WordPress Bitcoin Payments – Blockonomics Security Vulnerabilities

Paypal BBP #99 - Filter Bypass & Persistent Vulnerability

...

AspxCommerce 2.0 - Arbitrary File Upload

...

NSA Intelligence Agency spies on International Credit Card Transactions including Visa

"The truth is coming, and it cannot be stopped", Edward Snowden. The National Security Agency isn't just snooping into phone and online communications. It also appears to be keeping a close eye on credit card transactions. New reports published by Der Spiegel exposed that The National Security...

NSA Intelligence Agency spies on International Credit Card Transactions including Visa

"The truth is coming, and it cannot be stopped", Edward Snowden. The National Security Agency isn’t just snooping into phone and online communications. It also appears to be keeping a close eye on credit card transactions. New reports published by Der Spiegel exposed that The National Security...

Bitcoins - Secured by NSA designed Encryption or Backdoored ?

It's been nearly three months since Edward Snowden started telling the world about the National Security Agency's mass surveillance of global communications. After the last week report that the National Security Agency has leveraged its cooperative relationships with specific industry partners to.....

Bitcoins - Secured by NSA designed Encryption or Backdoored ?

It’s been nearly three months since Edward Snowden started telling the world about the National Security Agency’s mass surveillance of global communications. After the last week report that the National Security Agency has leveraged its cooperative relationships with specific industry partners to.....

CVE-2013-5700

The Bloom Filter implementation in bitcoind and Bitcoin-Qt 0.8.x before 0.8.4rc1 allows remote attackers to cause a denial of service (divide-by-zero error and daemon crash) via a crafted sequence of...

CVE-2013-5700

The Bloom Filter implementation in bitcoind and Bitcoin-Qt 0.8.x before 0.8.4rc1 allows remote attackers to cause a denial of service (divide-by-zero error and daemon crash) via a crafted sequence of...

Design/Logic Flaw

The Bloom Filter implementation in bitcoind and Bitcoin-Qt 0.8.x before 0.8.4rc1 allows remote attackers to cause a denial of service (divide-by-zero error and daemon crash) via a crafted sequence of...

Threat Outbreak Alert: Fake Bank Payment Information Email Messages on September 3, 2013

Medium Alert ID: 30650 First Published: 2013 September 4 19:19 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages that claim to contain payment advice from Bank of America for the recipient. The text in the email message attempts to convince...

Update to Bitcoin Client Fixes DoS Bug, Password Strength

The developers behind Bitcoin-QT, a software wallet used to protect and back up Bitcoin currency, have pushed out a new version of the client, fixing a critical denial-of-service bug, three security issues and fortifying password security. Version 0.8.4 of the original Bitcoin client was posted to....

Threat Outbreak Alert: Fake Order Payment Confirmation Email Messages on April 29, 2013

Medium Alert ID: 30608 First Published: 2013 August 30 11:00 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages that claim to contain an order payment confirmation for the recipient. The text in the email message attempts to convince the...

Threat Outbreak Alert: Malicious Personal Pictures Attachment Email Messages on April 7, 2014

Medium Alert ID: 30527 First Published: 2013 August 28 19:34 GMT Last Updated: 2014 April 8 12:53 GMT Version: 81 Summary Cisco Security has detected significant activity related to spam email messages that claim to contain personal pictures for the recipient. The text in the message body...

Paypal Account Deletion

...

Warning: Android Bitcoin wallet apps vulnerable to theft

A critical vulnerability in the Android implementation of the _Java SecureRandom random number generator _was discovered, that leaves Bitcoin digital wallets on the mobile platform vulnerable to theft. Before the announcement was made, users on the forums had noticed over 55 BTC were stolen a...

Warning: Android Bitcoin wallet apps vulnerable to theft

A critical vulnerability in the Android implementation of the _Java SecureRandom random number generator _was discovered, that leaves Bitcoin digital wallets on the mobile platform vulnerable to theft. Before the announcement was made, users on the forums had noticed over 55 BTC were stolen a...

Threat Outbreak Alert: Fake Payment Notification Email Messages on August 9, 2013

Medium Alert ID: 30381 First Published: 2013 August 12 16:28 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages that claim to contain a payment notification attachment for the recipient. The text in the email message attempts to convince the...

Bitcoin Wallets on Android Vulnerable to Theft

Bitcoin wallets on the Android platform are vulnerable to theft after a vulnerability was discovered that could allow an attacker to guess a private key used to secure transactions involving the virtual currency. A post to a Bitcoin forum over the weekend pointed to a report of one address having.....

Criminals rapidly migrating to new digital Currency 'Perfect Money' after Liberty Reserve takedown

There are so many ways to move money anonymously on the Internet and US Justice Department has declared war on currencies widely used by cyber criminals. Just after the Law Enforcement in 17 countries shuts down 'Liberty Reserve', a $6 billion digital money laundering operation, now the criminals.....

Criminals rapidly migrating to new digital Currency 'Perfect Money' after Liberty Reserve takedown

There are so many ways to move money anonymously on the Internet and US Justice Department has declared war on currencies widely used by cyber criminals. Just after the Law Enforcement in 17 countries shuts down 'Liberty Reserve', a $6 billion digital money laundering operation, now the criminals.....

Один сервер, Tor и Bitcoin

Всем доброго времени суток. В последнее время достаточно много новостей о Tor и Bitcoin, обе системы в достаточной мере направлены на безопасность и анонимность, однако их преимущества могут одновременно стать и недостатками. Структура Tor не позволяет определять местоположение клиента и...

Threat Outbreak Alert: Fake Payment Notification Email Messages on August 5, 2013

Medium Alert ID: 30322 First Published: 2013 August 5 18:48 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages that claim to contain a payment notification for the recipient. The text in the email message attempts to convince the recipient...

CVE-2013-3220

bitcoind and Bitcoin-Qt before 0.4.9rc2, 0.5.x before 0.5.8rc2, 0.6.x before 0.6.5rc2, and 0.7.x before 0.7.3rc2, and wxBitcoin, do not properly consider whether a block's size could require an excessive number of database locks, which allows remote attackers to cause a denial of service (split)...

CVE-2013-4627

Unspecified vulnerability in bitcoind and Bitcoin-Qt 0.8.x allows remote attackers to cause a denial of service (memory consumption) via a large amount of tx message...

CVE-2013-4165

The HTTPAuthorized function in bitcoinrpc.cpp in bitcoind 0.8.1 provides information about authentication failure upon detecting the first incorrect byte of a password, which makes it easier for remote attackers to determine passwords via a timing side-channel...

CVE-2013-3219

bitcoind and Bitcoin-Qt 0.8.x before 0.8.1 do not enforce a certain block protocol rule, which allows remote attackers to bypass intended access restrictions and conduct double-spending attacks via a large block that triggers incorrect Berkeley DB locking in older product...

Code injection

bitcoind and Bitcoin-Qt before 0.4.9rc2, 0.5.x before 0.5.8rc2, 0.6.x before 0.6.5rc2, and 0.7.x before 0.7.3rc2, and wxBitcoin, do not properly consider whether a block's size could require an excessive number of database locks, which allows remote attackers to cause a denial of service (split)...

Authentication flaw

The HTTPAuthorized function in bitcoinrpc.cpp in bitcoind 0.8.1 provides information about authentication failure upon detecting the first incorrect byte of a password, which makes it easier for remote attackers to determine passwords via a timing side-channel...

Design/Logic Flaw

Unspecified vulnerability in bitcoind and Bitcoin-Qt 0.8.x allows remote attackers to cause a denial of service (memory consumption) via a large amount of tx message...

CVE-2013-3219

bitcoind and Bitcoin-Qt 0.8.x before 0.8.1 do not enforce a certain block protocol rule, which allows remote attackers to bypass intended access restrictions and conduct double-spending attacks via a large block that triggers incorrect Berkeley DB locking in older product...

CVE-2013-4165

The HTTPAuthorized function in bitcoinrpc.cpp in bitcoind 0.8.1 provides information about authentication failure upon detecting the first incorrect byte of a password, which makes it easier for remote attackers to determine passwords via a timing side-channel...

Design/Logic Flaw

bitcoind and Bitcoin-Qt 0.8.x before 0.8.1 do not enforce a certain block protocol rule, which allows remote attackers to bypass intended access restrictions and conduct double-spending attacks via a large block that triggers incorrect Berkeley DB locking in older product...

CVE-2013-3220

bitcoind and Bitcoin-Qt before 0.4.9rc2, 0.5.x before 0.5.8rc2, 0.6.x before 0.6.5rc2, and 0.7.x before 0.7.3rc2, and wxBitcoin, do not properly consider whether a block's size could require an excessive number of database locks, which allows remote attackers to cause a denial of service (split)...

CVE-2013-4627

Unspecified vulnerability in bitcoind and Bitcoin-Qt 0.8.x allows remote attackers to cause a denial of service (memory consumption) via a large amount of tx message...

CVE-2013-4165

The HTTPAuthorized function in bitcoinrpc.cpp in bitcoind 0.8.1 provides information about authentication failure upon detecting the first incorrect byte of a password, which makes it easier for remote attackers to determine passwords via a timing side-channel attack. Bugs ...

CVE-2013-3219

bitcoind and Bitcoin-Qt 0.8.x before 0.8.1 do not enforce a certain block protocol rule, which allows remote attackers to bypass intended access restrictions and conduct double-spending attacks via a large block that triggers incorrect Berkeley DB locking in older product...

CVE-2013-4627

Unspecified vulnerability in bitcoind and Bitcoin-Qt 0.8.x allows remote attackers to cause a denial of service (memory consumption) via a large amount of tx message...

CVE-2013-3220

bitcoind and Bitcoin-Qt before 0.4.9rc2, 0.5.x before 0.5.8rc2, 0.6.x before 0.6.5rc2, and 0.7.x before 0.7.3rc2, and wxBitcoin, do not properly consider whether a block's size could require an excessive number of database locks, which allows remote attackers to cause a denial of service (split)...

Karsten Nohl Demonstrates SIM Card Root Attack At Black Hat

LAS VEGAS–Thanks to manufacturers employing old, weak encryption on SIM cards, researchers have found a way to root the cards and get access to billions of mobile devices. German security researcher Karsten Nohl of Security Research Labs demonstrated the SIM card attack in his talk at the Black...

Threat Outbreak Alert: Fake Payment Notification Email Messages on July 30, 2013

Medium Alert ID: 30257 First Published: 2013 July 30 15:18 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages that claim to contain a payment notification attachment for the recipient. The text in the email message attempts to convince the...

Threat Outbreak Alert: Fake Bank Payment Information Email Messages on August 19, 2013

Medium Alert ID: 30204 First Published: 2013 July 24 16:26 GMT Last Updated: 2013 August 19 17:23 GMT Version: 3 Summary Cisco Security has detected significant activity related to spam email messages that claim to contain bank payment information for the recipient. The text in the email...

Threat Outbreak Alert: Fake Incoming Money Transfer Notification Email Messages on March 23, 2015

Medium Alert ID: 30193 First Published: 2013 July 23 19:02 GMT Last Updated: 2015 March 24 13:27 GMT Version: 20 Summary Cisco Security has detected significant activity related to spam email messages that claim to contain an incoming money transfer notification for the recipient. The text...

Threat Outbreak Alert: Fake Business Complaint Notification Email Messages on January 28, 2014

Medium Alert ID: 30178 First Published: 2013 July 23 15:38 GMT Last Updated: 2014 January 29 13:51 GMT Version: 25 Summary Cisco Security has detected significant activity related to spam email messages that claim to contain a business complaint notification for the recipient. The text in...

Threat Outbreak Alert: Fake Payment Advice Email Messages on July 19, 2013

Medium Alert ID: 30149 First Published: 2013 July 19 18:16 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages that claim to contain payment advice for the recipient. The text in the email message attempts to convince the recipient to open...

Bug Bounty to Reward Researchers with Redeemable Points

IntegraXor, a manufacturer of supervisory control and data acquisition (SCADA) equipment, announced last week that it would implement a bug bounty program offering points redeemable for company services to researchers that disclose security vulnerabilities in their IGX SCADA system. In most bug...

Threat Outbreak Alert: Fake Bank Payment Information Email Messages on July 15, 2013

Medium Alert ID: 30085 First Published: 2013 July 15 18:42 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages that claim to contain bank payment information for the recipient. The text in the email message attempts to convince the recipient...

Threat Outbreak Alert: Fake Photo Email Messages on November 18, 2013

Medium Alert ID: 30072 First Published: 2013 July 15 12:49 GMT Last Updated: 2013 November 18 22:45 GMT Version: 5 Summary Cisco Security has detected significant activity related to spam email messages that claim to contain a personal photo for the recipient. The text in the email message...

Threat Outbreak Alert: Fake Canceled Electronic Payment Notification Email Messages on July 12, 2013

Medium Alert ID: 30071 First Published: 2013 July 15 12:46 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages that claim to contain a payment cancellation notification for the recipient. The text in the email message attempts to convince the...

The Rapidly Changing World of Mobile Application Payment Systems Compliance

In this series of Compliance Talk, Dirk and Ken are back at their favorite coffee shop, this time joined by Dan Fritsche. Dan is Coalfire's Director of Solution Validated Services and is considered a thought leader on mobile payments, P2PE and other emerging trends in the payments...

PayPal Enumeration / Information Disclosure

...