Eliana Willis

The hacker behind the largest decentralized finance platform hack in history returned much of what they stole on Wednesday, sending back approximately $260 million of the more than $600 million in cryptocurrency that was taken. In a statement, Poly Network — a “DeFi” platform that works across blockchains — said the unknown culprit behind the attack has so far returned $256 million in BSC, $1 million from Polygon and $3.3 million in Ethereum. Poly Network noted that there is still $269 million in Ethereum as well as $84 million in Polygon that needs to be returned. The company attributed the attack to a vulnerability that was exploited concerning contract calls. The exploit “was not caused by the single keeper as rumored,” Poly Network added. Researchers online tied the attack to a Poly Network privileged contract called the “EthCrossChainManager.”

In addition to returning the money, the hacker included a three part Q&A where they explained some of their reasoning. The attacker — in a post shared by Elliptic co-founder Tom Robinson — said they found a bug in Poly Network’s system and contemplated what to do from there, eventually deciding to steal the money available and transfer it to another account. They tried to paint their actions as altruistic and said they were trying to expose the vulnerability before it was exploited by “an insider.” They claim to be completely protected because they used anonymous email addresses and IPs.”The Poly Network is a decent system. It’s one of the most challenging attacks that a hacker can enjoy. I had to be quick to beat any insiders or hackers,” the attacker said. 

“I didn’t want to cause real panic of the crypto world. So I chose to ignore shit coins, so people didn’t have to worry about them going to zero. I took important tokens (except for Shib) and didn’t sell any of them.”They eventually began to sell or swap stablecoins because they were unhappy with how Poly Network responded to the attack. “They urged others to blame and hate me before I had a chance to reply!” the attacker explained, adding that they turned to the stablecoins because they wanted to earn interest on the stolen money while they negotiated with Poly Network. “I am not very interested in money! I know it hurts when people are attacked, but shouldn’t they learn something from those hacks?” they said. The culprit noted that they were moving slowly in returning the money because they needed rest, needed more time to negotiate with Poly Network and needed to “prove” their dignity while hiding their identity. The statement goes on to say that the attacker wants to help Poly Network with its security because of its importance to the cryptocurrency industry. “The Poly Network is a well designed system and it will handle more assets. They have got a lot of new followers on Twitter right?” the statement said. “The pain they have suffered is temporary but memorable.”The audacious attack sent shockwaves through the blockchain and cryptocurrency communities as Poly Network sought to respond. The company works across blockchains for Bitcoin, Ethereum, Neo, Ontology, Elrond, Ziliqa, Binance Smart Chain, Switcheo, and Huobi ECO Chain.The hacker has been slowly returning the money since Poly Network released a statement threatening the culprit on Tuesday. The company begged the hacker to return the money.”The amount of money you hacked is the biggest one in defi history. Law enforcement in any country will regard this as a major economic crime and you will be pursed,” the Poly Network team said. “It is very unwise for you to do any further transactions. The money stole are from tens of thousands of crypto community members, hence the people. You should talk to us to work out a solution. We call on miners of affected blockchain and crypto exchanges to blacklist tokens coming from the above addresses.”The company appealed to miners across affected blockchain and crypto exchanges like Binance, Tether, Uniswap, HuobiGlobal, OKEx, Circle Pay and BitGo to blacklist any tokens coming from these addresses.Tether CTO Paolo Ardoino said the platform froze about $33 million in connection to the hack. Hank Schless, senior manager at Lookout, told ZDNet that DeFi has “become a primary target for cybercriminals” and a recent report from CipherTrace found that attacks on DeFi caused an all-time high number of losses for the first half of 2021. The DeFi community saw a record loss of $474 million between January and July this year thanks to cybercriminals. The attack on Poly Network is bigger than other headlining cryptocurrency attacks like the $550 million hack of Coincheck in 2018 and the $400 million Mt. Gox hack in 2014.  More

Billion-dollar tech services firm Accenture is downplaying an alleged ransomware attack that the Lockbit ransomware group announced on Tuesday night. 

ZDNet Recommends

Accenture was listed on the group’s leak site next to a timer set to go off on Wednesday. The ransomware group added a note that said, “These people are beyond privacy and security. I really hope that their services are better than what I saw as an insider. If you’re interested in buying some databases, reach us.” Also: Hackers take $600m in ‘biggest’ cryptocurrency theftIn a statement to ZDNet, an Accenture spokesperson downplayed the incident, saying it had little impact on the company’s operations. Accenture brought in more than $40 billion in revenue last year and has over 550 000 employees across multiple countries. “Through our security controls and protocols, we identified irregular activity in one of our environments. We immediately contained the matter and isolated the affected servers. We fully restored our affected systems from back up,” the company said.  “There was no impact on Accenture’s operations or on our clients’ systems.” A screenshot of the Lockbit ransom page. 
CyberKnow
Many online similarly questioned the amount of data taken during the ransomware attack and noted how unlikely it would be for it to come from an Accenture insider, considering how easy it would be to trace the attack. 

Accenture did not respond to questions about whether it was an insider attack and when the attack may have occurred.  A cybercrime intelligence firm called Hudson Rock reported on Twitter that about 2,500 computers of employees and partners were compromised in the attack while another research firm, Cyble, claimed to have seen a ransom demand of $50 million for about 6 TB of stolen data. BleepingComputer later reported that Accenture had already communicated with one CTI vendor about the ransomware attack and will notify others. In a report from Accenture itself last week, the company said it found that 54% of all ransomware or extortion victims were companies with annual revenues between $1 billion and $9.9 billion. Accenture provides a range of services to 91 of the Fortune Global 100 and hundreds of other companies. IT services, operations technology, cloud services, technology implementation and consulting are just a few of the things the Ireland-based company offers customers. In June, the company purchased German engineering consulting firm Umlaut to expand its footprint into the cloud, AI and 5G while also acquiring three other tech companies in February.  The Australian Cyber Security Centre released an advisory on Friday noting that after a small dip in operations, the Lockbit ransomware group had relaunched and has ramped up attacks.  Members of the group are actively exploiting existing vulnerabilities in the Fortinet FortiOS and FortiProxy products identified as CVE-2018-13379 in order to gain initial access to specific victim networks, the advisory said.  “The ACSC is aware of numerous incidents involving LockBit and its successor ‘LockBit 2.0’ in Australia since 2020. The majority of victims known to the ACSC have been reported after July 2021, indicating a sharp and significant increase in domestic victims in comparison to other tracked ransomware variants,” the release added.  “The ACSC has observed LockBit affiliates successfully deploying ransomware on corporate systems in a variety of sectors including professional services, construction, manufacturing, retail and food.” In June, the Prodaft Threat Intelligence team published a report examining LockBit’s RaaS structure and its affiliate’s proclivity toward buying Remote Desktop Protocol access to servers as an initial attack vector.  The group generally demands an average of $85 000 from victims, and about one third goes to the RaaS operators. More than 20% of victims on a dashboard seen by Prodaft researchers were in the software and services sector.  “Commercial and professional services as well as the transportation sector also highly targeted by the LockBit group,” Prodaft said. UPDATE: After the timer went off on Wednesday afternoon, the group released the files it stole. There was no sensitive information in the leak and it was mostly made up of Accenture marketing material. The group has since reset the timer for Aug 12, 20:43 UTC, implying they may have more documents to leak.  More

A sophisticated fraud scheme using compromised emails and advance-payment fraud has been uncovered by authorities. The fraud was run by what Europol describes as a “sophisticated” organised crime group which created fake websites and fake email addresses similar to legitimate ones run by retailers and suppliers. Using these fake accounts, the criminals tricked victims into placing orders for goods and requested payment in advance.However, there never were any goods, so deliveries never took place – instead the stolen money was laundered through Romanian bank accounts controlled by the criminals before being withdrawn at ATMs. The 23 suspects have been charged following simultaneous raids by police in the Netherlands, Romania and Ireland. They’re believed to have defrauded companies in at least 20 countries across Europe and Asia out of a total of €1 million. The group is suspected to have been running for several years, offering fictitious items for sale, such as wooden pellets. But last year the group switched how it operated and offered fictional items relating to the COVID-19 pandemic, including protective equipment. SEE: A winning strategy for cybersecurity (ZDNet special report) Europol’s European Cybercrime Centre (EC3) aided national investigators in the Netherlands, Romania and Ireland, as well as deploying cyber crime experts to help with raids. 

Business Email Compromise attacks are one of the most lucrative forms of cyber crime for internet fraudsters – in 2019, the FBI listed BEC as the cyber crime with the highest amount of reported losses, accounting for $1.77 billion. Overall, it costs businesses much more than ransomware. To help prevent falling victim to Business Email Compromise attacks, Europol recommends that people should be wary of unsolicited contact from a seemingly senior official, or requests which don’t follow the usual company procedures – especially if the request is supposedly urgent or confidential. Organisations can also create barriers against falling victim to BEC by ensuring that wire transfers are subject to approval from multiple people to help increase the chance of fraud being spotted. MORE ON CYBERSECURITY More

Yesterday the Poly Network, which specialises in cryptocurrency transfers on the Binance, Ethereum and Polygon blockchains, announced that it had been attacked and assets transferred to hackers.It tweeted: Important Notice: We are sorry to announce that #PolyNetwork was attacked on @BinanceChain, @ethereum and @0xPolygonAssets had been transferred to hacker’s following addresses: ETH: 0xC8a65Fadf0e0dDAf421F28FEAb69Bf6E2E589963 and BSC: 0x0D6e286A7cfD25E0c01fEe9756765D8033B32C71. It asked miners of affected blockchain and crypto exchanges such as Binance, HuobiGlobal, OKEx, Tether, BitGo, Uniswap and Circle Pay, amongst others, to blacklist tokens coming from these addresses. Poly Network said that the hacker had “exploited a vulnerability between contract calls” — where a contract can modify the keeper of a contract and execute a transaction. Estimates of funds held in wallets say that the loss was in excess of $600 million.Twitter user @kelvinfichter explained how the hack actually worked. Blockchain ecosystem security company Slow Mist tweeted that a total of over $610 million US was transferred to three addresses. It considers that the attack was likely to be “long-planned, organized and prepared”.

The Poly Network later broadcast an open message to the hacker saying ” The amount of money you hacked is the biggest on in the defi (decentralised finance) history”.

It added, “Law enforcement in any country will regard this as a major economic crime, and you will be punished”. Decentralised Finance (DeFi) aims to cut out third parties such as brokerages or exchanges. Poly Network has asked for the return of the funds and tweeted the addresses that the funds are to be returned to. Paolo Ardoino tweeted that Tether had frozen $33 million as part of the hack.Today Poly Network indicated that cash might be returning. It tweeted a screenshot of a transaction with a comment for the alleged hacker.Update: you can view the entire conversation and refund update in this Google doc linked from @LX2025This is not the first time that hackers have allegedly stolen Bitcoin. In February, legal proceedings began against Bitcoin developers after the theft of Bitcoin in 2020. As legal processes ramp up across the world and lawyers aim to recover different lost or stolen assets, there seem to be fewer places for hackers to hide as new legislation is adopted.The Bitcoin SV network, which recently tweeted that gigabyte blocks were mined on the public blockchain, was subjected to a series of block-reorganisation attempts in July and early August that attempted to double-spend BSV coins. The network recommended that node operators mark the chain as invalid to “lock the attacker’s fraudulent chain out.”The EU proposal that addresses improved detection of money laundering and terrorism financing in the Union will require ‘digital currency service providers to apply for licences, and anonymous digital currency asset accounts will be banned.’ The US’ Infrastructure Bill proposal requires ‘brokers’ in the digital currency industry to collect information on and report customers’ tax obligations to the government.So is any version of Bitcoin safe? With potential cross-chain vulnerabilities occurring as relay chains and cross-chain bridges make it easier to move assets across blockchain, penetration testing and checking become ever more important. Hacks like this in an Ethereum contract demonstrate how vulnerable smart contracts can be. Miners running smaller nodes — the very ethos of DeFi — become more exposed to vulnerabilities like this, whereas miners running large mining nodes clusters have the resources and budget to carry out extensive testing and mitigation when potential hacks occur. Will this be the largest hack ever, or will other vulnerabilities expose even larger amounts of money being moved to other blocks before being transferred out of blockchain currency exchanges? Hopefully, this wake-up call will have developers making sure that their code is impenetrable — whichever version of the contract is used. More

Following the July discovery of Windows 10 PrintNightmare bugs, Microsoft has released an update that changes the default behavior in the operating system and prevents some end-users from installing print drivers. The key change in this month’s Patch Tuesday update for the bug CVE-2021-34481 aka PrintNightmare is that users will need admin rights to install print drivers. The bug, stemming from a flaw in the Windows Print Spooler service, allows a local attacker to escalate privileges to the level of ‘system’ — an outcome that lets them install malware and create new accounts on Windows 10 machines. The patch arrived with Microsoft’s August 2021 Patch Tuesday update, which included a patch for CVE-2021-36936, a distinct Windows Print Spooler remote code execution vulnerability. But Microsoft has also provided more information about the impact of the patch.”The installation of this update with default settings will mitigate the publicly documented vulnerabilities in the Windows Print Spooler service,” the Microsoft Security Response Center (MSRC) said.   “This change will take effect with the installation of the security updates released on August 10, 2021 for all supported versions of Windows, and is documented as CVE-2021-34481.”The problem with the update is that it may affect organizations with networked printers, placing additional workloads on admins who previously could let end-users install printer driver updates from a remote server. Microsoft however believes security benefits outweigh the costs in time. 

“This change may impact Windows print clients in scenarios where non-elevated users were previously able to add or update printers. However, we strongly believe that the security risk justifies this change,” MSRC said. Microsoft has outlined a way to disable this mitigation with a registry key, but it has advised against doing so. It outlines the steps in the knowledge base article KB5005652 where it explains it changes the default behaviors, even in devices that don’t use Point and Print or print functionality. After installing the August 10 updates, users who don’t have admin privileges can’t install new printers using drivers on a remote computer or service, nor update existing printer drivers using drivers from a remote computer or server. “If you are not using Point and Print, you should not be affected by this change and will be protected by default after installing updates released August 10, 2021 or later,” Microsoft adds. Microsoft warns that changing the new default will expose the organization to publicly available threats. “Disabling this mitigation will expose your environment to the publicly known vulnerabilities in the Windows Print Spooler service and we recommend administrators assess their security needs before assuming this risk,” MSRC notes.  More

A hacker has apparently exploited a vulnerability to steal $600 million from a blockchain finance platform in what could be one of largest cryptocurrency thefts to date.  The makers of Poly Network, a “DeFi” or decentralized finance platform that works across blockchains, said on Tuesday that an attacker stole about $600 million in cryptocurrencies. 

The team behind Poly Network appealed to the hackers to “return the hacked assets”.  “The amount of money you hacked is the biggest one in defi history. Law enforcement in any country will regard this as a major economic crime and you will be pursed. It is very unwise for you to do any further transactions. The money stole are from tens of thousands of crypto community members, hence the people. You should talk to us to work out a solution,” the Poly Network team said.  Also: The best crypto credit cards: Get your rewards in cryptocurrency Poly Network works across blockchains for Bitcoin, Ethereum, Neo, Ontology, Elrond, Ziliqa, Binance Smart Chain, Switcheo, and Huobi ECO Chain. Poly Network listed three addresses the assets were transferred to. 

“We call on miners of affected blockchain and crypto exchanges to blacklist tokens coming from the above addresses,” the team pleaded.  And it appears that at least a small amount of the funds have been returned. Poly Network posted on Twitter “you are moving things to the right direction” and said that it had received more than $1m back.   A little later it posted again saying: “So far, we have received a total value of $4,772,297.675 assets returned by the hacker. ETH address: $2,654,946.051 BSC address: $1,107,870.815 Polygon address: $1,009,480.809.” According to Poly Network, “the hacker exploited a vulnerability between contract calls, exploit was not caused by the single keeper as rumored.” Per Wall Street Journal’s MarketWatch, the CTO of stablecoin company Tether, Paolo Ardoino, said the company froze $33 million of its tokens lost in the Poly Network attack.  The hackers stole about $267m of Ether, $252m of Binance coins, and $85 million in USDC tokens.  SEE: Attacks on critical infrastructure are dangerous. Soon they could turn deadly, warn analysts Changpeng Zhao “CZ”, chief of the giant Binance crypto-exchange, said on Twitter that it was aware of the Poly Network attack and noted that there was not much the company could do about it.  “While no one controls BSC (or ETH), we are coordinating with all our security partners to proactively help. There are no guarantees. We will do as much as we can,” he wrote.  More