Hackers Steal Over $600 Million Worth of Cryptocurrencies from Poly Network

Hackers have siphoned $611 million worth of cryptocurrencies from a blockchain-based financial network in what's believed to be one of the largest heists targeting the digital asset industry, putting it ahead of breaches targeting exchanges Coincheck and Mt. Gox in recent years. Poly Network, a...

Users Can Be Just As Dangerous As Hackers

Among the problems stemming from our systemic failure with cybersecurity, which ranges from decades-old software-development practices to Chinese and Russian cyber-attacks, one problem gets far less attention than it should—the insider threat. But the reality is that most organizations should be ...

Sifchain: ETHEREUM_PRIVATE_KEY leaked via github

ETHEREUMPRIVATEKEY It is used to sign Ethereum transactions on the Blockchain. Steps To Reproduce: Open this url https://github.com/Sifchain/sifnode/blob/f96727748e1f44926d3bd72b1021f6c2461dee17/test/integration/start-integration-env.sh POC - screenshot attached Impact It shouldn’t be publicly...

[Bug] A critical bug in bps function

Handle hrkrshnn Vulnerability details A critical bug in bps function: PoolBase.sol function bps internal pure returns IERC20 rt // These fields are not accessible from assembly bytes memory array = msg.data; uint256 index = msg.data.length; // solhint-disable-next-line no-inline-assembly assembly...

Disrupting Ransomware by Disrupting Bitcoin

Ransomware isnt new; the idea dates back to 1986 with the "Brain" computer virus. Now, its become the criminal business model of the internet for two reasons. The first is the realization that no one values data more than its original owner, and it makes more sense to ransom it back to them --...

Xuperchain has an unspecified vulnerability

Xuperchain is an application. It provides a blockchain infrastructure to build compliant blockchain network functions. version 3.6.0 of Xuperchain contains a security vulnerability that could be exploited by an attacker to obtain partial signatures in order to recover the private key of an...

Cryptominer Farm Rigged with 3,800 PS4s Busted in Ukraine

Authorities in Ukraine have made another cybersecurity bust — this time shutting down what they said is one of the largest underground cryptomining operations ever found. The ring was apparently run by stringing together 3,800 Sony PlayStation 4 PS4 gaming consoles. Cryptominers serve as auditors...

Signature replay attacks are possible if a user's transactionId is not unique

Handle shw Vulnerability details Impact If a user's two transactions can have the same transactionId while their router addresses differ, then the fulfill and cancel signatures for one of the transaction is replayable on the other. Proof of Concept The only transaction-related data in the...

CVE-2021-35041

The blockchain node in FISCO-BCOS V2.7.2 may have a bug when dealing with unformatted packet and lead to a crash. A malicious node can send a packet continuously. The packet is in an incorrect format and cannot be decoded by the node correctly. As a result, the node may consume the memory...

CVE-2021-35041

The blockchain node in FISCO-BCOS V2.7.2 may have a bug when dealing with unformatted packet and lead to a crash. A malicious node can send a packet continuously. The packet is in an incorrect format and cannot be decoded by the node correctly. As a result, the node may consume the memory...

Format string

The blockchain node in FISCO-BCOS V2.7.2 may have a bug when dealing with unformatted packet and lead to a crash. A malicious node can send a packet continuously. The packet is in an incorrect format and cannot be decoded by the node correctly. As a result, the node may consume the memory...

CVE-2021-35041

The blockchain node in FISCO-BCOS V2.7.2 may have a bug when dealing with unformatted packet and lead to a crash. A malicious node can send a packet continuously. The packet is in an incorrect format and cannot be decoded by the node correctly. As a result, the node may consume the memory...

CVE-2021-35041

CVE-2021-35041 affects the FISCO-BCOS blockchain node (V2.7.2). The root cause is a bug in handling unformatted/incorrectly formatted packets, allowing a malicious node to repeatedly send crafted packets that the node cannot decode, causing sustained memory consumption and a crash (availability i...

FISCO BCOS 输入验证错误漏洞

FISCO BCOS is a blockchain underlying platform. FISCO-BCOS suffers from an input validation error vulnerability that stems from a possible bug in the blockchain node's handling of unformatted packets, which can lead to a crash...

Ballerina 访问控制错误漏洞

Ballerina is an open source programming language platform. Ballerina suffers from a security vulnerability that can be exploited by an attacker to replace or modify packages retrieved from BC, allowing malicious code to be injected into the Ballerina executable...

FBI/AFP-Run Encrypted Phone

For three years, the Federal Bureau of Investigation and the Australian Federal Police owned and operated a commercial encrypted phone app, called AN0M, that was used by organized crime around the world. Of course, the police were able to read everything -- I dont even know if this qualifies as a...

U.S. Recovers $2.3 Million Ransom Paid to Colonial Pipeline Hackers

In a major blow, the U.S. Department of Justice on Monday said it has recovered 63.7 bitcoins currently valued at $2.3 million paid by Colonial Pipeline to the DarkSide ransomware extortionists on May 8, pursuant to a seizure warrant that was authorized by the Northern District of California. The...

Typodetect - Detect The Active Mutations Of Domains

This tool gives blue teams, SOC's, researchers and companies the ability to detect the active mutations of their domains, thus preventing the use of these domains in fraudulent activities, such as phishing and smishing. For this, Typodetect allows the use of the latest available version of the TL...

Etherblob-Explorer - Search And Extract Blob Files On The Ethereum Blockchain Network

Search and extract blob files on the Ethereum network using Etherscan.io API. Introduction EtherBlob Explorer is a tool intended for researchers, analysts, CTF players or anyone curious enough wanting to search for different kinds of files or any meaningful human-supplied data on the Ethereum...

Ghidra-Evm - Module For Reverse Engineering Smart Contracts

In the last few years, attacks on deployed smart contracts in the Ethereum blockchain have ended up in a significant amount of stolen funds due to programming mistakes. Since smart contracts, once compiled and deployed, are complex to modify and update different practitioners have suggested the...