Hackers attack European crypto exchange ETERBASE; steal $5.4 Million

By Waqas The Slovakian crypto exchange suffered a targeted hack attack on Monday night. This is a post from HackRead.com Read the original post: Hackers attack European crypto exchange ETERBASE; steal $5.4 Million...

Crypto Alley Shares Number Error Vulnerability

Crypto Alley Shares CAST is an Ether-based digital currency. An integer overflow vulnerability exists in the 'mintToken' function in CAST's smart contract implementation. An attacker can exploit the vulnerability to set the balance of any user to an arbitrary value...

OracleVM 3.4 : Unbreakable / etc (OVMSA-2020-0041)

The remote OracleVM system is missing necessary patches to address critical security updates : - can: peakusb: pcanusbfd: Fix info-leaks to USB devices Tomas Bortoli Orabug: 31351221 CVE-2019-19535 - media: hdpvr: Fix an error handling path in hdpvrprobe Arvind Yadav Orabug: 31352053 CVE-2017-166...

ctf-2

This repository contains the writeup for the CSAW CTF 2015, a cybersecurity competition. The writeup is written in Polish and English, with the Polish version first. The writeup covers various challenges from the competition, including web, exploit, crypto, reversing, and forensics challenges. Ea...

detherjs (>=4.2.3 <=4.2.15), secure-cookies-js (>=1.0.0 <=1.1.1) +1 more potentially affected by unknown CVE via simple-crypto-js (>=1.1.0 <=1.1.1)

simple-crypto-js NPM version =1.1.0, =4.2.3, =1.0.0, =0.1.1, =0.1.2 Source cves: unknown CVE Source advisory: OSV:GHSA-5V7R-JG9R-VQ44...

Insecure Cryptography Algorithm in simple-crypto-js

Versions of simple-crypto-js prior to 2.3.0 use AES-CBC with PKCS7 padding, which is vulnerable to padding oracle attacks. This may allow attackers to break the encryption and access sensitive data. Recommendation Upgrade to version 2.3.0 or later...

GHSA-5V7R-JG9R-VQ44 Insecure Cryptography Algorithm in simple-crypto-js

Versions of simple-crypto-js prior to 2.3.0 use AES-CBC with PKCS7 padding, which is vulnerable to padding oracle attacks. This may allow attackers to break the encryption and access sensitive data. Recommendation Upgrade to version 2.3.0 or later...

GHSA-HJ5W-XGW9-W4RJ Malicious Package in coinstrng

All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets. Recommendation Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated...

jl-wechat-sdk (>=1.0.0 <=1.2.3) potentially affected by unknown CVE via crpyto-js (=0.0.1-security)

crpyto-js NPM version =0.0.1-security is affected by a known vulnerability. The following packages have a transitive dependency on crpyto-js and may be impacted: - jl-wechat-sdk =1.0.0, =1.2.3 Source cves: unknown CVE Source advisory: OSV:GHSA-73C6-VWJH-G3QH...

Malicious Package in crpyto-js

All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets. Recommendation Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated...

Malicious Package in crytpo-js

All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets. Recommendation Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated...

EulerOS 2.0 SP5 : kernel (EulerOS-SA-2020-1938)

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - A flaw was found in the way mremap handled DAX Huge Pages. This flaw allows a local attacker with access to a DAX enabled storage to escalate...

Entropy Backdoor in text-qrcode

All versions of text-qrcode contain malicious code that overwrites the randomBytes method for the crypto module with a function that generates weak entropy. Instead of generating 32 bytes, the infected randomBytes will generate 3 bytes of entropy and hash them, resulting in a 32 byte value being...

GHSA-H5VJ-F7R9-W564 Entropy Backdoor in text-qrcode

All versions of text-qrcode contain malicious code that overwrites the randomBytes method for the crypto module with a function that generates weak entropy. Instead of generating 32 bytes, the infected randomBytes will generate 3 bytes of entropy and hash them, resulting in a 32 byte value being...

Apple’s notarization process fails to protect

In macOS Mojave, Apple introduced the concept of notarization, a process that developers can go through to ensure that their software is malware-free and must go through for their software to run on macOS Catalina. This is meant to be another layer in Apples protection against malware...

How Cryptography Lets Down Marginalized Communities

Speaking at a prestigious crypto conference this month, Seny Kamara called on the field to recognize its blind spots—and fix them...

Seny Kamara on "Crypto for the People"

Seny Kamara gave an excellent keynote talk this year at the online CRYPTO Conference. He talked about solving real-world crypto problems for marginalized communities around the world, instead of crypto problems for governments and corporations. Well worth watching and listening to...

Seny Kamara on &quot;Crypto for the People&quot;

Seny Kamara gave an excellent keynote talk this year at the online CRYPTO Conference. He talked about solving real-world crypto problems for marginalized communities around the world, instead of crypto problems for governments and corporations. Well worth watching and listening to...

Seny Kamara on &quot;Crypto for the People&quot;

Seny Kamara gave an excellent keynote talk this year at the online CRYPTO Conference. He talked about solving real-world crypto problems for marginalized communities around the world, instead of crypto problems for governments and corporations. Well worth watching and listening to...

Security Bulletin: IBM Elastic Storage Server GUI is affected by weak crypto algorithm (CVE-2020-4379)

Summary A security vulnerability has been identified in all levels of IBM Elastic Storager Server GUI. A fix for this vulnerability is available. Vulnerability Details CVEID: CVE-2020-4379 DESCRIPTION: IBM Spectrum Scale 5.0.0.0 through 5.0.4.4 uses weaker than expected cryptographic algorithms...