Comment by closewith
7 months ago
Institutional faith in Pix has been rocked recently, as earlier this month, hackers using credentials purchased from a C&M employee were able to generate unauthorised PIX transactions on client banks and steal at least BRL$ 500 MM and maybe as much as BRL $ 5 BN.
Although funds are already being recovered, it has highlighted the opacity of Pix security, which has flown somewhat under the radar due to the closed nature of the system.
It was due to a contractor that sold his password for peanuts. Not much opacity here. They shoud stop relying on poorly paid outside contractors.
Yes, a developer for an upstream dependency sold their credentials and the attackers were able to use that to create transactions in client banks' Pix infrastructure.
> Not much opacity here.
I think a black box implemented by a third party that can steal your funds is the definition of opacity.
> They shoud stop relying on poorly paid outside contractors.
A great deal of financial software is written by poorly paid contractors, but it's rare that one set of credentials can introduce systematic risk to a financial system.
> They shoud stop relying on poorly paid outside contractors
Besides paying decent wages, they should get rid of single points of failure, being them silicon or meat based.
There are considerable privacy concerns regarding pix, some Brazilian government officials are able to obtain transaction information without a court order, which is needed when it comes to traditional methods that came before pix.
Yes, as commented elsewhere Brazilians in general are very accepting of government surveillance, with the omnipresent CPF and now complete disclosure of almost all consumer transactions to the State. It's always surprised me, TBH, given the very recent history of dictatorship and unbounded potential for abuse.
Most people don't think about that. Once they realise things change, Brazil also uses Bitcoin a lot because of a lack of trust. Pix would be even more widely used if the government took longer to start using it as a weapon (as it has already done)
Source?
This attack was not against the Pix system itself but the systems provided by C&M, and was attributed to an employee infiltrating said system. While the attack used the Pix service to move funds, Pix worked as expected. There is nothing it can do with incoming valid but fraudulent transactions.
> While the attack used the Pix service to move funds, Pix worked as expected.
That is not the case, as it appears the attackers were able to use the Pix protocol to transfer funds from accounts not controlled by the attackers.
> There is nothing it can do with incoming valid but fraudulent transactions.
Well, we don't yet know the actual mechanism, but that is the opacity we're talking about.
It's certainly not impossible to ameliorate insider risk and it's definitely not a given that a single set of compromised developer credentials should be able to enact widespread fraudulent transactions across many banks.