1136 matches found
Malicious code in blockchain-contracts (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a999a1b33fbea1c383e34a3e37196b2d9e96946685c3fbbff0720c1295e4bec1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2023-8688 Malicious code in blockchain-contracts (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a999a1b33fbea1c383e34a3e37196b2d9e96946685c3fbbff0720c1295e4bec1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
U.S. Treasury Sanctions Sinbad Cryptocurrency Mixer Used by North Korean Hackers
The U.S. Treasury Department on Wednesday imposed sanctions against Sinbad, a virtual currency mixer that has been put to use by the North Korea-linked Lazarus Group to launder ill-gotten proceeds. "Sinbad has processed millions of dollars' worth of virtual currency from Lazarus Group heists,...
The withdrawCarry() function always reverts because of an incorrect assumption.
Lines of code Vulnerability details Impact The Compound protocol's CTokens have 8 decimal places, but the team mistakenly believed that cNote also had only 8 decimal places. However, it was discovered that cNote actually has 18 decimal places. This discrepancy caused the withdrawCarry function to...
Missing pause checks in LRTOracle
Lines of code Vulnerability details Summary The LRTOracle oracle provides functionality to pause the contract but no restrictions are applied when the contract is in a paused state. Impact Similar to the other contracts in the protocol, the LRTOracle contract offers pausing functionality: 101: //...
CVE-2023-46132
CVE-2023-46132 describes a cross-linking attack against Hyperledger Fabric blocks where transaction encodings can be manipulated without changing the block hash. The connected documents provide concrete technical details and fixes: Fabric blocks hash transactions by naive concatenation, allowing ...
Missing deadline checks
Lines of code Vulnerability details Consider addings implementation to handle the expiration of the transaction for additional security. To implement a transaction expiration mechanism in the emergencyWithdraw add a timestamp check to ensure that the transaction is executed only within a certain...
Lazarus Group uses KandyKorn macOS malware for crypto theft
By Deeba Ahmed Another day, another malware operation by the infamous Lazarus group targeting blockchain engineers and crypto users. This is a post from HackRead.com Read the original post: Lazarus Group uses KandyKorn macOS malware for crypto theft...
India Blockchain Week (IBW) Unveils Diverse Speaker Line-up
By Owais Sultan India Blockchain Week IBW, the country’s flagship series of blockchain and Web3 events held in Bangalore from Dec.4-10, is… This is a post from HackRead.com Read the original post: India Blockchain Week IBW Unveils Diverse Speaker Line-up...
North Korean Hackers Targeting Crypto Experts with KANDYKORN macOS Malware
State-sponsored threat actors from the Democratic People's Republic of Korea DPRK have been found targeting blockchain engineers of an unnamed crypto exchange platform via Discord with a novel macOS malware dubbed KANDYKORN. Elastic Security Labs said the activity, traced back to April 2023,...
Horse Racing Game NEOBRED Integrates with Avalanche for Elite Gaming Experience
By Owais Sultan NEOBRED, a blockchain horse racing game, has announced that it is integrating with the Avalanche blockchain. The integration… This is a post from HackRead.com Read the original post: Horse Racing Game NEOBRED Integrates with Avalanche for Elite Gaming Experience...
blockchain-kurse.de Improper Access Control vulnerability OBB-3764889
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
Analysis: A Ransomware Attack on a PostgreSQL Database
In 2017, we reported on a database ransomware campaign targeting MySQL and MongoDB. Since then, we’ve observed similar attack tactics on a PostgreSQL database in Imperva Threat Research lab. In general, the attack flow contained: A brute force attack on the database for known users and weak...
The Fake Browser Update Scam Gets a Makeover
One of the oldest malware tricks in the book -- hacked websites claiming visitors need to update their Web browser before they can view any content -- has roared back to life in the past few months. New research shows the attackers behind one such scheme have developed an ingenious way of keeping...
Security Vulnerability of Switzerland’s E-Voting System
Online voting is insecure, period. This doesnt stop organizations and governments from using it. And for low-stakes elections, its probably fine. Switzerland--not low stakes--uses online voting for national elections. Andrew Appel explains why its a bad idea: Last year, I published a 5-part serie...
Binance's Smart Chain Exploited in New 'EtherHiding' Malware Campaign
Threat actors have been observed serving malicious code by utilizing Binance's Smart Chain BSC contracts in what has been described as the "next level of bulletproof hosting." The campaign, detected two months ago, has been codenamed EtherHiding by Guardio Labs. The novel twist marks the latest...
North Korea's Lazarus Group Launders $900 Million in Cryptocurrency
As much as $7 billion in cryptocurrency has been illicitly laundered through cross-chain crime, with the North Korea-linked Lazarus Group linked to the theft of roughly $900 million of those proceeds between July 2022 and July of this year. "As traditional entities such as mixers continue to be...
North Korea's Lazarus Group Suspected in $31 Million CoinEx Heist
The North Korea-affiliated Lazarus Group has stolen nearly $240 million in cryptocurrency since June 2023, marking a significant escalation of its hacks. According to multiple reports from Certik, Elliptic, and ZachXBT, the infamous hacking group is said to be suspected behind the theft of $31...
