Two weeks after the Binance cyberattack, in which North Korean hackers stole about $6.3 billion from the cryptocurrency exchange, internal investigations shed light on what really failed. And according to a cyber expert, the real novelty in the attack is the use of Binance’s own artificial intelligence models to carry out the attack.
“The new thing here is not that the attacker had AI. It is that the victim did. On 20 October, the attacker used one of Binance’s own internal AI tools as part of reaching two more engineers’ computers,” Ori Segal, CEO of Cybore, told The Jerusalem Post on Thursday.
Segal, whose company developed a system designed to detect suspicious activity during Zoom calls, explained that, aside from that, every step of the attack was carried out classically, using a poisoned package manager, a fake recruiter, a malicious file, credential reuse, and an over-broad deployment permission.
“None of it required a model,” he said, adding that while most cybersecurity experts have been asking what hackers can do with AI models since their inception in 2023, not many have asked what hackers can do with the AI tools the companies use.
“This is the first large incident where that question appears in the public record at all,” he added.
With no guide to identify, prevention is key
Segal also said that there is very little companies can do to prevent these attacks or train the employees to avoid false interviews, with no clear guide on what to do to survive them.
“Being asked to build something, run it locally and pull in external libraries is what a coding interview is. A fake employer can have a website, a careers page and a set of plausible LinkedIn profiles, and we have no public information about what this one had. Anyone offering a reliable tell is guessing,” he told the Post.
He said a key element in avoiding the attacks would be to stop the pressure for results and check whether the tasks need to be done on a particular device and whether there is any infection risk.
“Beyond that, the useful advice is not detection at all; it is where you run things. Unvetted third-party code should never run on your work computer, and not on the machine holding your own personal projects either,” Segal explained.
“A disposable virtual machine costs nothing and removes the entire attack, whether or not you noticed anything was wrong,” he added.
Luring employees with job interviews also a key vulnerability
Segal finally pointed out a key vulnerability that has not particularly been raised following the Binance cyberattack: the fact that the lure is a job interview is on its own a vulnerability, due to the need for the employee to disclose that he is looking for a new job in order to investigate.
“An employee who starts to suspect something went wrong now has a personal reason to stay quiet, because reporting it means telling their employer they were interviewing elsewhere, on a company laptop,” he explained.
“I am not suggesting that is what happened at Binance; I have no information either way. The point is that the incentive is structural; it exists in every company exposed to this, and it works for the attacker,” he added.
“The fix is cheap and almost nobody has done it. Say out loud, in advance, that an employee who was job hunting and ran something they should not have will not be punished for reporting it. Until a company has said that, it should expect disclosure to arrive late and incomplete,” he concluded.
How did the attack happen
Hackers used a bogus job interview and software hidden in an advertisement to compromise the computers of two Binance software engineers before using a third’s computer to drain $6.3 billion worth of crypto in last week’s record heist, the exchange said on November 3.
In its initial report on how hackers pulled off what could be the largest-ever financial theft, Binance detailed a multi-stage hacking effort that began in June and triggered a series of security breaches that culminated in the theft.
Even as Binance scrambled to lock down its system and freeze withdrawals after detecting the attack late on Thursday, the hackers were still making off with crypto from the exchange nearly four hours after the first theft, Binance said.
Reuters contributed to this report.
