PT-2020-21273

Name of the Vulnerable Software and Affected Versions Package affected versions not specified Description The package contains malware designed to find and exfiltrate cryptocurrency wallets. Any computer with this package installed or running should be considered fully compromised. Recommendation...

PT-2020-21021

Name of the Vulnerable Software and Affected Versions Package affected versions not specified Description The package contains malware designed to find and exfiltrate cryptocurrency wallets. Any computer with this package installed or running should be considered fully compromised. Recommendation...

PT-2020-21594

Name of the Vulnerable Software and Affected Versions Package affected versions not specified Description The package contains malware designed to find and exfiltrate cryptocurrency wallets. Any computer with this package installed or running should be considered fully compromised. Recommendation...

PT-2020-21235

Name of the Vulnerable Software and Affected Versions Package affected versions not specified Description The package contains malware designed to find and exfiltrate cryptocurrency wallets. Any computer with this package installed or running should be considered fully compromised. Recommendation...

PT-2020-21250

Name of the Vulnerable Software and Affected Versions Package affected versions not specified Description The package contains malware designed to find and exfiltrate cryptocurrency wallets. Any computer with this package installed or running should be considered fully compromised. Recommendation...

PT-2020-21133

Name of the Vulnerable Software and Affected Versions Package affected versions not specified Description The package contains malware designed to find and exfiltrate cryptocurrency wallets. Any computer with this package installed or running should be considered fully compromised. Recommendation...

PT-2020-21501

Name of the Vulnerable Software and Affected Versions Package affected versions not specified Description The package contains malware designed to find and exfiltrate cryptocurrency wallets. Any computer with this package installed or running should be considered fully compromised. Recommendation...

PT-2020-21314

Name of the Vulnerable Software and Affected Versions Package affected versions not specified Description The package contains malware designed to find and exfiltrate cryptocurrency wallets. Any computer with this package installed or running should be considered fully compromised. Recommendation...

GHSA-H5VJ-F7R9-W564 Entropy Backdoor in text-qrcode

All versions of text-qrcode contain malicious code that overwrites the randomBytes method for the crypto module with a function that generates weak entropy. Instead of generating 32 bytes, the infected randomBytes will generate 3 bytes of entropy and hash them, resulting in a 32 byte value being...

Entropy Backdoor in text-qrcode

All versions of text-qrcode contain malicious code that overwrites the randomBytes method for the crypto module with a function that generates weak entropy. Instead of generating 32 bytes, the infected randomBytes will generate 3 bytes of entropy and hash them, resulting in a 32 byte value being...

DiceKeys

DiceKeys is a physical mechanism for creating and storing a 192-bit key. The idea is that you roll a special set of twenty-five dice, put them into a plastic jig, and then use an app to convert those dice into a key. You can then use that key for a variety of purposes, and regenerate it from the...

Mac Cryptocurrency Traders Targeted by Trojanized Apps

Mac users are being targeted by trojanized cryptocurrency trading apps, which once downloaded actually drain victims’ cryptocurrency wallets, researchers warn. The four fake applications in question, Cointrazer, Cupatrade, Licatrade and Trezarus, claim to be rebranded copies of an actual...

Brazil's Banking Trojans Go Global

Malware that is typically used in Brazil is expanding its geography, targeting users in North America, Europe and elsewhere in Latin America. Banking trojans, which steal online banking logins and other financial credentials from unsuspecting victims, are fairly common – but the more sophisticate...

Over 100 New Chrome Browser Extensions Caught Spying On Users

Google recently removed 106 more extensions from its Chrome Web Store after they were found illegally collecting sensitive user data as part of a "massive global surveillance campaign" targeting oil and gas, finance, and healthcare sectors. Awake Security, which disclosed the findings late last...

CVE-2020-14199

BIP-143 in the Bitcoin protocol specification mishandles the signing of a Segwit transaction, which allows attackers to trick a user into making two signatures in certain cases, potentially leading to a huge transaction fee. NOTE: this affects all hardware wallets. It was fixed in 1.9.1 for the...

CVE-2020-14199

BIP-143 in the Bitcoin protocol specification mishandles the signing of a Segwit transaction, which allows attackers to trick a user into making two signatures in certain cases, potentially leading to a huge transaction fee. NOTE: this affects all hardware wallets. It was fixed in 1.9.1 for the...

Design/Logic Flaw

BIP-143 in the Bitcoin protocol specification mishandles the signing of a Segwit transaction, which allows attackers to trick a user into making two signatures in certain cases, potentially leading to a huge transaction fee. NOTE: this affects all hardware wallets. It was fixed in 1.9.1 for the...

CVE-2020-14199

The CVE-2020-14199 issue is a BIP-143 signing mishandling in the Bitcoin protocol that can mislead users into producing two signatures during Segwit transactions. Affected products are Trezor One firmware before 1.9.1 and Trezor Model T firmware before 2.3.1; these devices have firmware updates t...

CVE-2020-14199

BIP-143 in the Bitcoin protocol specification mishandles the signing of a Segwit transaction, which allows attackers to trick a user into making two signatures in certain cases, potentially leading to a huge transaction fee. NOTE: this affects all hardware wallets. It was fixed in 1.9.1 for the...

PT-2020-13926

Name of the Vulnerable Software and Affected Versions: Trezor One versions prior to 1.9.1 Trezor Model T versions prior to 2.3.1 Description: The issue in the Bitcoin protocol specification, specifically BIP-143, mishandles the signing of a Segwit transaction. This allows attackers to trick a use...