PeckShield: there were 23 security incidents in May, and racketry was on the rise

Original title: PeckShield: 23 security incidents in May, rampant racketry

Source: PeckShield

DeFi  security

There were two DeFi security incidents in May, as follows:

1) on May 07, a serious front-end error occurred in the Loopring protocol. The key material was set to a range of 32-bit integers. Due to the fact that the user's EdDSA key pair is limited to a 32-bit integer space, the hacker can find out all the user's EdDSA key pair by exhaustive analysis. As a result, the Loopring Exchange was shut down for half a day for maintenance upgrades.

2) on May 18, the tBTC team was suspected to have found a major contract loophole, so the top-up service was temporarily suspended and reviewed again. TBTC is a trust-free erc-20 token secured by redeemable BTC. The project's main network went live on May 15.

PeckShield review:As the DeFi project becomes more and more functional, the security issues hidden in the DeFi project are gradually exposed, which is very serious given its close relationship with user assets. PeckShield recommends that DeFi project parties do a full security audit with a DeFi team that has in-depth knowledge of DeFi product design in order to avoid potential security risks before going online.

Trading platform security

Six security incidents related to trading platforms occurred in May:

1) according to Youbi trading platform official information, Youbi from & NBSP; After the subscription of Taiwan dollar was opened on May 6th, the server was unable to be accessed for a short time due to the DDOS attack of heavy traffic for 3 consecutive days.

2) on May 1st, the official announcement of coinstar trading platform said that its website bitsg and app suffered from continuous DOSS attacks, which resulted in the failure to log in normally during certain periods of time.

3) on May 27, the LMEX stock exchange issued a notice about the operation adjustment of the trading platform in the community, saying: the platform was hacked and stolen and lost 150,000 USDT, resulting in low debt of the platform capital, which has been closed for charging.

4) recently, some media reported that the zhengzhou office of fubit trading platform was deserted. After being questioned by investors, fubit officially announced that it was insolvent and launched a liquidation plan.

5) at the end of last year, 34,000 ETH was stolen from the Upbit trading platform. In nearly half a year, hackers conducted multi-channel money laundering operations on stolen assets, which has been basically cleaned recently.

6) an official notice issued by UEX trading platform said: the platform was attacked by hackers, and it will take about five days to repair and verify the data. During the database repair, the platform will shut down charging and withdrawal and internal transfer.

PeckShield review:In view of the endless security incidents of the trading platform, the trading platform should use a more secure prevention system, similar to DDoS attack. The trading platform can be configured with multiple spare machines to avoid the risks brought to the system by a single point of failure. In addition, also does not exclude the existence of some small trading platform, in the name of being attacked line "run away" the actual malicious behavior.

Public security chain

A total of 1 serious public security problems occurred in May:

1) pomegranate pool technicians found serious vulnerabilities in the Filecoin code, through which the unlimited additional Filecoin can be realized. Pomegranate said that in order to prove the effectiveness of the vulnerability, the three miner accounts of 6Block, t01043, t027999 and t0234783, have realized the additional issuance of 1.6 billion Filecoin through the vulnerability, occupying the top three of the Filecoin rich list. The 6Block team independently discovered and reported the vulnerability to the Filecoin authorities, and is now actively assisting the authorities to complete the fix.

PeckShield review:Once the vulnerability on the public chain is found, it will have a great impact on the whole chain ecology. Therefore, before the official version of the public chain goes online, it is necessary to do security testing and vulnerability screening, and seek audit from a third-party security company to avoid affecting the public chain ecology due to the threat of the vulnerability.

Blackmail associated

There were also three typical blackmailings in May & NBSP; , such as:

1) the anonymous hackers obtained the data of more than 129 million Russian car owners and exposed them to the "dark web" for blackmail in order to obtain cryptocurrency, according to a report by the Russian media RBC.

2) Grubman Shire Meiselas & Sacks is attacked by REvil ransomware, also known as Sodinokibi, which threatens to release up to 756 gigabytes of stolen data nine times. The stolen data includes confidentiality contracts, phone Numbers, email addresses, personal communications, confidentiality agreements, etc.

3) cyber security company group-ib has warned that a new ransomware called ProLock, which relies on a Qakbot banking Trojan, has emerged in recent months. The victims include local governments, financial, medical and retail institutions. The ransomware attack demanded a total of 35 bitcoin ransoms, currently worth $337,750, according to group-ib.

PeckShield review:Extortion security incidents have always been a major hidden danger affecting the entire Internet ecology, not limited to the ecology of the blockchain. In addition, after the popularity of cryptocurrencies in the blockchain field, criminals often use the better anonymity of cryptocurrencies such as bitcoin to carry out extortion fraud.

The racketeering incident

In addition to the above, there were a number of cases of racketeering and running away in May. For example:

1) the procuratorate of dongyang city, zhejiang province has launched a public prosecution against a digital currency fraud, which amounted to 380 million yuan and involved more than 3,000 victims. The fraud group used WeChat, QQ and other methods to attract customers, falsely claiming that they could get high returns from investing in digital currency as bait, and induced customers to invest in the digital currency trading platform developed by the company.

2) a swindler posing as sun yuchen, founder of wave field, attempted to steal money from unsuspecting victims under the guise of forging a partnership with TRON.

3) police in maanshan city, anhui province arrested a telecom fraudster surnamed rao who had absconded to the dongxiang district. The suspect surnamed rao from 2019 to 2020 & cake; During the year, together with others, the victims were defrauded of more than 7 million yuan on the overseas "SABCT investment platform" by inducing them to invest virtual currency.

4) sun et al. operated the "super wallet" APP, enticing users to store it for hosting, and then shut down the platform to embede virtual currency. At present, sun and others have been arrested by the hanjiang procuratorate in putian city, fujian province. This case is a new type of crime case which USES the virtual currency platform to commit fraud. It is the first case of virtual currency fraud in hanjiang district.

5) some fraudsters are using the images of famous people to broadcast live on the Youtube platform, and at the same time releasing bitcoin addresses to commit fraud. Among those found are Chamath Palihapitiya, founder and CEO of Social Capital; Brad Smith, President of Microsoft; and lei jun, founder of xiaomi.

6) recently, the police in zibo, shandong province cracked an online platform investment fraud case supervised by the ministry of public security. Fraud rings with high interest rate for investment in virtual currency as bait, let the country 20& NBSP; 300& NBSP; across provinces; Many people were deceived and the amount involved was as high as 30 million yuan.

7) in some of the scam emails, fraudsters impersonated ioc members and asked people to donate to an encrypted bitcoin (BTC) wallet "belonging to the international Olympic committee".

8) CoinCorner reports that Google Ads is advertising CoinCorner corner r.com, a phishing clone that mimics CoinCorner.

PeckShield review:Due to the lack of user awareness, criminals often design some ponzi schemes with low investment and high returns, and take advantage of people's profit-seeking psychology to set up layers. Those are not uncommon, the use of high interest return of the funds, financial management wallet and other types of fraud fraud is typical.

Other security incidents

1) tencent security threat intelligence center detected that H2Miner Trojan used SaltStack remote command execution vulnerability to invade enterprise hosts for mining.

2) the security company Red Canary recently discovered that the hacker group BlueMockingBird had targeted thousands of corporate computers to illegally mine cryptocurrency. The hackers specifically targeted public-facing servers running ASP. After gaining access to the servers, the hackers downloaded and installed the Monroe coin mining application XMRRig.

3) a number of supercomputers across Europe, including the UK, Germany and Switzerland, have been infected with cryptocurrency mining malware this week and have been shut down to investigate the breach. According to the report, the attacker appears to have gained access to the supercomputer cluster by destroying SSH credentials, and once the attacker has gained access, it will exploit the cve-2019-15666 vulnerability to deploy the application for mining Monroe COINS (XMR).

PeckShield review:Due to users' lack of security awareness and operation standardization, various security risks have been emerging in endlessly. Phishing attacks, fraud and other incidents are typical. In this reminder, users should be careful to keep all kinds of private information, any small negligence may cause irreparable loss.

Original link:https://mp.weixin.qq.com

Welcome to join the official BlockBeats community:

Telegram Subscription Group: https://t.me/theblockbeats

Telegram Discussion Group: https://t.me/BlockBeats_App

Official Twitter Account: https://twitter.com/BlockBeatsAsia