Tag: Cybersecurity

Unidentified Exploit Steals Over $10.5 Million in NFTs and Coins

by Blockchain News

Since December 2022, an unidentified exploit has drained more than $10.5 million in non-fungible tokens (NFTs) and coins from experienced members of the crypto community who believed they were “reasonably secure.” The alarming incident was first brought to light by MetaMask developer Taylor Monahan, who revealed that over 5,000 Ether (ETH) had been stolen. However, the extent of the losses is yet to be determined. Monahan also cautioned that no one knows how the exploit works yet.

What is particularly worrying about this exploit is that it does not target crypto newbies but rather those who are experienced in safeguarding their digital assets. As Monahan noted, the exploit is not like the usual phishing attempts or random scammers. It targets those who are “crypto native,” with multiple addresses and work within the space. Some of the known commonalities about the exploit are that it targets keys that were created from 2014 to 2022.

To safeguard their digital assets, Monahan advised crypto veterans to use a hardware wallet or migrate their funds. Those who have their assets in a single private key are especially vulnerable and should consider splitting up their assets or getting a hardware wallet. Community member Jacky Goh echoed this sentiment, stating that the unknown hack is yet another reminder to use a hardware wallet. Goh recommended moving assets worth more than $1,000 for more than a week to a hardware wallet, which can save one in the long run.

The crypto community has been grappling with cybersecurity threats, with data published by cybersecurity and anti-virus provider Kaspersky indicating that it detected over 5 million crypto phishing attacks in 2022 alone. This marks a 40% year-on-year increase compared to 2021 when the company detected around 3.5 million attacks. The rise in cyberattacks targeting the crypto community highlights the need for robust cybersecurity measures.

Moreover, the exploit highlights the need for greater awareness and education around digital asset protection. While many crypto veterans are well-versed in securing their digital assets, it is essential to stay up to date with emerging threats and vulnerabilities. The fast-paced and rapidly evolving nature of the crypto space means that vigilance is essential. By keeping a close eye on one’s digital assets and using best practices for digital asset security, one can reduce the risk of falling victim to cyberattacks.

In conclusion, the recent exploit that has stolen over $10.5 million in NFTs and coins serves as a sobering reminder of the importance of robust cybersecurity measures for crypto assets. The crypto community must remain vigilant and educate themselves on emerging threats to safeguard their digital assets effectively. By adopting best practices and staying up to date with the latest cybersecurity trends, crypto veterans can protect their assets from theft and loss.

Source

Tagged : / / / / /

MetaMask Users Email Addresses Exposed in Cybersecurity Incident

by Blockchain News

MetaMask, the popular Ethereum wallet, recently experienced a cybersecurity incident that exposed the email addresses of some of its users who submitted a customer support ticket between August 1, 2021, and February 10, 2023. Parent company ConsenSys released a blog post on April 14, 2023, which disclosed the details of the incident.

According to the post, unauthorized actors gained access to a third-party computer system that was used to process customer service requests. This allowed them to potentially view customer support tickets submitted by MetaMask users. While the tickets did not ask for information other than what was necessary to help the user, they did include a free text field that some users may have used to submit personally identifying information. This may have included economic or financial information, name, surname, date of birth, phone number, and postal address.

ConsenSys emphasized that it does not ask for personally identifying information in customer conversations, but some users may have provided it anyway. The breach may have affected up to 7,000 MetaMask users who submitted customer support tickets during the affected timeframe.

As a response to the incident, hardware wallet provider Keystone warned MetaMask users that they might receive more phishing emails. The attacker may use this swiped email database to look for potential victims. Phishing is a scam that tricks a user into providing sensitive information to an attacker. It is often performed by sending an email to the victim that appears to be from a trusted party or someone the victim knows.

ConsenSys said it had taken steps to eliminate unauthorized access in the future. As a result, tickets submitted after February 10 should be unaffected by the incident. The company also contacted the Data Protection Commission of Ireland and the Information Commissioner’s Office of the United Kingdom to report the breach. Additionally, the company’s third-party customer service provider is working with a cybersecurity and forensics team to perform a more detailed investigation of the incident.

This is not the first time MetaMask has come under scrutiny from privacy advocates. In late 2022, the company revealed that it sometimes logged users’ IP addresses. However, it updated its app in March to give users more control over which providers could obtain this information.

The incident highlights the importance of cybersecurity in the cryptocurrency industry. Users should remain vigilant and take steps to protect their personal information, such as using strong and unique passwords and enabling two-factor authentication.

Source

Tagged : / / / / /

Cryptocurrency Phishing Attacks Surge in 2022

by Blockchain News

When it comes to cryptocurrency-related cyberattacks, bad actors have seemingly reduced the use of traditional financial threats like desktop and mobile banking malware, shifting their focus to phishing. Russian cybersecurity and anti-virus provider Kaspersky has revealed that cryptocurrency phishing attacks witnessed a 40% year-on-year increase in 2022. The company detected 5,040,520 crypto phishing attacks in the year, compared with 3,596,437 in 2021. This represents a significant increase in the number of phishing attacks targeting crypto investors.

A typical phishing attack involves reaching out to investors through fake websites and communication channels that mimic official companies. Users are then prompted to share personal information such as private keys, which ultimately provides attackers unwarranted access to crypto wallets and assets. This is a serious threat, as once attackers have access to a user’s private keys, they can gain control over their cryptocurrency holdings and potentially steal their assets.

While Kaspersky could not predict if the trend would increase in 2023, phishing attacks continue to gain momentum in 2023. Most recently, in March, hardware cryptocurrency wallet provider Trezor issued a warning against attempts to steal users’ crypto by tricking investors into entering their recovery phrase on a fake Trezor site. This highlights the need for users to exercise caution and be vigilant in their interactions with cryptocurrency platforms.

In a survey conducted by Kaspersky in 2022, one out of seven respondents admitted to being affected by cryptocurrency phishing. While phishing attacks predominantly involve giveaway scams or fake wallet phishing pages, attackers continue to evolve their strategies. According to Kaspersky, “crypto still remains a symbol of getting rich quick with minimal effort,” which attracts scammers to innovate their techniques and stories to lure in unwary crypto investors.

Even established cryptocurrency platforms and their investors are not immune to phishing attacks. Arbitrum investors were recently exposed to a phishing link via its official Discord server. A hacker reportedly hacked into the Discord account of one of Arbitrum’s developers, which was then used to share a fake announcement with a phishing link. This highlights the importance of securing communication channels and taking measures to ensure that official channels are not compromised.

To protect themselves from phishing attacks, cryptocurrency investors should be wary of unsolicited communications and only interact with official channels. They should also avoid sharing their private keys or recovery phrases with anyone, even if they appear to be legitimate sources. Finally, it’s essential to use two-factor authentication and keep their software and anti-virus systems updated to ensure maximum protection against phishing attacks.

In conclusion, phishing attacks targeting cryptocurrency investors are increasing in frequency, and scammers are continually evolving their techniques to steal investors’ assets. It’s crucial for investors to remain vigilant and exercise caution in their interactions with cryptocurrency platforms to avoid falling victim to these scams. By taking the necessary precautions, investors can help safeguard their cryptocurrency holdings and prevent losses due to phishing attacks.

Source

Tagged : / / / / /

OpenAI Launches Bug Bounty Program

by Blockchain News

OpenAI, the artificial intelligence (AI) company behind ChatGPT, has announced the launch of a bug bounty program to combat privacy and cybersecurity concerns. The program rewards security researchers and ethical hackers for identifying and addressing vulnerabilities in OpenAI’s technology and company, with cash rewards ranging from $200 for low-severity findings to $20,000 for exceptional discoveries.

OpenAI has partnered with Bugcrowd, a bug bounty platform, to manage the submission and reward process, ensuring a streamlined experience for all participants. The company has also offered safe harbor protection for vulnerability research conducted in compliance with its specific guidelines. OpenAI believes that expertise and vigilance will play a crucial role in keeping its systems secure and ensuring users’ security.

The launch of the program comes in the wake of recent bans in different countries on AI technology and concerns about privacy and cybersecurity. On March 20, OpenAI suffered a data breach, which exposed user data due to a bug in an open-source library. The incident highlighted the need for increased security measures and prompted OpenAI to launch the bug bounty program.

The global community of security researchers, ethical hackers, and technology enthusiasts have been invited to participate in the program. OpenAI hopes that the initiative will help to identify and address vulnerabilities in its systems and improve its overall security posture.

The program’s rules state that researchers must comply with all applicable laws and regulations, and safe harbor protection is provided for vulnerability research conducted according to OpenAI’s guidelines. If a third party takes legal action against a security researcher who participated in the program and followed the rules, OpenAI will inform others that the researcher acted within the program’s guidelines. This is because OpenAI’s systems are connected with other third-party systems and services.

The launch of the program follows a statement by the Japanese government’s Chief Cabinet Secretary Hirokazu Matsuno, stating that Japan would consider incorporating AI technology into government systems, provided privacy and cybersecurity issues are addressed. OpenAI’s bug bounty program demonstrates the company’s commitment to addressing these concerns and improving its security posture. By inviting the global community of security researchers, ethical hackers, and technology enthusiasts to participate, OpenAI hopes to increase vigilance and expertise, directly impacting the security of its systems and ensuring users’ security.

Source

Tagged : / / / / /

Japan supports OpenAI amid concerns

by Blockchain News

OpenAI, the artificial intelligence (AI) company, has received support from Japan amidst a wave of bans by different countries and uncertainties. Japan’s Chief Cabinet Secretary Hirokazu Matsuno announced on April 10 that Japan would consider incorporating AI technology into government systems, including OpenAI’s ChatGPT chatbot, subject to privacy and cybersecurity concerns being addressed.

This announcement followed an alleged data breach on March 20, where Italy’s data protection watchdog temporarily blocked the chatbot on March 31 and directed OpenAI to immediately restrict data processing for Italian users while an investigation is ongoing.

OpenAI CEO, Sam Altman, visited Japan to meet with government officials, including Prime Minister Fumio Kishida. Matsuno expressed his support for OpenAI, stating that the Japanese government would consider adopting its technology if privacy and cybersecurity concerns are addressed.

Altman expressed his enthusiasm about engaging with Japan’s remarkable talent and creating something exceptional for the Japanese people during a press conference in Tokyo. He also mentioned his amazement at the adoption of this technology in Japan.

During his meeting with Kishida, Altman discussed the potential of the technology and how to remove any negative aspects. They also deliberated on how to be cautious about the risks and maximize AI’s benefits for people. OpenAI is considering the possibility of opening an office in Japan and extending Japanese language services.

However, OpenAI is currently being investigated by Canada’s privacy commissioner for allegedly collecting and utilizing personal information without consent. On April 4, the Office of the Privacy Commissioner of Canada announced that the probe was initiated after a complaint from an anonymous individual. Philippe Dufresne, head privacy commissioner, emphasized that his department is closely monitoring AI technology to protect Canadians’ privacy rights.

OpenAI’s technology has been the subject of controversy in different countries. Japan’s expression of support for the company amid these concerns is a positive development for OpenAI’s efforts to expand its operations globally. OpenAI’s commitment to enhancing its models’ proficiency in the Japanese language and its cultural nuances also shows its dedication to providing effective AI services to Japan. However, addressing privacy and cybersecurity concerns is crucial for OpenAI to gain wider acceptance and adoption of its technology.

Source

Tagged : / / / / /

DeFi Execs Argue KYC as Solution to Combat Money Laundering in the Industry

by Blockchain News

Decentralized finance (DeFi) has experienced tremendous growth in recent years, with its total value locked (TVL) surpassing $100 billion in August 2021. However, the lack of regulation and the prevalence of cyber attacks pose significant challenges for the industry. One of the most pressing issues in DeFi is the laundering of millions of dollars stolen from DeFi platforms into clean money. To combat this, DeFi executives at the World of Web3 (WOW) Summit in Hong Kong have argued that implementing Know Your Customer (KYC) measures can address the problem.

During a panel session titled “Blockchain Security to Smart Compliance: AML & KYC Solutions in DeFi,” industry leaders endorsed KYC as a solution to tackle Anti-Money Laundering (AML) issues. Dyma Budorin, the CEO of smart contract auditing firm Hacken, warned of the prevalence of tools readily available to hackers to “launder the money.” He described it as the “biggest issue” in the industry, where hackers can easily steal millions of dollars and launder the funds into various wallets, making it difficult to track the source of the funds. Therefore, he believes KYC is about transparency and accountability, and it should be part of the industry.

However, Victor Yim, the head of fintech at Hong Kong’s incubator for entrepreneurship, Cyberport, suggested that KYC alone would not solve all AML problems. He explained that even in traditional finance, where KYC measures are prominent, “there is still money laundering happening every day.” Despite this, Yim believes KYC measures can make a “better tomorrow” for the DeFi industry. He added that it would require a collective effort, including regulators, policy bureau, and other players, to execute successfully. He cited the concept of “anonymous traceable” as an example of a balance between anonymity and compliance, where individuals remain anonymous unless called upon by law enforcement, adding that it will “protect the good people while still getting the bad people.”

Alexander Scheer, the founder of zkMe, emphasized that different mechanisms should be used for different solutions. For example, crypto mixers need to be handled differently from DeFi front-ends and on- and off-ramps. Scheer also touched on regulations, stating that the DeFi industry should proactively take the lead and “front run” regulations before they are imposed by regulators. This proactive approach could help to ensure that regulations do not stifle innovation in the industry.

In conclusion, implementing KYC measures in DeFi could enhance transparency and accountability in the industry, making it more difficult for hackers to launder stolen funds. However, it is crucial to acknowledge that KYC alone is not a panacea for AML issues, and different mechanisms should be used for different solutions. The DeFi industry should collaborate with regulators and other stakeholders to develop effective solutions that balance compliance with innovation, safeguarding the interests of all stakeholders, and preventing bad actors from exploiting the system.

Source

Tagged : / / / / /

Cybersecurity Firm Halborn Warns of Zero-Day Vulnerabilities in Over 280 Blockchain Networks

by Blockchain News

A cybersecurity firm, Halborn, has recently warned of a vulnerability that could put over 280 blockchain networks at risk of zero-day exploits, potentially exposing at least $25 billion worth of crypto. The vulnerability, which Halborn has dubbed “Rab13s,” could have significant consequences for the affected networks, and Halborn has already worked with some networks, such as Dogecoin, Litecoin, and Zcash, to institute a fix.

The warning comes after Halborn was contracted in March 2022 to conduct a security review of Dogecoin’s codebase and found “several critical and exploitable vulnerabilities.” Halborn later discovered that these same vulnerabilities “affected over 280 other networks,” which risked billions of dollars worth of cryptocurrencies.

Halborn outlined three vulnerabilities, with the most critical one allowing an attacker to “send crafted malicious consensus messages to individual nodes, causing each to shut down.” These messages over time could expose the blockchain to a 51% attack, where an attacker controls the majority of the network’s mining hash rate or staked tokens to make a new version of the blockchain or take it offline.

Halborn found other zero-day vulnerabilities that would allow potential attackers to crash blockchain nodes by sending Remote Procedure Call (RPC) requests – a protocol allowing a program to communicate and request services from another. However, Halborn added that the likelihood of RPC-related exploits was lower, as it required valid credentials to undertake the attack.

Halborn warned that due to codebase differences between networks, not all the vulnerabilities were exploitable on all the networks, but at least one of them may be exploitable on each network. The cybersecurity firm said it was not releasing further technical details of the exploits due to their severity and added that it made a “good faith effort” to contact all affected parties to disclose the potential exploits and provide remediation for the vulnerabilities.

While Dogecoin, Zcash, and Litecoin have already implemented patches for the discovered vulnerabilities, Halborn warned that hundreds of other networks could still be exposed. The potential for these zero-day exploits to impact billions of dollars worth of cryptocurrencies underscores the importance of strong cybersecurity measures and regular security audits for blockchain networks. As the adoption of blockchain continues to grow, it is likely that hackers will continue to target vulnerabilities in these networks, making the need for robust security measures all the more critical.

Source

Tagged : / / / / /

Hong Kong Suffers Surge in Crypto Scams in 2022

by Blockchain News

A large increase in the number of financial losses brought on by bitcoin scams has been seen in Hong Kong in the year 2022. According to reports from the local police, victims of cryptocurrency scams lost a total of HK$1.7 billion in 2018, marking a 106% increase from the previous year. In addition, the number of incidents of fraud using cryptocurrencies increased by 67 percent from 2021, reaching 2,336 cases. According to the Hong Kong police CyberDefender website, these scams were responsible for more than half of the HK$3.2 billion that was taken from citizens of the city as a result of technological crimes.

The growing usage of cryptocurrencies has made it increasingly difficult for authorities to trace the origin of monies obtained via illegal activity. Fraudsters are able to conceal their names, transactions, and ultimate destination thanks to the anonymity given by cryptographic currency transactions. Because of this, following the money trail left by criminals has become increasingly difficult for law enforcement.

The Cybersecurity and Technology Crime Bureau of the Hong Kong Police Force has provided some insights into the profile of a typical fraudster operating in the cryptocurrency industry. These con artists will claim to have extensive knowledge in the financial markets, particularly when it comes to crypto assets, precious metals, or foreign exchange goods. They often use bait to entice unsuspecting victims into downloading phony investing programs that display fictitious transactions and profits.

In order to differentiate its approach to cryptocurrency regulation from China’s total ban on cryptocurrencies, which will be implemented in 2021, the government of Hong Kong has gotten actively involved in the development of bitcoin infrastructure. The Securities and Futures Commission of Hong Kong issued a request for public comment in February on the updated proposed licensing framework for cryptocurrency exchanges, which is scheduled to go into force beginning in June 2023. Despite this, it is still very important to exercise extreme caution while investing in cryptocurrencies, as con artists continue to develop new methods to abuse the weaknesses of the market.

Source

Tagged : / / / / /

Dozens of AI-Powered Chatbot Tokens Found to Be Part of honeypot schemes

by Blockchain News

PeckShield, a company that specializes in blockchain security, has sounded the alarm after discovering hundreds of tokens that falsely claim to be tied to the artificial intelligence (AI) powered chatbot ChatGPT.“

In a post dated February 20, the company disclosed that at least three “BingChatGPT” tokens seem to be part of honeypot scams. A honeypot strategy is a kind of smart contract that deceives a user into contributing Ether (ETH), which the attacker subsequently captures and collects.

In what is commonly known as a “pump and dump” scheme or a “rug pull,” PeckShield reports that at least two of the identified tokens have already lost nearly 100% of their value, while a third is at a loss of 65%. This type of scheme involves the purchase of an asset with the intention of quickly selling it at a higher price.

Typically, the organizers of a pump-and-dump scheme would orchestrate a campaign of deceptive claims and hype to entice investors to purchase tokens, and then they will discreetly sell their interest in the plan as prices go up. This is done in order to make a profit from the scam.

According to PeckShield, at least one of the malicious actors behind the tokens is known as “Deployer 0xb583,” and he is responsible for the creation of “dozens of tokens using a pump and dump strategy.”

PeckShield did not provide an explanation as to why the malicious actors are using the name BingChatGPT for their tokens; however, it is possible that the scammers are attempting to capitalize on the announcement made on February 7 that OpenAI’s ChatGPT technology will be integrated into Bing as well as Microsoft’s Edge web browser.

It’s possible that using the name “Microsoft Token” is an effort to fool victims into believing they are connected to Microsoft in some way, in order to capitalize on the buzz surrounding AI chatbots.

A research published on February 16 by the blockchain analytics company Chainalysis stated that approximately 10,000 new tokens created in 2022 exhibited all the on-chain hallmarks of being pump-and-dump operations. This information was recently made public.

According to the Blockchain analytics company, there were 1.1 million tokens released in 2018, but only 40,521 had a “effect on the crypto ecosystem.” This means that there were at least 10 swaps during four consecutive days of trading in the week after their introduction.

The company said that of of the 40,521 tokens that were introduced in 2022 and got sufficient momentum to be worth investigating, 9,902 or 24 percent had a price fall in the first week that was suggestive of likely pump and dump behaviour.

The company noted that it examined 25 specific tokens and found that “they were almost certainly designed for a pump and dump,” with malicious honeypot code that prevents new buyers from selling the token. While a price drop on its own is not an indication of wrongdoing on the part of token creators, the company noted that it examined 25 in particular and found that “they were almost certainly designed for a pump and dump.”

Source

Tagged : / / / / / / /

OneKey Addresses Vulnerability That Allowed Hardware Wallet to be Hacked

by Blockchain News

OneKey, a company that provides cryptographic hardware wallets, has said that it has already patched a flaw in its firmware that made it possible for one of its hardware wallets to be compromised in under one second.

Unciphered, a firm in the field of cybersecurity, said in a video that was uploaded on YouTube on February 10 that it has discovered a means to “break open” a OneKey Mini by taking advantage of a “Massive major flaw” and exploiting it.

It was possible, according to Eric Michaud, a partner at Unciphered, to return the OneKey Mini to “factory mode” and bypass the security pin by disassembling the device and inserting coding. This would allow a potential attacker to remove the mnemonic phrase that is used to recover a wallet. This was made possible by returning the device to “factory mode.”

“You have the central processing unit as well as the security element. Your cryptographic keys will always be stored in the secure element. Michaud noted that in a typical situation, the connections between the central processing unit (CPU), which is where the processing is done, and the secure element are encrypted.

“Well, as it turns out, in this particular instance, it wasn’t built to do so. “What you could do is put a tool in the middle that monitors the communications and intercepts them and then injects their own commands,” he said, adding: “That being said, with password phrases and basic security practices, even physical attacks disclosed by Unciphered will not affect OneKey users.” 

The company went on to emphasize that despite the fact that the vulnerability was concerning, the attack vector that was discovered by Unciphered cannot be used remotely. Instead, it necessitates “disassembly of the device and physical access through a dedicated FPGA device in the lab” in order to be possible to execute.

According to OneKey, after discussion with Unciphered, it was divulged that other wallets have been found to have similar difficulties. This was disclosed when it was discovered that other wallets had the same issue.

OneKey said that they have compensated Unciphered with bounties as a way of expressing gratitude for their contributions to the company’s security.

OneKey has said in a blog post that it has already taken significant precautions to secure the safety of its customers. These precautions include protecting customers against supply chain assaults, which occur when a hacker replaces a real wallet with one that is under their control.

Tamper-proof packaging for shipments has been one of the steps taken by OneKey, along with the use of Apple’s own supply chain service providers for the purpose of ensuring tight supply chain security management.

They have aspirations to add onboard authentication in the not too distant future and to update more recent hardware wallets with higher-level security components.

According to what was said by OneKey, the primary objective of hardware wallets has always been to safeguard the financial assets of users from cyber-attacks, computer viruses, and other potential threats; nevertheless, sadly, nothing can be completely secure.

“When we look at the entire manufacturing process of hardware wallets, from silicon crystals to chip code, from firmware to software, it’s safe to say that any hardware barrier can be breached with enough money, time, and resources; even if it’s a nuclear weapon control system.” “When we look at the entire manufacturing process of hardware wallets, from silicon crystals to chip code, from firmware to software,”

Source

Tagged : / / / / / /
Bitcoin (BTC) $ 25,664.88 3.78%
Ethereum (ETH) $ 1,744.21 5.69%
Litecoin (LTC) $ 76.71 14.35%
Bitcoin Cash (BCH) $ 101.66 8.74%