Fintech security: the challenges and fails of a new era

"I have no idea how this app from my bank works, and I don't trust what I don't understand." Josh is not an old curmudgeon or luddite. He's 42 with a decent understanding of technology. Nevertheless, the changes in fintech have come too fast for him. It's not that he doesn't trust his bank. He...

Vivin Nets Thousands of Dollars Using Cryptomining Malware

A recently uncovered threat actor, dubbed Vivin, has made thousands of U.S. dollars through a large-scale cryptomining campaign. Vivin is unique due to its longevity — the threat actor has been active since at least 2017 — and researchers with Cisco Talos point to Vivin as a good example of why...

Breaking down a two-year run of Vivin’s cryptominers

News Summary There is another large-scale cryptomining attack from an actor we are tracking as "Vivin" that has been active since at least November 2017. "Vivin" has consistently evolved over the past few years, despite having poor operational security and exposing key details of their campaign. ...

CVE-2020-6638

Grin through 2.1.1 has Insufficient Validation...

CVE-2020-6638

Grin through 2.1.1 has Insufficient Validation...

CVE-2020-6638

Grin through 2.1.1 has Insufficient Validation...

Defend Yourself Now and in the Future Against Mobile Malware

The world has gone mobile and the US is leading the way. It’s estimated that that the number of smartphone users alone topped 257 million in the States in 2018. That means three-quarters 74% of households now boast at least one mobile device. And in this new digital world, it’s mobile application...

Operation AppleJeus Sequel

The Lazarus group is currently one of the most active and prolific APT actors. In 2018, Kaspersky published a report on one of their campaigns, named Operation AppleJeus. Notably, this operation marked the first time Lazarus had targeted macOS users, with the group inventing a fake company in ord...

Chrome Extension Stealing Cryptocurrency Keys and Passwords

A malicious Chrome extension surreptitiously steals Ethereum keys and passwords: According to Denley, the extension is dangerous to users in two ways. First, any funds ETH coins and ERC0-based tokens managed directly inside the extension are at risk. Denley says that the extension sends the priva...

DDQ override vulnerability

DDQ is a cryptocurrency. A security vulnerability in the 'owned' function in DDQ's smart contract implementation stems from the function's failure to check the identity of the caller. An attacker could use the vulnerability to modify the owner of a smart contract...

NewIntelTechMedia Overreach Vulnerability

NewIntelTechMedia NETM is a cryptocurrency. An override vulnerability exists in the 'quaker' function in the smart contract implementation of NewIntelTechMedia NETM, which stems from the fact that the function does not check the identity of the caller. An attacker could use the vulnerability to...

RansomCoin - A DFIR Tool To Extract Cryptocoin Addresses And Other Indicators Of Compromise From Binaries

Extracting metadata and hardcoded Indicators of Compromise from ransomware, in a scalable, efficient, way with cuckoo integrations. Ideally, is it run during cuckoo dynamic analysis, but can also be used for static analysis on large collections of ransomware. Designed to be fast, with low false...

GHSA-HM6Q-R2JC-CPQH lodahs is malware

All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets. Recommendation Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated...

lodahs is malware

All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets. Recommendation Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated...

CVE-2019-19771

The lodahs package 0.0.1 for Node.js is a Trojan horse, and may have been installed by persons who mistyped the lodash package name. In particular, the Trojan horse finds and exfiltrates cryptocurrency wallets...

Design/Logic Flaw

The lodahs package 0.0.1 for Node.js is a Trojan horse, and may have been installed by persons who mistyped the lodash package name. In particular, the Trojan horse finds and exfiltrates cryptocurrency wallets...

CVE-2019-19771

The lodahs package 0.0.1 for Node.js is a Trojan horse, and may have been installed by persons who mistyped the lodash package name. In particular, the Trojan horse finds and exfiltrates cryptocurrency wallets...

CVE-2019-19771

CVE-2019-19771 concerns the lodahs package (Node.js) version 0.0.1, a malware trojan masquerading as lodash that installs via mistyped npm package names and exfiltrates cryptocurrency wallets. Multiple sources (Red Hat, NVD, GHSA, OSV, CNVD, CVE lists) describe it as malware affecting Node.js env...

Threat Analysis Unit (TAU) Threat Intelligence Notification: Skidmap

Hijacking machine resources and using them to mine for cryptocurrency continues to be an attractive and lucrative target for threat actors. As we’ve continued to see this type of attack used, we’ve also seen more platforms being targeted. Seeing cryptocurrency mining malware targeting Linux and...

ShapeShift KeepKey Buffer Overflow Vulnerability

ShapeShift KeepKey is an e-wallet device for cryptocurrency storage. ShapeShift KeepKey suffers from a punch zone overflow vulnerability. The vulnerability stems from a networked system or product performing operations in memory without properly validating data boundaries, resulting in incorrect...