Design/Logic Flaw

Grin before 3.1.0 allows attackers to adversely affect availability of data on a Mimblewimble blockchain...

CVE-2020-12439

CVE-2020-12439 affects Grin prior to 3.1.0. The issue allows attackers to adversely affect availability of data on a Mimblewimble blockchain. The Connected documents confirm the product (Grin), version bound (before 3.1.0), and the impact (availability disruption). There are no explicit remediati...

CVE-2020-12439

Grin before 3.1.0 allows attackers to adversely affect availability of data on a Mimblewimble blockchain...

Denial of Service Vulnerability in Mishandling of Underlying Blockchain Network Requests

Go language io/ioutil package provides ReadAll function for reading and storing data, this function will continuously apply for new memory space in the process of reading data until the requested data is stored. After testing, it is found that there are quite a number of public chains developed b...

The effects of climate change on cybersecurity

Outside the coronavirus pandemic and its related healthcare and economic fallout, climate change and cybersecurity are seen by many as the two most urgent problems facing our planet now and in the near future. They are two distinct and separate problems, to be sure. There are some areas, however,...

RSAC 2020: Blockchain is 'Garbage In', Voting Needs Paper Ballots

SAN FRANCISCO – Cryptography is at the heart of security, especially here at this week’s RSAC 2020. And during the event’s annual Cryptographer’s Panel, industry leaders broke down their top crypto-concerns, including privacy regulations, election security and blockchain. Privacy is clearly a top...

Voatz Internet Voting App Is Insecure

This paper describes the flaws in the Voatz Internet voting app: "The Ballot is Busted Before the Blockchain: A Security Analysis of Voatz, the First Internet Voting Application Used in U.S. Federal Elections." Abstract: In the 2018 midterm elections, West Virginia became the first state in the...

Researchers: Hackers Can Seize Control of Ballots Cast Using the Voatz Voting App

Security researchers have found key flaws in a mobile voting app that some states plan to use in the 2020 election that can allow hackers to launch both client- and server-side attacks that can easily manipulate or even delete someone’s vote, as well as prevent a reliable audit from taking place...

CVE-2020-6638

Grin through 2.1.1 has Insufficient Validation...

fcp_cryptoauth (=0.4.0), holochain_sodium (=0.0.1-alpha1) +6 more potentially affected by unknown CVE via rust_sodium (>=0.10.1 <=0.10.2)

rustsodium CARGO version =0.10.1, =0.0.1-alpha1, =1.0.0, =0.13.0, =0.2.0, =0.10.5 Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2020-0003...

Blockchain Developer Gets Busted After Talk in North Korea

Hacker and Ethereum developer Virgil Griffith was recently arrested by US authorities for speaking at a conference on blockchain technologies...

How Will Blockchain Technology Revolutionize Logistics?

By Waqas If you haven’t noticed, blockchain technology is taking the world by storm, catapulting technology into unchartered, new territory.... This is a post from HackRead.com Read the original post: How Will Blockchain Technology Revolutionize Logistics?...

McAfee ATR Analyzes Sodinokibi aka REvil Ransomware-as-a-Service – Follow The Money

ARCHIVED STORY McAfee ATR Analyzes Sodinokibi aka REvil Ransomware-as-a-Service – Follow The Money By John Fokker · October 14, 2019 Episode 3: Follow the Money This is the third installment of the McAfee Advanced Threat Research ATR analysis of Sodinokibi and its connections to GandCrab, the mos...

What Are Zero-Knowledge Proofs?

How do you make blockchain and other transactions truly private? With mathematical models known as zero-knowledge proofs...

A week in security (August 26 – September 1)

Last week on Malwarebytes Labs, we analysed the Android xHelper trojan, we wondered why the Nextdoor app would send out letters on behalf of their customers, reported about a study that explores the clickjacking problem across top Alexa-ranked websites, wondered how to get the board to invest in...

Theo - Ethereum Recon And Exploitation Tool

Theo aims to be an exploitation framework and a blockchain recon and interaction tool. Features: Automatic smart contract scanning which generates a list of possible exploits. Sending transactions to exploit a smart contract. Transaction pool monitor. Web3 console Frontrunning and backrunning...

Orbit v2.0 - Blockchain Transactions Investigation Tool

Introduction Orbit is designed to explore network of a blockchain wallet by recursively crawling through transaction history. The data is rendered as a graph to reveal major sources, sinks and suspicious connections. Note: Orbit only runs on Python 3.2 and above. Usage Let's start by crawling...

Presidential Candidate Andrew Yang Has Quantum Encryption Policy

At least one presidential candidate has a policy about quantum computing and encryption. It has two basic planks. One: fund quantum-resistant encryption standards. Note: NIST is already doing this. Two, fund quantum computing. Unlike many far more pressing computer security problems, the market...

On Isogenies Verifiable Delay Functions (VDF)

This continues the post frompart 1. In the previous post we discussed about Verifiable Delay Functions. Here is a quick summary of what we discussed in the first part: We covered the definition of Verifiable Delay Functions VDF. We have seen a short history of how this idea slowly developed. We...

Cryptocurrency Hacks Still Growing — What Does That Mean for the Industry?

Though once synonymous with underground networks and black hat hackers, bitcoin and other cryptocurrencies have gone mainstream over the past two years. In 2017, we saw the skyrocket of bitcoin to an all-time high of close to $20,000 followed by a significant decline the following year. But beyon...