S11E34 – The Binance Hot Wallet Hack and Owning Your Domain

Episode Summary

On the Halloween edition, Mike and co-host Howard covered a week of security stories, starting with the theft of about $6 billion from Binance hot wallets and a leak of a Department of Homeland Security staff directory. Mike explained hot wallets, how single sign-on sessions can be cloned, and why he thinks Microsoft keeps essential security tools behind higher-priced licenses.

The middle of the show was a lesson from a new client handoff: domains held in the previous provider’s account, a backup device that had been dead for months while backups were still billed, and Intune management with no license behind it. The show closed with the GM driving-data settlement and the Character.ai bankruptcy.

Topics Covered

Binance hot wallet theft

Binance lost roughly $6 billion, in what is widely believed but unconfirmed to be a North Korean attack, reportedly traced to a misplaced developer laptop. The attackers moved funds out of hot wallets, the pre-funded accounts used to pay out transactions quickly, into coins that are harder to trace or reverse. Binance says it will make users whole. Mike’s takeaway: crypto is still a volatile wild west, and Binance account holders should take extra precautions.

DHS directory leak and single sign-on

A group calling itself the Department of Peace handed journalists what appears to be a DHS staff directory covering 40,000 or more workers, allegedly obtained through Okta. Okta says its systems were not breached. Mike compared a single sign-on session to a venue wristband that can be cloned, and said a bug in how the sign-in was implemented is a more likely explanation than a break-in.

Microsoft security behind a paywall

Mike argued that conditional access, the control that blocks replayed sign-ins from unauthorized machines, should be included for every Microsoft 365 account rather than gated behind licenses he said cost far more per user. He also noted that basic plans show only about a week of sign-in logs.

Auditing an outgoing IT provider

During a new client handoff, Mike found the client’s domains sitting in the previous provider’s account, a backup device that had died months earlier while backups were still billed, and machines enrolled in Intune after the required license was canceled, leaving no BitLocker keys or local admin access. His takeaways: own your own domain and accounts, a scheduled backup is not a verified backup until something is restored from it, and ask your provider for proof, not reassurance.

GM driving data and Character.ai

GM settled a multistate class action over selling driver behavior data to insurers, with Arizona receiving close to $6 million of a $220 million settlement. Mike noted that collection is now opt-in. He also noted that Character.ai is in bankruptcy after lawsuits, and that Disney has taken rights to its technology and hired its CEO.

Calls

• John asked whether a Hisense TV that died after a roof leak was worth repairing. Mike shared the shop rule: if a repair costs half the price of a replacement or more, replace it.