Monero: Attcker can trick monero wallet into reporting it recived twice as much with alternative tx_keypubs

Summary: multiple identical txpubkeys were patched, but you can still use alternative txpubkeys to get the same result. Description: An attacker can craft an XMR transaction which causes the receiving wallet to report that it received twice as much XMR as the attacker actually sent. The balance o...

Monero: A bug in the Monero wallet balance can enable theft from exchanges

Summary: A Monero bug already fixed in master allows theft from exchanges. This has been exploited again a Monero-derived coin, so the exploit may be underway currently. Description: fluffypony: Also please mention you spoke to me and I recommended you put it on HackerOne PR 3985 fixed a wallet...

CoinHive URL Shortener Abused to Secretly Mine Cryptocurrency Using Hacked Sites

Security researchers have been warning about a new malicious campaign that leverages an alternative scheme to mine cryptocurrencies without directly injecting the infamous CoinHive JavaScript into thousands of hacked websites. Coinhive is a popular browser-based service that offers website owners...

CoinHive URL Shortener Abused to Secretly Mine Cryptocurrency Using Hacked Sites

Security researchers have been warning about a new malicious campaign that leverages an alternative scheme to mine cryptocurrencies without directly injecting the infamous CoinHive JavaScript into thousands of hacked websites. Coinhive is a popular browser-based service that offers website owners...

RIG Exploit Kit Delivering Monero Miner Via PROPagate Injection Technique

Introduction Through FireEye Dynamic Threat Intelligence DTI, we observed RIG Exploit Kit EK delivering a dropper that leverages the PROPagate injection technique to inject code that downloads and executes a Monero miner similar activity has been reported by Trend Micro. Apart from leveraging a...

RIG Exploit Kit Delivering Monero Miner Via PROPagate Injection Technique

Introduction Through FireEye Dynamic Threat Intelligence DTI, we observed RIG Exploit Kit EK delivering a dropper that leverages the PROPagate injection technique to inject code that downloads and executes a Monero miner similar activity has been reported by Trend Micro. Apart from leveraging a...

Cb ThreatSight Investigation Reveals RETADUP Worm Leverages AutoIt to Launch Monero Cryptomining Campaign

While monitoring a customer’s environment, the Carbon Black ThreatSight team discovered a series of unusual alerts. Further investigation of the suspect processes revealed these alerts were related to an attacker leveraging the open-source Monero framework to launch a crypto-mining campaign. Afte...

Monero: Misreporting of received amount by show_transfers

Summary: A sender may cause showtransfers to report a higher amount that was actually sent on the recipient's showtransfers output. Description: Due to a flaw in processnewtransaction in wallet2.cpp, if the tx pubkey is present multiple times, it will decode outputs correctly as many times, and a...

Monero: monerod can be disabled by a well-timed TCP reset packet

Summary: A well-timed TCP reset RST can cause monerod or any service relying on epee to stop accepting new connections. Description: When a new connection is attempted, the handleaccept function is called. This does some error checking and finishes setting up the connection. Once the connection i...

Monero: Constant-time comparison is not always implemented; critical areas are vulnerable to key-timing attacks

In my most superficial of reviews, constant-time comparison appears to not be globally implemented at a glance, only implemented within the ref10 implementation. With that said, the following areas either appear to be vulnerable, or are potentially vulnerable, to key-timing attacks: 1. Containers...

Prowli malware takes over 40,000 devices worldwide for Monero mining

By Waqas According to a newly released report, a malicious crypto-mining and This is a post from HackRead.com Read the original post: Prowli malware takes over 40,000 devices worldwide for Monero mining...

Monero: Trusted daemon check fails when proxied through torsocks or proxychains

Summary: If torsocks1 or proxychains1 is enforced when using Monero wallet with a remote node without explicit --untrusted-daemon arguments given, the application will assume the daemon is trusted. Description: By default, the wallet checks if the daemon address can be trusted by calling...

Monero: forum.getmonero.org Shell upload

Summary: The method uploadProfile in the UsersController allows an attacker to upload a shell to the target server due to lack of image validation. Description: Steps To Reproduce: 1. Open POC https://forum.getmonero.org/uploads/profile/lNobodyl1527340454.php or...

New Mac cryptominer uses XMRig

A new Mac cryptominer was discovered this week, after affected users saw their fans whirring out of control and a process named "mshelper" gobbling up CPU time like Cookie Monster. Fortunately, this malware is not very sophisticated and is easy to remove. The malware became public knowledge in a...

WinstarNssmMiner Monero mining malware crashes PC upon detection

By Waqas Another day, another Monero cryptocurrency mining malware hits unsuspected users worldwide This is a post from HackRead.com Read the original post: WinstarNssmMiner Monero mining malware crashes PC upon detection...

New Facebook-Spread Malware Triggers Credential Theft, Cryptomining

A new malware campaign rapidly spreading via Facebook is infecting victims’ systems to steal their social media credentials and download cryptomining code. The malware, dubbed Nigelthorn by the Radware researchers who first discovered it, is being propagated via socially engineered links on...

400 popular Drupal based websites hacked to mine cryptocurrency

By Waqas Vulnerability in Drupal CMS Converted Popular Websites into Monero mining This is a post from HackRead.com Read the original post: 400 popular Drupal based websites hacked to mine cryptocurrency...

MassMiner Takes a Kitchen-Sink Approach to Cryptomining

Though it falls squarely into the trend of cryptominers setting their sights on the Monero virtual currency, the MassMiner malware family is adding its own special somethin’-somethin’ to the mix. It targets Windows servers with a variety of recent and well-known exploits – all within a single...

Kitty Cryptomining Malware Cashes in on Drupalgeddon 2.0

Yet another bad actor has taken advantage of Drupal sites still vulnerable to “Drupalgeddon 2.0,” this time to mine cryptocurrency. The bad script, dubbed the “Kitty” cryptomining malware, takes advantage of the known critical remote-code execution vulnerability in Drupal CVE-2018-7600 to target...

Monero: epee will accept an arbitrary amount of leading line-breaks in an http request

Summary: In the epee http protocol handler, as it reads a new request, it first attempts to ignore any leading carriage-returns and line-feeds. It does not have a mechanism to give up if an inordinate number of CrLfs are encountered. Description: The pertinent block of code is here:...