alt Hacker NewsA lot of detail on what Engineer A, B and C did. But this would've been prevented if Engineer A didn't have "a container deployment permission token on his computer".
What the fuck? On a target as big as Binance? Every developer should be treated as a liability and never be able to deploy by themselves.
This was a big time process failure -- almost every company I worked for you have to authenticate with SSO and MFA and never have static credentials for important services like Github, Google cloud, etc. They don't seem to have least-privilege in place and if they did are not consistent about applying the policy to everyone.
I wouldn't be surprised if the guys they compromised were high-level staff engineers with the keys to the kingdom so to speak so they found a loophole. Security is hard because the attack only needs one chance to get it right -- and defense needs to get it right every single time.