EN PT-BR
← Voltar ao feed
medium cryptocurrency finance

Binance $6.34B Breach: SafeDep Tests Sandbox Defenses Against 'Contagious Interview' Fake Recruiter Attack

1 fonte(s) · 1 atualização(ões) · publicado 04/11/2026 06:00 · coletado há 1 hora

SafeDep published a technical follow-up to its earlier breakdown of the Binance developer-laptop breach, focusing on the fake take-home assignment step that led to the theft of $6.34 billion. A fake recruiter sent a Binance engineer ('Engineer B') a take-home coding assignment whose setup script replaced the pyenv binary under /opt/homebrew on a work laptop, re-linked it, and spawned a shell, all undetected by endpoint security. SafeDep rebuilt this setup step as a benign lab and tested it against its own open-source sandboxing tool, pmg, on Linux, showing that with sandboxing disabled (the default), all malicious file swaps, SSH key reads, secret exfiltration, and network callbacks succeeded, while enabling the sandbox with a locked-down, proxy-only network policy blocked nearly all of them. The interview pattern matches the Contagious Interview campaign previously documented by SafeDep.

Detalhes técnicos

The malicious setup script performed six file operations: staging a trojanized pyenv binary, deleting the real one, renaming the trojan into place, then unlinking and re-creating the PATH symlink, before launching zsh. SafeDep's lab reproduced this against a dummy Homebrew prefix and found that a package-reputation check (which only inspects registry-downloaded packages) cannot detect this type of attack, since the payload lives in the project's own package.json/setup.py scripts rather than a registry dependency. With pmg --sandbox enabled using the built-in npm profile, writes to ~/.ssh, shell startup files, and the Homebrew prefix returned EACCES; secret environment variables such as AWS_SECRET_ACCESS_KEY were stripped from the child process; and curl/wget execution was blocked. However, the default audit network mode still allowed raw socket connections and HTTPS calls to exfiltration destinations to succeed; only enabling network_via_proxy_only and network_mode: enforce closed this gap, blocking DNS resolution and raw TCP connects. The same protections applied to npm run start, pmg sandbox exec, and pip install ., though /tmp and the project directory remained writable in all configurations, and on macOS, Seatbelt enforcement differs from Linux Landlock (EPERM vs EACCES), with raw sockets requiring the same proxy-only hardening.

Remediação

SafeDep recommends sandboxing take-home assignment setup scripts (not just registry packages) using tools like pmg, explicitly denying execution of curl/wget/python*, enabling network_via_proxy_only with enforce mode to prevent raw-socket exfiltration, running untrusted setup code in a VM or spare user account, and reviewing all setup files manually before execution. Teams should also centralize sandbox violation logs (pmg sandbox violations list) since blocked attempts still exit with status 0 and look like success to the developer.

Linha do tempo

  1. safedep.io ↗ · pub. 04/11/2026 06:00 · coletado 04/11 14:00 primeiro registro

    Binance $6.34B Breach: SafeDep Tests Sandbox Defenses Against 'Contagious Interview' Fake Recruiter Attack

    ler a análise desta fonte

    SafeDep published a technical follow-up to its earlier breakdown of the Binance developer-laptop breach, focusing on the fake take-home assignment step that led to the theft of $6.34 billion. A fake recruiter sent a Binance engineer ('Engineer B') a take-home coding assignment whose setup script replaced the pyenv binary under /opt/homebrew on a work laptop, re-linked it, and spawned a shell, all undetected by endpoint security. SafeDep rebuilt this setup step as a benign lab and tested it against its own open-source sandboxing tool, pmg, on Linux, showing that with sandboxing disabled (the default), all malicious file swaps, SSH key reads, secret exfiltration, and network callbacks succeeded, while enabling the sandbox with a locked-down, proxy-only network policy blocked nearly all of them. The interview pattern matches the Contagious Interview campaign previously documented by SafeDep.

    Technical Details

    The malicious setup script performed six file operations: staging a trojanized pyenv binary, deleting the real one, renaming the trojan into place, then unlinking and re-creating the PATH symlink, before launching zsh. SafeDep's lab reproduced this against a dummy Homebrew prefix and found that a package-reputation check (which only inspects registry-downloaded packages) cannot detect this type of attack, since the payload lives in the project's own package.json/setup.py scripts rather than a registry dependency. With pmg --sandbox enabled using the built-in npm profile, writes to ~/.ssh, shell startup files, and the Homebrew prefix returned EACCES; secret environment variables such as AWS_SECRET_ACCESS_KEY were stripped from the child process; and curl/wget execution was blocked. However, the default audit network mode still allowed raw socket connections and HTTPS calls to exfiltration destinations to succeed; only enabling network_via_proxy_only and network_mode: enforce closed this gap, blocking DNS resolution and raw TCP connects. The same protections applied to npm run start, pmg sandbox exec, and pip install ., though /tmp and the project directory remained writable in all configurations, and on macOS, Seatbelt enforcement differs from Linux Landlock (EPERM vs EACCES), with raw sockets requiring the same proxy-only hardening.

    Remediation

    SafeDep recommends sandboxing take-home assignment setup scripts (not just registry packages) using tools like pmg, explicitly denying execution of curl/wget/python*, enabling network_via_proxy_only with enforce mode to prevent raw-socket exfiltration, running untrusted setup code in a VM or spare user account, and reviewing all setup files manually before execution. Teams should also centralize sandbox violation logs (pmg sandbox violations list) since blocked attempts still exit with status 0 and look like success to the developer.