, with Banksy's team saying: "Any Banksy NFT auctions are not affiliated with the artist in any shape or form." The British man who won the auction is a prominent NFT collector and Banksy fan known on Twitter as Pranksy. He said he felt "burned" when he was scammed out of nearly $340,000 in cryptocurrency coins, but was relieved when the hacker inexplicably returned most of the money to him by the end of the day.
"I was in a security forum and multiple people were posting links to the site. I'd clicked one and immediately saw it was vulnerable, so I reached out to Banksy's team via email as I wasn't sure if anyone else had. "They didn't respond over email, so I tried a few other ways to contact them including their Instagram, but never received a response." Mr Curry's disclosure, first reported by rekt.news was made initially by email on 25 August. The BBC was shown the email thread and has tried to contact Banksy's team several times, with no response.
Mr Curry says the website flaw -- which has now been fixed -- "allowed you to create arbitrary files on the website" and post your own pages and content. The new page, called 'Banksy.co.uk/NFT,' was deleted shortly after the auction, with Banksy's team saying: "Any Banksy NFT auctions are not affiliated with the artist in any shape or form." The British man who won the auction is a prominent NFT collector and Banksy fan known on Twitter as Pranksy. He said he felt "burned" when he was scammed out of nearly $340,000 in cryptocurrency coins, but was relieved when the hacker inexplicably returned most of the money to him by the end of the day.
A fool and his money... (Score:5, Insightful)
... are the primary target demographic for all NFT auctions.
A fool and his money... (Score:4, Informative)
a prominent NFT collector and Banksy fan
In other words, a mark. At least he got most of his money back, but even if he hadn't, or if the NFT had been "genuine", the end result would have been the same. He would have ended up with an entry on a blockchain representing... well, not a whole lot. If he plays his cards right, maybe some other mark will buy this NFT as one representing a work of art in its own right. Hey, it's Banksi, so it's all about gimmicks and reputation rather than actual art anyway.
Re:A fool and his money... (Score:4, Insightful)
That's in no way different from any other copyright.
If you pirate an MP3 or buy a license for the MP3 and download it... you end up with the exact same MP3.
You can also buy a "limited edition" print of a work of art. Nevermind someone could just scan it... and print off a million more. Or a "First Edition" of a book. Same book usually.
Artificial, endorsed, scarcity for art is nothing new.
Re:A fool and his money... (Score:4, Insightful)
Re: (Score:2)
The difference between a print and an NFT is that you can hang the print on the wall, and in the long run I expect that will make all the difference.
The difference between a physical item and a digital one stored on a distributed blockchain is that the physical item can be destroyed a lot more easily. In the long run, that will make all the difference.
However, most NFTs are like most art, economically worthless. They have value only when treated like they have value, and this "NFT all the things!" craze will fade and stop perturbing values eventually. It won't be the end of NFTs, just the end of meaningless ones being profitable.
Re: (Score:2)
The Golgafrinchan Ark Fleet Ship B was a way of removing the basically useless citizens from the planet of Golgafrincham. A variety of stories were formed about the doom of the planet, such as blowing up, crashing into the sun or being eaten by a mutant star goat. The ship was filled with all the middlemen of Golgafrincham, such as the telephone sanitisers, account executives, hairdressers, tired TV producers, insurance salesmen, personnel officers, security guards, public rela
Re: A fool and his money... (Score:2)
I think a lot about this part of HHG these days. I canâ(TM)t help thinking itâ(TM)s a damn good idea, especially in these times.
Nope (Score:5, Insightful)
"We sent emails to an address, and we posted comments on his publicist's instagram" isn't the same as, "[Person] was warned."
They tried to contact a famous person, exclusively and casually via the internet, and did not receive any response. That is not the same as, "[Person] was warned."
Re: (Score:2)
Re: Nope (Score:2)
I wouldn't be surprised.
To me all this feels like a Banksy way of displaying the futility pf NFTs.
Re: (Score:2)
Hmm, which definition of "warn" are you using?
The definition I'm using uses the word "inform" which means "to give (someone) facts or information." Was Banksy given facts or information?
Re: (Score:2)
This, and which were the true ways to warn purposefully isolated person?
Re: Nope (Score:2)
You do realize that Banksy hides their identity, so options are limited to the above sorts of measures, right?
Re: (Score:2)
What is wrong with using the information given in the "Contact Us" section of a website to warn someone of a flaw in the website? That seems entirely appropriate...
Re: (Score:2)
No. No it does not seem reasonable at all. On a small website, maybe. But a famous person? Those are usually PR links. You're going to have to either figure out who built the website and contact that company, or figure out the correct address to send a letter to the person's agent. Or otherwise contact their agent.
And if you don't hear back, you didn't tell them anything yet.
Cybercrime is so common now (Score:1)
"the hacker inexplicably returned most of the money to him" - so cybercrime is so easy now that criminals are engaging in "catch and release" just for the fun of it.
Re:Cybercrime is so common now (Score:4, Interesting)
Re: (Score:2)
"the hacker inexplicably returned most of the money to him" - so cybercrime is so easy now that criminals are engaging in "catch and release" just for the fun of it.
Maybe the “hacker” was Banksi himself. I wouldn’t put it past him.
Or Pranksy -- who is now in possession of the only genuine fake (or fake genuine) Banksy NFT, purchased off Banksy's site...
Re: (Score:2)
This return within a day thing is spoiler.
Re: (Score:3)
Re: (Score:2)
Yep. Remember his self-shredding painting [youtube.com]?
New product idea (Score:2)
The digital NFT shredder.
Look out art world, here I come.
It will be worth millions (Score:2)
So noble! (Score:2, Insightful)
So let me get this straight. A wealthy patron, who rather than donating to solve the world's problems, essentially wanted to purchase bragging rights to a piece of digital garbage on a half-assed, money-grab website, was spared the public embarrassment of losing hundreds of thousands of dollars, all because the digital thief had some moral code of conduct? That much money could have fed a village in Kenya for a decade. So much for the concept of Robinhood.
Convenient he got the money back. (Score:2)
Great advertisement for the site.
non-news (Score:2)
From TFA:
A cyber-security expert warned Banksy that the website could be hacked
And what makes people think that Banksy or anyone from his team even understood what he was warned about? When someone speaks to you in Greek, it's understandable if you disregard it. Unless you're a Greek, of course.