What AI infers about
@safe wallet's tl;dr below (bold for highlights and Italics for my hot-takes):
Based on forensic investigations, the Lazarus Group, a North Korean state-sponsored hacking group, executed a targeted attack on the Bybit exchange, resulting in the theft of $1.4 billion in Ether139. The attack compromised a Safe{Wallet} developer machine, which allowed the hackers to propose a disguised malicious transaction712.
(This infers a single developer has the technical capacity to perform the same actions, which is already a flaw in the SSDLC wrt process flows and authoritization levels)
Here's a breakdown of what likely occurred from a technical cyber compromise perspective:
Initial Compromise: The Lazarus Group gained unauthorized access to a Safe Wallet developer's machine112. It remains unclear how they initially breached the developer's machine, but Lazarus is known for using sophisticated social engineering techniques, which could involve tricking employees into downloading malicious software or clicking on malicious links15. They are also known to use spear-phishing campaigns, malicious attachments, and links that deliver custom malware4.
(breaching a developer machine is easy and to be expected. the security controls in place for an exchange need to account for this inevitability)
Malicious Code Injection: Once inside Safe Wallet's systems, the attackers injected malicious code into the data served by Safe Wallet’s cloud data provider, Amazon Web Services (AWS)19. Verichains stated that the benign JavaScript file of
app.safe.global was replaced with malicious code12. The malicious code was designed to activate only when Bybit's wallet requested a transaction1.
(this is concerning. How did the attacker know the address of bybit's cold wallet to begin with?)
Transaction Manipulation: When Bybit attempted to transfer funds, the malicious code altered the transaction's content without raising suspicion from the Bybit employees who signed it1. The code modified the transaction to transfer the ability to execute transactions to Lazarus1. A masked URL that appeared to be a legitimate Safe transaction was used38.
(this is basic hacking ttp's going as far back as the 90's, pre-crypto era. There is a fundamental architecture flaw that, hopefully, is not systemic to all wallets /contracts)
Asset Diversion: With control over the transaction execution, Lazarus moved $1.4 billion worth of Ether and staked Ether tokens out of Bybit's wallet1.
Covering Tracks: Immediately after executing the malicious transaction, Lazarus removed the injected code from Safe Wallet's infrastructure to conceal their activity and potentially reuse the attack method1.
Safe Wallet's Response: Safe Wallet has taken several steps to address the breach, including rebuilding and reconfiguring its infrastructure, rotating all credentials, and adding security measures to eliminate the attack vector1912. They've also implemented stricter validations for transactions, enhanced monitoring alerts, and temporarily removed native Ledger integration6811.
Lazarus Group's Modus Operandi: The Lazarus Group has stolen over $6 billion in crypto assets since 2017, using the proceeds for North Korea's ballistic missile program12. They often target developers and technology professionals in cryptocurrency, cybersecurity, and online gambling5. They are known for using social engineering, custom malware, and techniques to evade security measures14.
(What AI forgot to mention: Lazarus are some of the most adept threat actors in the context of modifying open-source software libraries commonly used by web3 developers, in order to introduce back doors, logic-flows, and exploitable vulnerabilities. They target the software supply chain itself to great effect.)