CVE-2023-50428: Undefined Security Weakness

In Bitcoin Core through 26.0 and Bitcoin Knots before 25.1.knots20231115, datacarrier size limits can be bypassed by obfuscating data as code e.g., with OPFALSE OPIF, as exploited in the wild by Inscriptions in 2022 and 2023. NOTE: although this is a vulnerability from the perspective of the...

CVE-2023-50428

In Bitcoin Core through 26.0 and Bitcoin Knots before 25.1.knots20231115, datacarrier size limits can be bypassed by obfuscating data as code e.g., with OPFALSE OPIF, as exploited in the wild by Inscriptions in 2022 and 2023. NOTE: although this is a vulnerability from the perspective of the...

VulnCheck KEV: CVE-2023-50428

In Bitcoin Core through 26.0 and Bitcoin Knots before 25.1.knots20231115, datacarrier size limits can be bypassed by obfuscating data as code e.g., with OPFALSE OPIF, as exploited in the wild by Inscriptions in 2022 and 2023. NOTE: although this is a vulnerability from the perspective of the...

SUSE CVE-2023-37192

Memory management and protection issues in Bitcoin Core v22 allows attackers to modify the stored sending address within the app's memory, potentially allowing them to redirect Bitcoin transactions to wallets of their own choosing...

US Seizes Bitcoin Mixer Sinbad.io Used by Lazarus Group

By Waqas US Treasury Sanctions Sinbad.io for Laundering Millions in Stolen Funds Linked to North Korea's Lazarus Group. This is a post from HackRead.com Read the original post: US Seizes Bitcoin Mixer Sinbad.io Used by Lazarus Group...

Crimeware and financial cyberthreats in 2024

At Kaspersky, we constantly monitor the financial cyberthreat landscape, which includes threats to financial institutions, such as banks, and financially motivated threats, such as ransomware, that target a broader range of industries. As part of our Kaspersky Security Bulletin, we try to predict...

Randstorm Exploit: Bitcoin Wallets Created b/w 2011-2015 Vulnerable to Hacking

Bitcoin wallets created between 2011 and 2015 are susceptible to a new kind of exploit called Randstorm that makes it possible to recover passwords and gain unauthorized access to a multitude of wallets spanning several blockchain platforms. "Randstorm is a term we coined to describe a collection...

Russia’s 2nd-Largest Insurer Rosgosstrakh Hacked; 400GB of Data Sold Online

By Waqas The hackers are selling the trove of data for $50,000 in Bitcoin BTC or Monero XMR cryptocurrency. This is a post from HackRead.com Read the original post: Russias 2nd-Largest Insurer Rosgosstrakh Hacked; 400GB of Data Sold Online...

YoroTrooper: Researchers Warn of Kazakhstan's Stealthy Cyber Espionage Group

A relatively new threat actor known as YoroTrooper is likely made up of operators originating from Kazakhstan. The assessment, which comes from Cisco Talos, is based on their fluency in Kazakh and Russian, use of Tenge to pay for operating infrastructure, and very limited targeting of Kazakhstani...

Malvertising Campaign Targets Brazil's PIX Payment System with GoPIX Malware

The popularity of Brazil's PIX instant payment system has made it a lucrative target for threat actors looking to generate illicit profits using a new malware called GoPIX. Kaspersky, which has been tracking the active campaign since December 2022, said the attacks are pulled off using malicious...

bitcoin-core:policy_estimator_io: Crash in FuzzedFileProvider::seek

Detailed Report: https://oss-fuzz.com/testcase?key=5350197397684224 Project: bitcoin-core Fuzzing Engine: libFuzzer Fuzz Target: policyestimatorio Job Type: libfuzzerasani386bitcoin-core Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0xffffffff Crash State: FuzzedFileProvider::seek...

Analysis: A Ransomware Attack on a PostgreSQL Database

In 2017, we reported on a database ransomware campaign targeting MySQL and MongoDB. Since then, we’ve observed similar attack tactics on a PostgreSQL database in Imperva Threat Research lab. In general, the attack flow contained: A brute force attack on the database for known users and weak...

Stealer for PIX payment system, new Lumar stealer and Rhysida ransomware

Introduction As a cybersecurity company, Kaspersky is constantly dealing with known and brand-new malware samples. As part of our crimeware reporting service, we provide our customers with technical reports on the evolution of existing crimeware families, as well as newly emerging ones. In this...

They Cracked the Code to a Locked USB Drive Worth $235 Million in Bitcoin. Then It Got Weird

Stefan Thomas lost the password to an encrypted USB drive holding 7,002 bitcoins. One team of hackers believes they can unlock it—if they can get Thomas to let them...

bitcoin-core:autofile: Crash in FuzzedFileProvider::seek

Detailed Report: https://oss-fuzz.com/testcase?key=4569342472486912 Project: bitcoin-core Fuzzing Engine: libFuzzer Fuzz Target: autofile Job Type: libfuzzerasani386bitcoin-core Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0xffffe52d Crash State: FuzzedFileProvider::seek IOdowrite...

bitcoin-core:http_request: Use-of-uninitialized-value in evutil_inet_pton

Project: https://github.com/bitcoin/bitcoin.git Detailed Report: https://oss-fuzz.com/testcase?key=5567073029586944 Project: bitcoin-core Fuzzing Engine: libFuzzer Fuzz Target: httprequest Job Type: libfuzzermsanbitcoin-core Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address:...

US Police Recover $3M Stolen by Pakistani Crypto Scammers

By Waqas The crypto scammers convinced a victim in the United States to transfer their Bitcoin to a Kraken cryptocurrency account that the victim did not control. This is a post from HackRead.com Read the original post: US Police Recover $3M Stolen by Pakistani Crypto Scammers...

PT-2023-10706 · Bitcoin · Bitcoind

Name of the Vulnerable Software and Affected Versions: Bitcoin versions prior to the fix for BIP-0050 Description: A issue occurred due to a large number of total transaction inputs being broadcasted, which were rejected by some nodes and not rejected by others, causing a fork. Recommendations: A...

The vulnerability of the library for handling Bitcoin transactions and blocks in Libbitcoin Explorer (BX) allows a hacker to expose the protected information.

The vulnerability of the Libbitcoin Explorer BX for processing Bitcoin transactions and blocks is related to the use of a insecure random number generator program. Exploiting this vulnerability could allow an attacker, operating remotely, to disclose sensitive information...

CVE-2015-6964

MultiBit HD before 0.1.2 allows attackers to conduct bit-flipping attacks that insert unspendable Bitcoin addresses into the list that MultiBit uses to send fees to the developers. Attackers cannot realistically steal these fees for themselves. This occurs because there is no message authenticati...