solidot新版网站常见问题，请点击这里查看。
消息
本文已被查看 268 次
币安称黑客通过虚假工作面试入侵工程师笔记本电脑
币安官方博客披露了黑客如何窃取价值 63 亿美元加密货币的初步调查报告。报告称，攻击始于今年六月：
2026 年 6 月——供应链攻击。钱包开发运维团队的工程师 A 为安装一款热门 AI 编程工具，通过搜索引擎查找并下载了一个遭篡改的 Homebrew 安装程序。我们的安全团队主动检测到了这一异常，更换了该设备，同时轮换了所有相关凭证。尽管如此，工程师 A 的岗位信息，以及其钱包基础设施团队中的相关同事信息，仍已暴露给攻击者。
9月——社会工程攻击。软件工程师 B 通过一个正规的求职平台，收到了一名冒充项目总监人员的联系。工程师B在该平台上的个人资料中提及了自己在币安的工作经历。对方以项目总监的身份安排了第一轮面试，由一名人力资源代表参与；随后又安排了第二轮面试，面试者自称是该虚构公司的 CEO。
在第一轮面试中，冒充人力资源代表的人员与工程师B进行了实时视频面试。为了建立信任，面试者还向工程师B分享了自己的社交媒体账号，其平台帐号有个人生活照片和视频。这种方式比以往的社会工程攻击手段更复杂，也更具欺骗性。
第二轮面试通过一款热门社交聊天应用进行。面试接近尾声时，工程师B被要求将一份含代码仓库的“作业”下载到工作电脑中。该代码仓库包含恶意代码，在安装过程中便会执行，进而触发了一系列未经授权的操作。
该恶意软件采用了复杂的代码混淆和规避检测技术，包括用恶意版本替换某个正规开发工具组件，以执行命令并与攻击者控制的外部服务器建立通信。当时，终端安全防护工具未能检测到这一零日恶意软件。攻击者还采取了隐藏恶意行为、清除入侵痕迹等措施，进一步增加了检测和后续调查的难度。
10 月 20 日——利用内部 AI 工具作为攻击跳板。攻击者利用遭入侵的工程师 B 的电脑，通过内部 AI 工具控制了钱包开发运维工程师 A，以及另一名钱包软件工程师 C 的设备。攻击者很快发现，工程师 A 的电脑上存有一个具有容器部署权限的令牌。
10 月 30 日——渗透钱包签名操作。10 月 30 日 01:15 至 03:56（东八区时间）期间，攻击者登录了软件工程师 C 的电脑，使用从工程师 A 处窃取的凭证部署了一个容器，并执行恶意脚本，进而发起此次攻击。
https://www.binance.com/zh-CN/blog/%E7%A4%BE%E5%8C%BA/3229153443759566763
本文由 AI图鉴自动抓取并翻译，版权归原作者所有；如需查看原文请点下方链接。
Click here to see the most common questions on the new version of the website.
Message
This paper has been viewed 268 times
Cheonan claims that hackers have hacked the engineer's laptop through false job interviews.
An official blog in Bian has revealed a preliminary investigation into how hackers stole $6.3 billion worth of encrypted currency. According to the report, the attack began last June:
June 2026 - Supply chain attack. Engineer A of the Wallet Development Transport Team to install a hot AI programming tool to find and download a tampered Homebrew installation via the search engine. Our security team proactively detected this anomaly, replaced the equipment and rotated all relevant vouchers. Nevertheless, information about the position of Engineer A, as well as information about his colleagues in his wallet infrastructure team, has been disclosed to the attackers.
September — Social engineering attacks. Software Engineer B received contact with an impersonating project director through a formal job search platform. Engineer B referred to his work experience on the platform. The first round of interviews was arranged in the capacity of Project Director, with the participation of a human resources representative, followed by a second round of interviews, which the interviewer identified as CEO of the fictional company.
During the first round of interviews, human resources impersonators conducted live video interviews with Engineer B. In order to build confidence, interviewers also shared their social media accounts with Engineer B, whose platforms have personal life photographs and videos. This approach is more complex and deceptive than previous social engineering attacks.
The second round of interviews was conducted through a popular social chat application. Towards the end of the interview, Engineer B was asked to download a “work” with coded warehouses into the work computer. The code warehouse contains a malicious code that will be implemented during the installation process, triggering a series of unauthorized operations.
The malicious software uses complex code confusion and circumvent detection techniques, including replacing a formal development tool component with a malicious version to execute orders and establish communications with external servers controlled by the attackers. At that time, the terminal security tool could not detect the Zero-Day malicious software. The perpetrators have also taken measures such as concealing malicious acts and clearing traces of incursions, which have further complicated detection and follow-up investigations.
October 20 - Using internal AI tools as an attack springboard. Using the computer of the invaded engineer B, the attackers controlled the Wallet Development Transport Engineer A and the equipment of another Wallet Software Engineer C through an internal AI tool. The attackers soon discovered that Engineer A had a sign on his computer with a container to deploy permission.
October 30 — Infiltration wallet signature operation. On 30 October, between 0115 and 03:56 (Eastern Sector 8 time), the assailants entered the software engineer C ' s computer, deployed a container using a receipt stolen from engineer A and carried out malicious scripts, which led to the attack.
https://www.binance.com/zh-CN/blog/%E7%A4%BE%E5%8C%BA/3229153443759566763
Auto-fetched and translated by AI Atlas. All rights belong to the original author.