TECHBOARD #6: SSHole unlocks locked accounts without a password as Binance reveals how the billion-dollar theft unfolded

Real-world attacks

The multibillion-dollar attack on Binance began with a fake job interview. According to the published attack timeline, the attackers first targeted a DevOps engineer in June. While installing an AI tool, he downloaded a malicious Homebrew package. The security team detected the infection, replaced the device, and changed the login credentials. However, the attackers had already obtained information about his role and connections to other team members. In September, another developer was approached with a fake job interview. The attackers posed as representatives of a fictitious company and convinced him to download a coding assignment containing malware. It replaced a legitimate component of the pyenv tool with malicious code and evaded endpoint detection. Using the compromised device and an internal AI tool, the attackers then gained access to other engineers, including an account authorized to deploy containers.

On 29 October, the attackers deployed a malicious container and gained access to an internal service used to sign transactions. Using Ethereum’s EIP-7702 mechanism, they delegated some permissions from one of the cryptocurrency wallets to their own smart contract. As a result, even suspending withdrawals could not immediately stop the outflow of cryptocurrency. The unauthorized permissions existed directly on the blockchain, while the MPC multiparty signing system further complicated their revocation. Binance managed to freeze approximately $2.85 billion, but additional funds continued to leave for several hours after the attack was detected.

Personal data belonging to 123,200 customers was leaked from the Czech cryptocurrency exchange Coinmate. On 30 October, an attacker breached part of the company’s internal systems. According to the published information about the incident, no passwords or customer funds were compromised. However, the stolen data will most likely be used for targeted phishing and fraudulent attempts to contact users.

Vulnerability landscape

OpenSSH allows attackers to log in to accounts using any password longer than 256 characters. According to the technical analysis of SSHole, CVE-2026-123158 affects specific Linux configurations that use the musl library without PAM. Some Alpine Linux and OpenWrt deployments, as well as container environments, are particularly at risk. The vulnerability emerged from the interaction of changes introduced over several decades. Unix systems use the * character in the password database to identify accounts that cannot be accessed with a password. Since 2012, however, the musl library has returned the same character when the crypt() function encounters an error. The function refuses to process passwords longer than 256 characters. Under certain conditions, OpenSSH then compares two identical characters and incorrectly treats the authentication attempt as successful.

An older OpenSSH fix also contributed to the final attack chain. This is not a universal SSH bypass. A vulnerable configuration must use musl without PAM, allow password authentication, contain an account marked with *, and include another account with a valid hash. In official Alpine cloud images, the affected account may also have access to passwordless doas, extending the impact to root. OpenSSH released a fix in version 10.6p2. When investigating potential incidents, defenders can search authentication logs for successful password-based logins to accounts that should have been locked.

Microsoft Paint contained a vulnerability that could allow remote code execution. CVE-2026-83844 has a CVSS score of 8.1. Microsoft describes a potential attack involving a specially crafted network packet but has not published enough technical detail to explain which service is affected. The fix is available through the Microsoft Store rather than the standard Windows Update process. Administrators should therefore verify the installed version of Paint separately.

Tool tips

TrustedHive demonstrates how the privileged TrustedInstaller service can be abused to write files without authorization. The research proof of concept for Windows 11 combines the Component Based Servicing COM interface with file-path redirection using junctions. For red teamers, it offers an interesting local privilege-escalation technique. Successfully writing a file, however, does not automatically grant SYSTEM privileges.

CITADELO news

Can you recognize modern phishing before clicking a malicious link? Citadelo’s new interactive phishing quiz lets you test your reactions to fraudulent messages and situations from everyday working life.

A payment card may continue to work after its expiry date. In our new article about the Zombie Card attack, we examine research into the differences between the expiry date stored on a card and the data checked by payment terminals.

What could an attacker achieve after compromising a single device?

Red teaming tests realistic attack paths across technology, people, and processes, revealing whether your organization can detect and stop them in time.