YUKKA Lab

yukkalab

Hey Hackers, Non Fungible Conference, the leading experimental web3 event is back with the most radical lineup, June 7-9 2023, Lisbon. HackerNoon is proud to once again be a media partner for the event. Non Fungible Conference Details returns to the iconic Pavilhão Carlos Lopes, Lisbon, Where: Non Fungible Conference June 7-8, 2023. When: Following a sold-out debut last year, NFC is welcoming , the most talented international traditional and digital artists and , doubling footfall from the previous edition. 200 key leaders of the web3 world 5,000 guests “More” is NFC’s credo so the team have just announced an extra day to close this two days of madness with some barefoot moves. Save the date on June 9, to join a 10 hour marathon Beach Party, powered by and The Sandbox Party Degens More Info here TOKEN-BASED, ART & REWARDS NFC is implementing a new and unique approach to reshape the Web3 event format, challenge the status quo and rewrite event playbooks. It begins with a bespoke that gives genesis ticket holders free access to this 2nd edition, voting rights for curators, and other exclusive rewards. token ticketing solution The art-driven event also presents , an 3D artwork created by two legendary artists in the NFT scene, and , part of co-Editors NFC23 token Coldie Carlos Marcial Cult of Crypto Art. BYE BYE PANELS, EXPECT THE UNEXPECTED FORMAT NFC breaks the rules once again by banning panels from their festival-style schedule. The radical switch to say bye-bye to the boredom of panels will celebrate guests through new formats such as community talks, art battles, debates, talent fair, podcast, music performances and masterclasses. NFC also introduces the , to offer an artistic and sensory experience and invite undoxxed artists and collectors on stage for the first time ever. Blind Talks Expect exclusive content through a short movie, massive projections in a 600 sqm room enhanced by music, voices and lights. followed by a Q&A by these artists themselves, hidden by physically present. Confirmed anonymous acts include @muratpak @CozomoMedici @MrMisang @Hackatao @pascalboyart @basileus_eth @WhaleSharkETH and more surprises on this stage. This hybrid area and its projectors will go wild on the opening day and night, before turning into the mainstage to invite key players and partners to take the floor on day two. PARTNERS, COLLECTIONS, AND LINEUP ARE MADE OF THESE… NFC have also teamed up with the stunning collections @InvsbleFriends @rektguyNFT @ChimpersNFT @RugRadio @worldofwomennft... and invite rock stars artists and speakers such as @cyber_yuyu @trevorjonesart @Coldie @ALIENQUEENNFT @farokh @dave_krugman @shavonnewong_ @osf_rekt @Innamodja @ggcasimiro_ @yugalabs >> Line up https://www.nonfungibleconference.com/line-up include Ledger, Cult of Crypto Art, The Sandbox, BNV, Arianee, Exclusible, OVER and more to join the game. Current official partners have already been announced, so you can plan your summer ahead with private discounts in the city of Lisbon. Hotel partners HOW TO ATTEND NFC 2023? Communities are essential, so we decide to offer special prices to our frens and fam.. We started with rewarding our genesis ticket holders by giving them free entrance to NFC23. Now we are offering 95% discount. Check out our , but watch out - early birds tickets don’t last forever. dedicated page THE LOST WALLET THE ultimate treasure hunt NFC have  co-created with where all the biggest metaverses have joined, to let the players win a Crypto Punk and other prizes. Beam Builders, Started in March on until August 23. About NON FUNGIBLE CONFERENCE is the leading IRL web3 event focusing on NFT culture. The mission is to reshape events for the Web3 Age and push the boundaries. It means abandoning the status quo and rewriting event playbooks.  Thinking bigger. Taking risks. Pushing new limits. Non Fungible Conference

Summer is Calling and NFC is Boiling: The Non Fungible Conference is Back

Hey Hackers! On March 24th, an NFT trader named Brandon Riley, who goes by on Twitter, accidentally burned and destroyed the NFT forever. @vitalitygrowth CryptoPunk #685 Burning a digital asset involves sending it to a wallet address from which it can never be retrieved, which effectively removes the digital asset from circulation. Here is the transaction showing Brandon Riley purchased the CryptoPunk NFT for 77 ETH, which equaled approximately $129K dollars. https://etherscan.io/tx/0x1e37be379e864643e013a69c68ed92f064df0cf9c52c4a452335821bb35967b8 Below is the initial from Brandon Riley stating that he accidentally burned his CryptoPunk NFT. Tweet https://twitter.com/vitalitygrowth/status/1639489299254063105?embedable=true He also called on YugaLabs, the creators of CryptoPunks, to sell him a CryptoPunks ᵛ¹ NFT, which is compatible with ERC-721, as a consolation prize for his epic failure. Brandon Riley replied to his original tweet with a thread explaining how exactly he made the mistake of burning his NFT instead of wrapping it. It appears that Riley was following an online guide on how to wrap the NFT as a ERC-721 token and make it compatible with NFTfi, which is a liquidity protocol for NFTs. This was necessary as the CryptoPunks NFT collection was created before ERC-721 became the industry standard for NFTs, and therefore CryptoPunks are not compatible with some marketplaces and defi applications. In the end, Riley accidentally input the wrong wallet address, and just like that the NFT was lost forever. Brandon Riley claimed that his intention, for wrapping the NFT, was to borrow liquidity against it, and not because he intended to sell it on the upstart NFT marketplace, Blur, as rumors suggested. “Please keep in mind I’m not a dev, not at all familiar with these contracts, and don’t really understand how wrapped punks work. The reality is, that because I’m so unfamiliar I should have had another set of eyes. In hindsight it’s very easy to see all of the mistakes I made. ” This is truly a devastating mistake for me. But I did this myself, and it is no one’s fault but my own. Both the beauty and the curse of self-custody. Stay safe out there everyone, and please be way more careful than I was. Thank you to so many of you for the kind words. , -Brandon Riley @vitalitygrowth Seeing a story like this is quite sad, and I really can’t feel anything but sorry for this NFT trader for the mistake he made. There is also a lesson to be learned from this, and it is that if you do not know what you are doing in the world of web3, then you could potentially make a huge mistake and lose your assets. Transactions made on the blockchain are permanent and there is no customer support to help you recover assets. This puts all the responsibility on you, the user, to be sure of what you are doing or you could run the risk of losing everything. What are your thoughts on this news? How would you react if you just burned an NFT worth 77 ETH? Would you be sharing the news on Twitter? Do you have sympathy for someone who makes a huge mistake like this? Enter my on Publish0x to win yourself some free Crypto! Monthly Giveaway Check out my Socials: https://linktr.ee/zerorequiem0x See ya! :) Also published here.

This Fatal Mistake Led to a $129K Loss for This NFT Trader

এই মারাত্মক ভুল এই NFT ব্যবসায়ীর জন্য $129K ক্ষতির দিকে পরিচালিত করেছে

Dieser fatale Fehler führte zu einem Verlust von 129.000 US-Dollar für diesen NFT-Händler

Este error fatal condujo a una pérdida de $ 129K para este comerciante de NFT

Cette erreur fatale a entraîné une perte de 129 000 $ pour ce trader NFT

इस घातक गलती के कारण इस NFT ट्रेडर को $129K का नुकसान हुआ

この致命的なミスにより、この NFT トレーダーは 12 万 9,000 ドルの損失を被りました

이 치명적인 실수로 인해 이 NFT 트레이더는 129,000달러의 손실을 입었습니다.

Este erro fatal levou a uma perda de $ 129.000 para este comerciante NFT

Bu Ölümcül Hata, Bu NFT Yatırımcısının 129 Bin Dolar Kaybına Yol Açtı

Sai lầm nghiêm trọng này đã dẫn đến khoản lỗ 129 nghìn đô la cho nhà giao dịch NFT này

这个致命错误导致这位 NFT 交易员损失 12.9 万美元

September 16 was a regular day in Slack for Uber staff. Team members were chatting about their schedules for the week and the latest updates on their projects. Ideally, a couple of channels were filled with the usual banter and idle conversation, while others were quiet—waiting for someone to break the silence. Safe to say, nothing seemed out of place. Not even a new user who had joined the company's channel. This user used the name 'Nwave' without a profile picture, biography, or job description. But no one thought much of this—none of the staff had a reason to. Workers modify profiles all the time. Then, something else happened. The newcomer announced had hacked into Uber's data. According to screenshots , the message reads: they posted on social media platforms A deluge of emojis followed the announcement—satirical sirens, laid-back popcorns, mocking faces, and lighthearted alarms. The message's brazenness, to the staff, looked like a TikTok prank. They thought it was a joke and made GIFs to meme the situation. Some even started interacting with the hacker. At that point, no one knew the extent of the hack and that an 18-year-old intruder who had been learning cybersecurity used Uber as a practice ground. More significantly, the staff didn't know such news would make its way to the front pages of the , prompting several security alerts from partners and reactions from the cybersecurity industry. New York Times First off, how did the Uber breach happen? Let's begin by dissecting the announcement. ' I am a hacker, and Uber has suffered a data breach... A hacker has advanced knowledge of computer systems and networks and can use that knowledge to break into or 'hack' into other people's systems. There are three types of hackers: : A black hat hacker uses their skills, maliciously, to gain access to, or otherwise, disrupt computer systems and networks. They usually do so without permission and often to cause harm, such as stealing information or money. Black Hat A white hat hacker uses their skills for good by finding security flaws in systems, and reporting their fixing before actual harm is caused. White Hat: A grey hat hacker performs hacking activities but may not have malicious motives behind their actions. Instead, they might be interested in learning about how things work or playing around with new technology for fun. Grey Hat: In an article published by , there's a psychological benefit to profiling hackers with an emphasis on security awareness. Still, there's a level to which the profiling can go if we must deflect influence from the hacker to the hacked. In Uber's case, the latter prevailed. Infosec Institute There was nowhere the hijacker was named. All we know about him is that a teenager (18 years old) who claimed to have just learned some cybersecurity skills. But affiliated with , a notorious hacking group. Still, are they black-hat, white-hat, or grey-hat? Further details will reveal that. Let's look at the breach. they're Uber says they're Lapsus$ A data breach or leak is a security incident in which unauthorized access to data occurs. The accessed data may be confidential, private, or public. An puts the total cost of a data breach in the United States at $4.24 million in 2022. IBM report Stats narrowed down. A points to California as the state suffering the most data breaches in the United States within 15 years. Worryingly, Uber is based in San Francisco, California. Still, we can't judge the breach's impact or conclude about the hacker until we know what was stolen or exposed. Comparitech study ...Slack has been stolen, confidential data, along with secrets from sneakers…' Slack is a popular communication tool for organizations, often called 'the corporate Facebook.' It's a great way to keep everyone in your company in the loop on projects as it helps teams share documents and files. Due to its multiple collaboration features and integration benefits, Slack boasts active users. Additionally, 65% of the Fortune 100 pay for the platform, not forgetting the 750,000 organizations, according to . more than 10 million DMR Despite its benefits, Slack isn't immune to cyber threats. Its user growth ensures it's often an infiltration target by hackers. If hijackers are not targeting the platform as a whole, they're looking into individual companies on the platform to breach. In 2015, a major cyber attack. The impact led to the adoption of two-factor authentication. Although the company hasn't been comprehensively breached since then, it has served as a backdoor avenue for infiltrating other companies. Social media giant, , was hacked through Slack in 2020; Video Game Maker, , in 2021; and now the ride-hailing service, Uber. Slack suffered Twitter Electronic Arts In all of these breaches, companies lost several data pieces worth hundreds of dollars. It's the same for Uber.  The hacker mentioned stealing Uber's Atlassian Confluence, stored data called , and two mono-repos (a single repository with many projects) from the cross-platform software, Phabricator. further shared they had secrets from sneakers and posted screenshots to back them up. stash They ready-to-spill Uber, , confirmed the unauthorized access. It pared down the theft to internal communications and engineering systems, which included the Slack server, AWS console, Google Workspace, VMware virtual machines, corporate email accounts, and most importantly, the company's HackerOne bug bounty program, where researchers discuss critical IT vulnerabilities. in its report uberunderpaisdrives Easily the most profound statement in the announcement is the hashtag , wrongly spelled as #uberunderpaisdrives. It's not unusual for hackers to use their skills to cause social or economic change, or make a political statement. But does this qualify the action of this intruder as white-hat, black-hat, or grey-hat? #uberunderpaysdrivers On the surface, Uber could be underpaying drivers. In 2017, the ride-hailing company riders in New York City for more than two years. However, looking deep into it, hackers are known to hide under social advocacy to gain public sentiments. admitted to accidentally underpaying Thus, labeling the intruder seems hurried. The extent of damage is unknown as investigations continue. Whether this hacker had access to sensitive customer data and what planned to do with it remains unclear. Whereas the person(s) have presented to the New York Times and even for , being part of Lapsus$ is . they themselves shared their Telegram channel white-hat discussion black-hat for a larger scheme The meat: How the hacker got in According to a series of tweets from , CMO Zellic.io, , Security Engineer, Yugalabs, and , the hacker used social engineering plus MFA fatigue. Corben Leo Sam Curry VX-Underground Social engineering uses human interaction and manipulation to gain access to computer systems. Social engineers use deception, influence, and persuasion to trick people into giving up confidential information, performing actions, or installing software that compromises security. They often pose as members of the target organization or company, or they may pose as someone else entirely (for example, a law enforcement officer). that over 98% of cyberattack relies on social engineering to show the severity of this form of attack. PurpleSec reports MFA fatigue refers to users getting bored with multi-factor authentication (MFA) and choosing not to comply with it eventually. It happens for several reasons, but the most common one is that users find MFA too inconvenient or annoying. In Uber's case, it happened this way: The hacker used several social engineering techniques to compromise an Uber employee's (probably employees’) account. The attacker sent about the need for MFA from their account. This led to MFA fatigue in the employee, who ultimately gave up compliance. repeated notifications The attacker then sent a WhatsApp message pretending to be a member of Uber IT, asking for login approval. The employee complied and gave them access to their Slack account. From Slack, the attacker proceeded to access network resources, targeting PowerShell scripts. One of the scripts contained hard-coded credentials for an administrator account, which allowed the attacker to gain access to multiple other systems. MFA fatigue isn't a new attack vector—it was used against and in August this year. In fact, Uber suffered a similar fate in 2016, when it lost sensitive data to intruders. MailChimp Twilio Cybersecurity lessons from the Uber breach The breach has prompted many experts to weigh in with their opinions on what companies can do to prevent these types of attacks from happening in the future. Below are preliminary lessons sourced from cybersecurity experts on CyberWire: #1. Attackers have the edge Jai Dargan, Chief of Staff at Axio, reminded us again that attacks are inevitable. Even though we don't know who is behind this attack, it's safe to assume they're well-funded and highly motivated. To highlight the impact, the placed cyber attacks and data fraud as third in the most worrisome outlook for companies. World Economic Forum Insight Report The hack also gives us a glimpse into how attackers have evolved. Jyoti Bansal, Co-founder and CEO of Traceable AI, said, 'the Uber breach is an example of how attackers have such an edge over defenders, and how their goals have evolved.' Attackers are no longer looking for a quick profit like they did in the past. Now, they're trying to steal data for future use—and that means defenders have to match the approach. #2. MFA isn't sufficient Multifactorial authentication (MFA) has been the standard for years. However, it's no longer reliable, given all the ways attackers can bypass it. and found at least four ways they could circumvent MFA or diminish its benefits. The result points to the fact that MFA, only, isn't sufficient. CyberArk carried out an analysis Instead, Darryl Athans, Vice President of North America at SENHASEGURA, wants organizations to include privileged access management (PAM) and user and entity behavior analytics (UEBA) in their MFA. The former ensures only authorized users have access to sensitive data. The latter monitors user behavior and detects anomalies to identify potential threats before they become an issue. #3. Human links are weak The Uber breach serves as a reminder that humans are some of the weakest links in any security system. A strong password and two-factor authentication aren't enough when someone can call your cell phone company and pose as you. Former NSA Director Admiral, Michael S. Rogers, believes the solution is to increase user security awareness. Here are proposed ways to achieve that: Educate your users about social engineering risks and how to avoid them. Ensure that your employees take time to change their passwords regularly and use a secure password manager to help them do so. Create an awareness campaign about MFA fatigue, including information about what it is, its impact on cybersecurity, and what they can do. Train your employees on recognizing phishing notifications. This will help them catch malicious alerts before they fall for them. #4. Zero trust is a necessity Another lesson is the need to eliminate implicit trust by verifying and validating every stage of the security process. Doing this is known as zero trust, and according to , it helps reduce costs. It's often $1.76 million less in zero-trust-adopting companies compared to non-adopting ones. a report by IBM John Dasher, VP of Product Marketing at Banyan Security, believes the solution is to shore up human weaknesses with sound zero trust technology. By adopting a zero trust strategy, using the principle of least privilege access, and employing device trust, you can help take human judgment out of the equation. What's next for Uber after the breach? Uber has announced that it's bringing back its internal software tool after taking it down as a precaution following the breach. Services are now operational. In its latest report, it said no sensitive user data was compromised. However, experts believed the breach was deep access. According to , companies that suffer breaches underperform in the market due to poor brand perception. The breach has already impacted Uber's performance in the market. Checking on Tuesday, (NYSE: UBER) shares traded lower by 0.35% at $31.38 premarket. It remains to be seen how Uber handles this situation—whether or not they can bounce back quickly enough for investors and customers alike. a study by Comparitech Updated The British police have arrested the alleged hacker behind the Uber breach, whose name has been revealed to be Tea Pot (aka teapotuberhacker). The young man is said to be around 17 years old and is not 18 as previously believed. According to a , he was arrested in Oxfordshire alongside seven other teenagers. The hacker used "Breachbase" and "White" as his online aliases. Reports say that he had made around $14 million from cybercrimes. tweet by the City of London Police

How an 18-Year-Old Teen Breached Uber Without Hacking a Single System

Cómo un adolescente de 18 años violó Uber sin hackear un solo sistema

Comment un adolescent de 18 ans a piraté Uber sans pirater un seul système

कैसे एक 18 साल के किशोर ने एक भी सिस्टम हैक किए बिना उबर का उल्लंघन किया

18 歳の 10 代の若者が、システムを 1 つもハッキングせずに Uber に侵入した方法

Como um adolescente de 18 anos invadiu o Uber sem invadir um único sistema

Làm thế nào một thiếu niên 18 tuổi đột nhập Uber mà không cần hack một hệ thống duy nhất

一个 18 岁的青少年如何在不入侵单个系统的情况下入侵 Uber

Stories, News & Mentions about YUKKALAB

Yukkalab’s Stories on HackerNoon