CVE-2024-0675

Lamassu Bitcoin ATM Douro, version 7.1, is affected by a vulnerability described as improper checking for unusual or exceptional conditions. The issue could allow a physical attacker to exit kiosk mode, access the underlying Xwindow interface, and execute arbitrary commands as an unprivileged use...

CVE-2024-0675 Improper checking for unusual or exceptional conditions vulnerability in Lamassu Bitcoin ATM Douro machines

Vulnerability of improper checking for unusual or exceptional conditions in Lamassu Bitcoin ATM Douro machines, in its 7.1 version, the exploitation of which could allow an attacker with physical access to the ATM to escape kiosk mode, access the underlying Xwindow interface and execute arbitrary...

CVE-2024-0675 Improper checking for unusual or exceptional conditions vulnerability in Lamassu Bitcoin ATM Douro machines

Vulnerability of improper checking for unusual or exceptional conditions in Lamassu Bitcoin ATM Douro machines, in its 7.1 version, the exploitation of which could allow an attacker with physical access to the ATM to escape kiosk mode, access the underlying Xwindow interface and execute arbitrary...

CVE-2024-0674 Privilege escalation vulnerability in Lamassu Bitcoin ATM Douro machines

Privilege escalation vulnerability in Lamassu Bitcoin ATM Douro machines, in its 7.1 version, which could allow a local user to acquire root permissions by modifying the updatescript.js, inserting special code inside the script and creating the done.txt file. This would cause the watchdog process...

CVE-2024-0674

CVE-2024-0674 describes a privilege-escalation in Lamassu Bitcoin ATM Douro machines (version 7.1). A local user can modify updatescript.js and create done.txt, causing the watchdog to run as root and execute the payload in updatescript.js. Connected sources corroborate this root-level impact and...

CVE-2024-0674 Privilege escalation vulnerability in Lamassu Bitcoin ATM Douro machines

Privilege escalation vulnerability in Lamassu Bitcoin ATM Douro machines, in its 7.1 version, which could allow a local user to acquire root permissions by modifying the updatescript.js, inserting special code inside the script and creating the done.txt file. This would cause the watchdog process...

What the Bitcoin ETF Approval Mean for the Crypto Market

By Uzair Amir The recent green light given to a Bitcoin Exchange-Traded Fund ETF by regulatory authorities in the U.S. is… This is a post from HackRead.com Read the original post: What the Bitcoin ETF Approval Mean for the Crypto Market...

Lamassu Bitcoin ATM Douro Security Breach

Lamassu Bitcoin ATM Douro is a bitcoin ATM from Lamassu. A security vulnerability exists in the Lamassu Bitcoin ATM Douro version 7.1. An attacker can exploit this vulnerability to gain root privileges and execute the payload stored in updatescript.js...

PT-2024-15740 · Lamassu · Lamassu Bitcoin Atm Douro

Name of the Vulnerable Software and Affected Versions: Lamassu Bitcoin ATM Douro version 7.1 Description: The issue allows a local user to interact with the machine, retrieve stored hashes, and crack long 4-character passwords using a dictionary attack. This is due to a weak password requirement...

PT-2024-15739 · Lamassu · Lamassu Bitcoin Atm Douro

Name of the Vulnerable Software and Affected Versions: Lamassu Bitcoin ATM Douro version 7.1 Description: The issue is related to improper checking for unusual or exceptional conditions in the Lamassu Bitcoin ATM Douro machines. This could allow an attacker with physical access to the ATM to esca...

AllaKore RAT Malware Targeting Mexican Firms with Financial Fraud Tricks

Mexican financial institutions are under the radar of a new spear-phishing campaign that delivers a modified version of an open-source remote access trojan called AllaKore RAT. The BlackBerry Research and Intelligence Team attributed the activity to an unknown Latin America-based financially...

Kasseika Ransomware Using BYOVD Trick to Disarms Security Pre-Encryption

The ransomware group known as Kasseika has become the latest to leverage the Bring Your Own Vulnerable Driver BYOVD attack to disarm security-related processes on compromised Windows hosts, joining the likes of other groups like Akira, AvosLocker, BlackByte, and RobbinHood. The tactic allows...

Authentication Bypass

@keep-network/tbtc-v2 is vulnerable to Authentication Bypass. The vulnerability is caused by publishing specially crafted transactions on the Bitcoin blockchain, resulting in seemingly valid SPV proofs within fraudulent transactions...

SPV Merkle proof malleability allows the maintainer to prove invalid transactions

Summary By publishing specially crafted transactions on the Bitcoin blockchain, the SPV maintainer can produce seemingly valid SPV proofs for fraudulent transactions. The issue was originally identified by Least Authority in the tBTC Bridge V2 Security Audit Report as Issue B: Bitcoin SPV Merkle...

GHSA-WG2X-RV86-MMPX SPV Merkle proof malleability allows the maintainer to prove invalid transactions

Summary By publishing specially crafted transactions on the Bitcoin blockchain, the SPV maintainer can produce seemingly valid SPV proofs for fraudulent transactions. The issue was originally identified by Least Authority in the tBTC Bridge V2 Security Audit Report as Issue B: Bitcoin SPV Merkle...

The vulnerability of libraries for generating Bitcoin addresses and private keys in PyCryptodome and PyCryptodomeX lies in the exposure to information disclosure due to inconsistencies. This vulnerability allows attackers to gain unauthorized access to protected information.

The vulnerability of libraries for generating Bitcoin addresses and private keys in PyCryptodome and PyCryptodomeX involves information disclosure due to mismatches in their functionality. Exploiting this vulnerability could allow an unauthorized attacker to gain unauthorized access to protected...

What is Mallox Ransomware

Deciphering the Danger: Decoding Mallox Ransomware. Mallox Ransomware embodies a harmful software element, contributing to an ever-expanding repertoire of digital extortion threats. This cyber menace executes its mission by snaking its way into your computer system, applying a cipher to your data...

Lawmakers Are Out for Blood After a Hack of the SEC’s X Account Causes Bitcoin Chaos

The US Securities and Exchange Commission is under pressure to explain itself after its X account was compromised, leading to wild swings in the bitcoin market...

Here’s Some Bitcoin: Oh, and You’ve Been Served!

A California man who lost $100,000 in a 2021 SIM-swapping attack is suing the unknown holder of a cryptocurrency wallet that harbors his stolen funds. The case is thought to be the first in which a federal court has recognized the use of information included in a bitcoin transaction -- such as a...

The SEC’s Official X Account Was ‘Compromised’ and Used to Post Fake Bitcoin News

The US financial regulator says its official @SECGov account was “compromised,” resulting in an “unauthorized” post about the status of Bitcoin ETFs...