CVE-2021-43839

Cronos is a commercial implementation of a blockchain. In Cronos nodes running versions before v0.6.5, it is possible to take transaction fees from Cosmos SDK's FeeCollector for the current block by sending a custom crafted MsgEthereumTx. This problem has been patched in Cronos v0.6.5. There are ...

Design/Logic Flaw

Cronos is a commercial implementation of a blockchain. In Cronos nodes running versions before v0.6.5, it is possible to take transaction fees from Cosmos SDK's FeeCollector for the current block by sending a custom crafted MsgEthereumTx. This problem has been patched in Cronos v0.6.5. There are ...

CVE-2021-43839 Drainage of FeeCollector's Block Transaction Fees

Cronos is a commercial implementation of a blockchain. In Cronos nodes running versions before v0.6.5, it is possible to take transaction fees from Cosmos SDK's FeeCollector for the current block by sending a custom crafted MsgEthereumTx. This problem has been patched in Cronos v0.6.5. There are ...

CVE-2021-43839

Cronos v0.6.5 fixes a vulnerability in Cronos nodes earlier than v0.6.5 where an attacker could drain the current-block transaction fees from Cosmos SDK’s FeeCollector by sending a crafted MsgEthereumTx. Affected: Cronos prior to v0.6.5. Root cause: improper handling enabling fee drainage at the ...

Security Bulletin: IBM MQ Blockchain bridge dependencies are vulnerable to an issue in Apache Log4j (CVE-2021-45046)

Summary A Remote Code Execution issue was identified within the Log4j fix for CVE-2021-44228 that is used by Fabric Gateway to provide logging functionality. Fabric Gateway is used by the IBM MQ blockchain bridge component of IBM MQ to provide connection capability between IBM MQ queue managers a...

Google Shuts Down Glupteba Botnet, Sues Operators

Google took steps to shut down the Glupteba botnet, at least for now. The botnet uses the bitcoin blockchain as a backup command-and-control mechanism, making it hard to get rid of it permanently. So Google is also suing the botnets operators. Its an interesting strategy. Lets see if its successf...

Google disrupts Glupteba blockchain botnet that infected 1mn PCs

By Waqas Google has also filed a lawsuit against the alleged Russian threat actors and operators of Glupteba Botnet. This is a post from HackRead.com Read the original post: Google disrupts Glupteba blockchain botnet that infected 1mn PCs...

CVE-2021-25526

Intent redirection vulnerability in Samsung Blockchain Wallet prior to version 1.3.02.8 allows attacker to execute privileged action...

CVE-2021-25526

Intent redirection vulnerability in Samsung Blockchain Wallet prior to version 1.3.02.8 allows attacker to execute privileged action...

Information disclosure

Intent redirection vulnerability in Samsung Blockchain Wallet prior to version 1.3.02.8 allows attacker to execute privileged action...

CVE-2021-25526

CVE-2021-25526 describes an intent redirection vulnerability in Samsung Blockchain Wallet versions prior to 1.3.02.8. The issue, affecting the wallet component, allows an attacker to cause privileged actions to be executed via faulty redirection. Technical details consistently point to Samsung’s ...

CVE-2021-25526

Intent redirection vulnerability in Samsung Blockchain Wallet prior to version 1.3.02.8 allows attacker to execute privileged action...

Samsung Blockchain Wallet 安全漏洞

Samsung Blockchain Wallet is an unmanaged cryptocurrency wallet service from South Korean company Samsung. A security vulnerability exists in Samsung Blockchain Wallet versions prior to 1.3.02.8, which stems from a faulty redirection in the software that allows an attacker to perform privileged...

PT-2021-16716 · Samsung · Samsung Blockchain Wallet

Name of the Vulnerable Software and Affected Versions: Samsung Blockchain Wallet versions prior to 1.3.02.8 Description: The issue allows an attacker to execute privileged actions due to an intent redirection vulnerability. Recommendations: For versions prior to 1.3.02.8, update to version 1.3.02...

Google Takes Down Glupteba Botnet; Files Lawsuit Against Operators

Google’s Threat Analysis Group TAG has disrupted the blockchain-enabled botnet known as Glupteba, which is made up of around 1 million compromised Windows and internet of things IoT devices. In tandem, Google also filed a lawsuit against the botnet’s operators. Glupteba, already a formidable...

Smart Contract Bug Results in $31 Million Loss

A hacker stole $31 million from the blockchain company MonoX Finance , by exploiting a bug in software the service uses to draft smart contracts. Specifically, the hack used the same token as both the tokenIn and tokenOut, which are methods for exchanging the value of one token for another. MonoX...

RewardReinvestor Is Vulnerable To Sandwich Attacks

Handle leastwood Vulnerability details Impact The splitReinvest function in RewardReinvestor is called upon by bonded users. An attacker can monitor the blockchain for calls to this function and launch a sandwich attack in combination with a flash loan to steal funds. A malicious user is...

“Crypto” Means “Cryptography,” Not “Cryptocurrency”

I have long been annoyed that the word "crypto" has been co-opted by the blockchain people, and no longer refers to "cryptography." Im not the only one...

Cosmos: Unclaimed official s3 bucket of tendermint(tendermint-packages) which is used by many other blockchain companies in their code

An unclaimed official S3 bucket of Tendermint, which was also used by many other blockchain companies and developers, was discovered. An attacker could have hosted malicious files on the bucket, causing harm to the companies or developers using it for package installation. The vulnerability has...

CVE-2021-41135

The Cosmos-SDK is a framework for building blockchain applications in Golang. Affected versions of the SDK were vulnerable to a consensus halt due to non-deterministic behaviour in a ValidateBasic method in the x/authz module. The MsgGrant of the x/authz module contains a Grant field which includ...