How I got owned: a fake (AI) video call and social pressure
An ex-Bybit account manager, let's call him John, contacted me on Telegram and asked for a catch-up call. He wanted to introduce his new project. I've met John at several conferences and we had many calls over the years.
He sent me a link to a Microsoft Teams meeting. When I joined, video was working, but audio wasn't. There was John, his face clearly visible, and two people I didn't know. A popup said I needed to update the "TeamsFX SDK". I dismissed it, and John and I did the usual “Can you hear me?” mouthing. He appeared to react to my non-verbal interaction. I suspect this was a real-time AI video, or a cleverly cut recording.
Not wanting to keep three people waiting, I rejoined and got the update dialogue again. I checked the commands it displayed. The links all appeared to point to Microsoft repositories. I copied them and ran them in the terminal.
The audio still didn't work. John messaged me on Telegram and suggested we try again later on Google Meet.
About one hour later, my common sense came back. I checked my command history, but it was empty. Then I checked my browser history: tearnrnicrocoft[.]com/...
Fuck.
I disconnected the system and started investigating.
- The fake Teams page put different commands into my clipboard from the ones it displayed.
- The script unset the command history
- The install script downloaded an executable, which contacted a server that supplied a second executable written in Go.
- They stole my Telegram session and logged me out of my sessions. Once I got back in, I couldn't terminate theirs because my session was newer. I contacted Telegram support, but haven't received a response.
- Various credential files had access timestamps shortly after the malware ran.
- I contacted John through another channel, he was compromised in the same way. They might have recorded him during the video call to use in further attacks
As for the damage: I've rotated my keys and passwords. So far, I haven't found evidence of further misuse. The Telegram account remains unresolved.
Hopefully remains a cheap lesson.
europe is done. there is no way out. the euro will be abandoned. the only question left is who will be the scapegoat, the rich or the immigrants. we're really doing the same thing from 90 years ago
Can't read a post because its from a private account? Just ask grok what the original post was on a reply
How do you call this: negative markouts but very positive pnl? Not sure it's fair to say you should increase markout horizons when they are far outside of the prediction window. It's got something to do with trends and probabilities but i think i'm missing something... counterfactual value of selective participation (counterfactual seems to be a word loved by llms).
Good old times.
The first strategy we ran did something like 20x in one month. It worked like this:
Bitmex had pegged orders and contingent orders. A pegged order would be placed one tick below the opposing price by the matching engine on arrival. For example, a pegged buy order one tick below the best ask. A contingent order would trigger the placement of the pegged order upon a fill.
So, all we did was place trigger orders on both sides at the bbo, along with the untriggered pegged orders. When the price changed, our trigger orders would fill, and the matching engine would immediately place our pegged orders at the new price level... with zero latency.
This meant that we (and, I think, one or two other teams) would always be first in the priority queue. Back in 2018, this was incredibly valuable, as the tick size was very large relative to volatility.
It worked for three months. Then Bitmex disabled both order types because we were putting too much load on the matching engine.
GG
Yesterday we closed the book on XBTUSD — the contract that started it all.
Launched on 13 May 2016, it was the longest-running perpetual swap contract in crypto. And until we are told otherwise, the longest running derivatives contract of any kind, given TradFi still trades on contracts that expire.
Let's take a trip down memory lane one last time 💔
