This was the original article that talked about this attempt: <a href="https://robertheaton.com/2019/06/24/i-was-7-words-away-from-being-spear-phished/" rel="nofollow">https://robertheaton.com/2019/06/24/i-was-7-words-away-from-...</a><p>HN discussion: <a href="https://news.ycombinator.com/item?id=20283922" rel="nofollow">https://news.ycombinator.com/item?id=20283922</a>
Coinbase should be hiring pentesters and giving them employee level access - even access to commit and deploy code.<p>Any insider shouldn't be able to steal more than the hot wallet, and even that should be hard.<p>I actually <i>wouldn't</i> put much effort into border security. At coinbases level of risk, evildoers will have no qualms bribing an employee to install a backdoor in their machine.
> CVE-2019–11707 was simultaneously discovered by Samuel Groß of Google’s Project Zero and the attacker.<p>At least another time in the last week I read on other threads on HN or related links that vulnerability were found almost the same time by independent people.<p>Here we have a researcher from Google’s Project Zero and the attacker.<p>How do you explain these coincidences?<p>What is the chance that some prominent researchers being targeted and their systems are actually exploited?
>We collected IOCs from the host in question and started hunting broadly in our network. We did not see any of the IOCs anywhere else in our environment, and blacklisted all the IOCs that we had at that time.<p>Can someone explain what they mean by IOCs?
I find this info is interesting<p>> The attackers went through a qualification process and multiple rounds of emails with potential victims, making sure they were high-payoff targets before they directed victims to the page containing the exploit payload.<p>It's a well-prepared plan combining social engineering and technical exploits
This point to an actual use of the cryptocurrency - exploiting a 0 day against someone who might have a crypto wallet means you can actually directly make money off exploits.
Prior to crypto, having a 0 day wasn't equal with ability to make blackhat money with it...
Does it a help in this case if one runs the browser in a sandbox? E.g. in docker?<p>They can then break out from the browser, but only get to docker with that exploit, and it's unlikely they have a docker exploit too at hand, is it?
> exploit code was delivered from a separate domain, analyticsfit[.]com<p>They paid some registrar for the domain. Can police request payment details? Can someone buy domain on stolen credit card?