Enter: Frictionless Transferring of Wallet Ownership

In the Robocoin application, users can create their own personal or operator wallets and then share it with other Robocoin users. It was observed that this sharing of wallets with other users is frictionless. In other words, the users with whom the wallet is shared with Let's say B and C are not...

Bitstamp Offline Following Wallet Compromise

Bitstamp, a Bitcoin exchange based in the United Kingdom, remains offline this afternoon following what appears to have been a compromise over the weekend. The company tweeted shortly after 4 a.m. Monday that it had to temporarily halt all withdrawals because it believes one of its wallets was...

Enter: stored xss in transaction

Open wallet settings and remove maxlength="30" from wallet name input 2. Change name to something like this asdf'"alert1 3. Go to "Send bitcoin" and make inbound transfer from one wallet to another with description: descalert'xss in description' 4. Submit form 5. After submit we got xss both in...

Enter: Stored XSS in api key of operator wallet

Make an operation wallet 2. Open wallet settings 3. Press "New key" 4. In source code remove "maxlength=30" of key's name input tag - no length check on server-side 5. Fill name input with "asdf" PoC 6. Press "Generate Key" 7. After that when open wallet settings we got XSS. 8. In case we can...

CVE-2014-6881

The PNC Virtual Wallet aka com.pnc.ecommerce.mobile.vw.android application before 2.2 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Information disclosure

The PNC Virtual Wallet aka com.pnc.ecommerce.mobile.vw.android application before 2.2 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-6881

The PNC Virtual Wallet aka com.pnc.ecommerce.mobile.vw.android application before 2.2 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-6881

The CVE-2014-6881 entry concerns the PNC Virtual Wallet Android app (package com.pnc.ecommerce.mobile.vw.android) prior to version 2.2. The vulnerability is a lack of SSL certificate validation, allowing MITM attackers to spoof servers and obtain sensitive information via crafted certificates. Th...

[SECURITY] Fedora 20 Update: kwalletmanager-4.14.1-1.fc20

KDE Wallet Manager is a tool to manage the passwords on your KDE system...

Bitcoin Phishing Scam Takes Aim at 400 Organizations

More than 400 organizations were recently targeted by a Bitcoin phishing campaign that intended to con users into disclosing their wallet passwords. According to Proofpoint, a California-based email security firm that recapped the campaign Wednesday, 12,000 messages were recently sent in two wave...

Android new vulnerability exposure: hack may fake and authentic applications-vulnerability warning-the black bar safety net

Ticker 7 on 3 0 September morning news, on Tuesday released a study on the display, the Google Android operating system has a security vulnerability that can allow a hacker to fake a trusted formal application, thereby hijacking the user's smartphone or tablet. The security company Bluebox Securi...

Android "Fake ID" Vulnerability Allows Malware to Impersonate Trusted Apps

Due to the majority in the mobile platform, Google’s Android operating system has been a prior target for cybercriminals and a recently exposed weakness in the way the operating system handles certificate validation, left millions of Android devices open to attack. Researchers at BlueBox security...

Critical Android FakeID Bug Allows Attackers to Impersonate Trusted Apps

There is a critical vulnerability in millions of Android devices that allows a malicious app to impersonate a trusted application in a transparent way, enabling an attacker to take a number of actions, including inserting malicious code into a legitimate app or even take complete control of an...

Android Ransomware First to Encrypt Data on Mobile Devices

A strain of ransomware that encrypts data on Android mobile devices, the first of its kind, has spread to 13 countries since it was first spotted less than a month ago. Researchers at Kaspersky Lab today disclosed details on Pletor, an expensive Trojan that popped up on an underground forum selli...

New Ransomware Malware takes Advantage of Windows PowerShell

Ransomware is one of the most blatant and obvious money making schemes for cybercriminals and it was most likely to be known when last year Cryptolocker ransomware targeted millions of computers worldwide. Recently, security researchers at the Antivirus firm TrendLabs have unearthed another...

Coinbase: Bypassing 2FA for BTC transfers

Under advanced settings, users have the ability to protect their wallet by requiring two-factor confirmation when sending bitcoins. Personally, I have configured my account with the most secure option, which requires two factor confirmation when sending any amount of bitcoins. However, a flaw...

Design/Logic Flaw

The engineNextBytes function in classlib/modules/security/src/main/java/common/org/apache/harmony/security/provider/crypto/SHA1PRNGSecureRandomImpl.java in the SecureRandom implementation in Apache Harmony through 6.0M3, as used in the Java Cryptography Architecture JCA in Android before 4.4 and...

CVE-2013-7372

CVE-2013-7372 affects the SecureRandom implementation in Apache Harmony (SHA1PRNG_SecureRandomImpl) used by JCA in Android up to version 4.3/4.4 boundaries. The engineNextBytes function uses an incorrect offset when no user seed is provided, making the PRNG output more predictable and enabling at...

Coinbase: Coinbase Android Application - Bitcoin Wallet Leaks OAuth Response Code

Hi, There's a simple bug here, the Coinbase Android App. "BitCoin Wallet" leaks the OAuth Response Code which can be obtained using adb logcat -s Coinbase command line for testing, and any Android application on the same phone can read the response code for the user by reading the logs. As of now...

MtGox Hacker tricks people to install Bitcoin Stealer

This News will blow everyone’s mind! If you are a bitcoins holder then you might be aware of MtGox, Once the World's biggest Bitcoin exchange. MtGox filed for bankruptcy last month after saying it lost some 8,50,000 Bitcoins to hackers and suddenly went dark with no explanations. A few days ago,...