625
It Turns Out Binance's $6 Billion Hack Happened Because Its Employees Were Vibe Coding (futurism.com)
submitted 1 day ago by to c/technology@lemmy.world
113 comments fedilink hide all child comments
:pikaah: 4
you are viewing a single comment's thread
view the rest of the comments
[–] 175 points 1 day ago* (33 children)

Poor headline.

It began in June when an employee on Binance’s wallet developer team thought they’d indulge in some vibe coding by installing a popular AI coding tool. But they ended up downloading a tampered installation of Homebrew, a tool that’s popular with software engineers, after clicking a malicious ad.

There's lots of packages on Homebrew and it's a popular package manager, even outside of MacOS. He could have decided to grab anything from Homebrew and get hit.

The real one to blame here is Google for doing zero vetting on the crap they put at the top of the search results. Malicious ads for popular software happen constantly and so far they haven't moved an inch to fix it.

  • permalink
  • fedilink
  • source
  • hideshow 33 child comments
    •
  • [–] 27 points 1 day ago (4 children)

    If you are developing software with financial impact, and every developer downloads their dependencies from the internet without further checks, you already have set up yourself for desaster.

    If you would ask a LLM for how to guard yourself against malicious dependencies, this would be one of the first things they'd point out.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 4 child comments
    •
  • [–] 21 points 1 day ago (2 children)

    Also crazy how they are just allowed to “indulge” themselves with vibecoding on a machine that can access live production servers.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 7 points 1 day ago (1 child)

    Yeah, just doing shit without worrying about things like security is a core part of vibe coding. Vibecoding as a concept put into practice is definitely to blame.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 2 points 1 day ago*

    I think the same "professional" environment where whomever made the decisions for systems architecture thought that Production systems that deal with a shitton of money should be in the same network as machines which aren't locked down like crazy and whose users can install whatever the fuck they want, is the kind of environment where people thinks vibe coding is great.

    Incompetent idiots leading incompetent idiots.

  • permalink
  • fedilink
  • source
  • parent
  • [–] 50 points 1 day ago* (4 children)

    If you touch computers enough to install homebrew you shouldve touched computers enough to find the real download link, or at least install ublock.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 4 child comments
    •
  • [–] 23 points 1 day ago (1 child)

    100% user error.

    If you work (as in LITERALLY GET PAID TO DO SO) back/front end, IT or devops there's absolutely no excuse to expose your digital self like an absolute fucking idiot not checking where the fuck are you & what the fuck are you running.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 40 points 1 day ago* (last edited 1 day ago) (4 children)

    futurism .com links often seem like clickbait for people who are skeptical of the broligarchy.

    I'm all for covering that side of the story - we need a lot more resistance against the oligarchy. But clickbait is sleazy no matter what story it's pretending it can tell.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 4 child comments
    •
  • [–] 11 points 1 day ago (2 children)

    Yeah, Futurism's presentation is always overly dramatic and clickbaity. I end up learning more by clicking on the embedded links in the articles than the articles themselves.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 26 points 1 day ago (6 children)

    The person to blame is the idiot clicking on ads for software downloads

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 6 child comments
    •
  • [–] 23 points 1 day ago (1 child)

    If we blamed every low level individual idiot who falls for malware, we'd be here all day and the malware would still be there. How about we blame the people pushing malware to millions of idiots? Also the companies who can't even employ the most basic cybersecurity best practices to protect their own assets. It's not like they were a small startup that can't afford to.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 2 points 1 day ago*

    Some idiot put some other idiot, kid, or incompetent bullshitter in charge of designing the network for a Financial company and they did what idiots, inexperienced kids and incompetent bullshiters do and put the Production machines in the same network and easily accessible by machines were users can install any random shit from the Internet.

    Sooner or later something like what happened now would've happened.

    The fault is entirely with the decision maker who chose to have somebody else other than a senior expert design the systems architecture of a business that is supposed to safekeep billions of dollars.

  • permalink
  • fedilink
  • source
  • parent
  • [–] 12 points 1 day ago* (1 child)

    Yeah but a secure system should have stopped them. And even if that first safety net failed another one should have stopped the hackers from accessing the client’s crypto accounts. Why does a software dev’s computer need access to the live accounts.

    Also why can they just access any website? Shit should’ve been locked down. They should’ve only be able to access whitelisted websites.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 1 point 1 day ago*

    Indeed.

    Any half way decent software designer, systems designer or IT security specialist always assumes at least some people are idiots, or naive, or make mistakes even though they know better.

    And it only takes one of those doing their thing once for an attacker to get in.

    So they design their stuff taking that into account, which in this case means DESIGNING THE FUCKING NETWORK TOPOLOGY SO THAT THE FUCKING PRODUCTION MACHINES DEALING WITH FUCKING BILLIONS OF DOLLARS AREN'T EXPOSED TO PCs WHERE USERS CAN INSTALL ANY SHIT FROM THE INTERNET!

    (Sorry, got a bit pissed of with the tremendous incompetence displayed by whomever is their systems designer or whomever didn't hire a fucking senior systems designer to setup the IT infrastructure of a Finance company)

    Mind you, in my career I've also worked in Startups and they think somebody who has 5 years experience is senior and put them in charge of shit they really shouldn't be in charge of or probably even touch, so this isn't surprising to me, even if it's still infuriating.

  • permalink
  • fedilink
  • source
  • parent
  • [–] 18 points 1 day ago (5 children)

    But who downloads homebrew from the web and not CLI?

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 5 child comments
    •
  • [–] 7 points 1 day ago (2 children)

    Thats something I would absolutely do years ago before I got more familiar with cli and not as afraid of a terminal shell

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •