Slashdot Mirror
In a Remarkable Turn of Events, Hackers -- Not Users -- Lost Money in Attempted Cryptocurrency Exchange Heist (bleepingcomputer.com)
The hackers who attempted to hack Binance, one of the largest cryptocurrency exchanges on the Internet, have ended up losing money in a remarkable turn of events. It all began on Thursday, when thousands of user accounts started selling their Bitcoin and buying an altcoin named Viacoin (VIA). The incident, BleepingComputer reports, looked like a hack, and users reacted accordingly. But this wasn't a hack, or at least not your ordinary hack. The report adds: According to an incident report published by the Binance team, in preparation for yesterday's attack, the hackers ran a two-month phishing scheme to collect Binance user account credentials. Hackers used a homograph attack by registering a domain identical to binance.com, but spelled with Latin-lookalike Unicode characters. More particularly, hackers registered the [redacted].com domain -- notice the tiny dots under the "i" and "a" characters.
Phishing attacks started in early January, but the Binance team says it detected evidence that operations ramped up around February 22, when the campaign reached its peak. Binance tracked down this phishing campaign because the phishing pages would immediately redirect phished users to the real Binance login page. This left a forensic trail in referral logs that Binance developers detected. After getting access to several accounts, instead of using the login credentials to empty out wallets, hackers created "trading API keys" for each account. With the API keys in hand, hackers sprung their main attack yesterday. Crooks used the API keys to automate transactions that sold Bitcoin held in compromised Binance accounts and automatically bought Viacoin from 31 other Binance accounts that hackers created beforehand, and where they deposited Viacoin, ready to be bought. But hackers didn't know one thing -- Binance's secret weapon -- an internal risk management system that detected the abnormal amount of Bitcoin-Viacoin sale orders within the span of two minutes and blocked all transactions on the platform. Hackers tried to cash out the 31 Binance accounts, but by that point, Binance had blocked all withdrawals.
Phishing attacks started in early January, but the Binance team says it detected evidence that operations ramped up around February 22, when the campaign reached its peak. Binance tracked down this phishing campaign because the phishing pages would immediately redirect phished users to the real Binance login page. This left a forensic trail in referral logs that Binance developers detected. After getting access to several accounts, instead of using the login credentials to empty out wallets, hackers created "trading API keys" for each account. With the API keys in hand, hackers sprung their main attack yesterday. Crooks used the API keys to automate transactions that sold Bitcoin held in compromised Binance accounts and automatically bought Viacoin from 31 other Binance accounts that hackers created beforehand, and where they deposited Viacoin, ready to be bought. But hackers didn't know one thing -- Binance's secret weapon -- an internal risk management system that detected the abnormal amount of Bitcoin-Viacoin sale orders within the span of two minutes and blocked all transactions on the platform. Hackers tried to cash out the 31 Binance accounts, but by that point, Binance had blocked all withdrawals.
So, it is kind of a Unicode hack?
Unicode wasn't allowed initially in domain names if I recall correctly.
Everything I write is lies, read between the lines.
But how did they lose money?
How is the 2LipBulb cryptocurrency? Folks in the Netherlands swear by it.
....when you lick a butthoal you lick it for life!!!
Good thing TFS redacted the domain name. Now a person has to read TFA to see the text, and we know that will never happen.
Somewhere there is a Black Hat that's gonna be dead if some money doesn't get paid back. The big boys don't like it when you lose their money in a hack gone bad. So what happens to the money. Does Binance keep it? Turn it over (read give to the police fund) to the government?
The banks? Who?
I'd say it goes to charity.
I bet you only speak English. For people who speak other languages, Unicode is rather useful. Yes, different languages use different character sets that can resemble each other. Yes, people can be fooled, but security doesnt trump the ability to have natural looking URLs in the native languages of most of the planet. télétoon.com (doesnt work) is much more natural than teletoon.com to a French speaker. At least vidéotron.com works (it gets rewritten to canonical videotron.com) There are plenty of legitimate uses for that feature. Add to that that most western european language speakers are completely used to accented characters, so usually the only ones likely to be fooled are the English only speakers. So you want to limit the web to English DNS entries because English speaking people dont notice accented characters. Sorry, world wont comply.
I almost never visit (legit) sites using unicode characters. I'd love my browser warning me whenever I visit one -- just in case.
Not A.I. but B.I. as in Binance Intelligence.
I will wait for the movie version on Netflix, but Kevin Spacey can pass on this role.
WARNING: Smartphones have side effects--most of them undocumented.
No one pulled your string, the owners of the internet are talking here.
If you want your unneeded characters spin up minitel.
I had a job installing security systems many years ago. There was a grocery store in a slightly isolated area, it had an alarm hooked up with an outside siren and connected to the phone line. It was the 1980s, there were no cellular backups. The would be safe cracker pulled the outside siren off the wall with his vehicle and cut all of the phone lines, then he broke in and started working on the safe ignoring the inside siren. He had about $1000 worth of power tools in to the back office and started to drill the safe. He didn't count on the baker coming in early to get a start on the day. When the baker showed up, the robber bugged out the back door. He left behind all of his nice tools. He did cause the business some hardship, they couldn't access the contents of the safe for about 3 days until the locksmith could replace the parts he had ruined. Insurance paid to fix his safe and alarm system, after that they had their phone lines buried so they couldn't be cut as easily.
I hope that someday we will be able to put away our fears and prejudices and just laugh at people. - Jack Handey
Which is precisely why the GP suggested restricting website character sets by TLD. If you want to have télétoon as your website address, make it télétoon.fr (or télétoon.com.fr), not télétoon.com, as .com is (in practice) a US-centric TLD. This isn't hard and it isn't discriminatory, but the registrars a) want to blackmail website owners into registering more addresses, b) don't give two shits about security, and to top it off c) like virtue-signaling about how open and accepting they are to other cultures (the latter is actually Mozilla's explicit explanation for not displaying punycode for anything ever, because apparently peoples feelings are more important to them than their users security. I don't give a shit if people want their website under .com TLD, what people want is completely and totally irrelevant: I want a billion dollars, doesn't mean Mozilla should be required to give it to me.)
"None can love freedom heartily, but good men; the rest love not freedom, but license." --John Milton
> So you want to limit the web to English DNS entries because English speaking people dont notice accented characters. Sorry, world wont comply.
Sorry fucker, DNS entries are limited to ASCII. What you are seeing is the punycode transcription in vulnerable browsers (any browser that displays unicode is vulnerable).
English lost the thorn and eth for international compliance with French and German printing presses. You can do without your assorted dicks and dots to prevent scams.
Anyone can print their own money now. It is just a matter of finding a bunch of people to buy them from you. Money out of thin air!
(Of course, a government, can also print money, which has the authority (and reason)! So it is really nothing like anybody else!)
In any event, even if you had an American domain, that doesnt necessarily mean its English. Other language television networks or groups in the US should only use English names? telelatino.com, sinovision.net, etc... Country != language. Should dw.com actually be dw.us or dw.com.uk because it is in English, even though it is a German broadcaster? Your position doesnt exten very well either, what about .tv ? .org, .net should it be English only? or other languages allowed? How are people going to know whether a domain allows international characters or not? Now youre going to say .fr domains should be in FR, but there are lots of multilingual countries: Canada (2), Belgium (2) , Switzerland(3), India (22).
Even if you grant everything you say, everybody else in the world (the vast majority of the world's population) would still have the problem of similar looking domains, so you are asking for an English specific solution, that helps only English speaking people, and makes them less able to deal with domains that are outside the intentially crippled ones reserved for English language usage. So people who are saying "no internaltional characters on this 1 (2? 3?) TLD are just advocating a ghetto that makes people more vulnerable when the TLD is not one of the select few.
Why would you need unicode characters for European language URLs?
For Arabic, Thai or various other languages that have little or nothing in common with the alphabet we use in English, it would make some sense, but for European languages, you're mostly losing the accents and the speakers themselves tend to have workarounds from the days when typewriters only had the characters for one language and not all of them.
Hehehehehehehe. But seriously, why the hell would they keep their stolen coins in accounts on the same site they're stealing from?! THAT'S INSANE!
Miner Miner Fourty Niner.
Make 'murika Greedy Again.
yet all air traffic is english. as it should be. so should all the rest of the world.