Partnered With:

PeckShield: There were 28 security incidents in August, and the DeFi market was hit hard

Read this article in 21 Minutes

DeFi 8, Wallet Security 2, public chain Security 6, exchange related 1, extortion related 4, fraud and run-away 7

Source: PeckShield

Original by PeckShield

According to PeckShield Situational Awareness data, there were 28 prominent security incidents across the blockchain ecosystem in the past month, with an "intermediate" hazard rating, involving DeFi 8, wallet security 2, public chain security 6, exchange related 1, extortion related 4, and racketeering 7.

DeFi security

A total of 8 DeFi related security incidents occurred in August, as follows:

1) Yam Finance, the DeFi project, tweeted that a bug had been found in the Rebase contract. The Rebase after the initial reset will produce more YAM than expected. See PeckShield security team's follow-up technical interpretation of the doomed YAM vote rescue!

2) DeFi project YFValue (YFV) issued a notice that the team discovered a bug in the YFV pledge pool yesterday that was used by malicious participants to reset the YFV timer in the pledge separately.

3) On 05 August, Opyn Put, the DeFi options platform, lost about $370,000 when its intelligent contract was hacked. Attackers found Opyn intelligent contract exercise (exercise) interface received ETH has some processing flaw, the contract did not examine traders real-time transactions, that an attacker can initiate to yourself in a real deal, then insert a camouflage deal with the seller's mortgage digital assets, achieving have white Wolf. For details, see PeckShield: DeFi Platform Opyn Intelligent Contract Vulnerability -- Attacker Empty-handed!

4) YFII's hard fork project, YYFI, became an "exit scam" in the early morning of August 1. From the very beginning, it seemed that the project had decided to pay attention and get ready for its run.

5) A twitter user reported that DeFi's mobile mining project Degen.Money obtained user funds through two authorizations. The first authorization gives the pledge contract, and the second authorization gives the right to transfer money, which will result in the user's funds being taken away by the attacker.

6) SushiSwap, an emerging automated market maker platform, was found to have multiple security holes in the intelligent contract. The vulnerability could be exploited by the smart contract owner, allowing the owner to do anything, including emptying tokens from the smart contract account without authorization. At the same time, the intelligent contract of this project also has serious reentry attack vulnerability, which will lead to the potential attacker's malicious code being executed for many times.

7) DeFi Mobile Farming Anonymous Project officials announced that they would redeploy the pledge pool. They tweeted that hackers tried to permanently freeze "Pool1" but failed. Pool1, on the other hand, will continue as planned.

8) Two small token projects -- NUGS and NEXE -- were suspected of running into fraud shortly after Uniswap was launched. The NUGS project blamed the move on a "smart contract flaw" and on its official cable channel, NUGS said its smart contracts were now "beyond repair". Another project, NEXE, is also suspected to have run away and its social media account has been deleted.

PeckShield review: As the DeFi project becomes more and more versatile, hidden security issues are becoming more and more apparent. Given its close relationship to user assets, security issues for the DeFi project are very serious. As each project is developed by different teams with limited understanding of the design and implementation of each product, the integrated product is likely to have security problems in the process of interacting with the third-party platform, and thus suffer from both sides. PeckShield recommends that the DeFi project side conduct a full security audit with a team that has done in-depth research on all aspects of DeFi's product design before going online, as far as possible, to avoid potential security risks.

Digital Wallet Security

Two wallet security incidents occurred in August:

1) A GitHub user says a huge amount of his Bitcoin money has been stolen by hackers. The user, who USES the Bitcoin wallet Electrum software, was last accessed in 2017. Electrum has since released a security update, but that user hasn't installed it yet, so he was prompted to update and fix potential problems before transferring Bitcoin. But when he acted on the tip, the software exploited a vulnerability to connect to the hacker's servers, and 1,400 BTCS (worth $16m) were immediately removed from his wallet and stored in the hacker's wallet.

2) Aug. 30 -- Ledger, a provider of encrypted wallets, recently suffered a database leak and a wallet vulnerability that put users' Bitcoins at risk. Charles Guillemet, Ledger's chief technical officer, said that in the case of the database breach, the attacker accessed part of our e-commerce and marketing database through an API key misconfigured on our website by a third party, allowing unauthorized access to our customers' contact information and order data. The Ledger fixed the problem the same day and disabled the API key.

PeckShield review: A digital wallet is the closest thing to an encrypted asset as a tool for managing private keys. While a cold wallet is an offline wallet that is disconnected from the Internet, it is also at risk of physical attack and theft, while a hot wallet like a web wallet also requires users to be wary of phishing attacks, malicious code injection, and other attacks.

Public security chain

A total of 6 public chain-related safety incidents occurred in August:

1) Early on August 4, Adamant Capital founder Tuur Demeester tweeted that today the full Bitcoin node may be suffering from slot exhaustion attack. And according to a post by Warren Togami, vice President of Blockstream, forwarded by Tuur Demeester, all the connected slots transferred to several bitcoin nodes that it monitors are full. Warren Togami says that incoming connections from localhost will stop when the public incoming connection slot runs out.

2) Tokens worth more than $1 billion on the Ethereum blockchain lack a software standard released in 2017, leaving them vulnerable to hijacking and loss from exchanges, according to a new study by researchers at Peking University, Beijing University of Posts and Telecommunications, Zhejiang University and the University of Queensland. The software vulnerability, known as a fake deposit vulnerability, has been found in 7,772 ERC-20 token issuers. The study showed that hackers could swindle large amounts of money at almost no cost by manipulating code from smart ERC-20 scrip contracts that used inadequate transaction verification methods. A fake deposit attack could then crash the exchange, causing erC-20 and other cryptocurrency holders to lose their money.

3) An update in OpenEthereum makes nodes running on the new version largely useless, a bug that appears to have been introduced in OpenEthereum's 2.7.2 release. OpenEthereum decided to simply scrap version 2.7 because it and its bugs were very difficult to fix. The latest iteration of the 2.5.13 stable version is scheduled for release in mid-September before the Hard Fork in Berlin. Until then, however, operators who download the new version will face a damaging downgrade. Liam Aharon, a developer at infrastructure developer BlockNative, stressed on Twitter that the downgrade would require a complete resynchronization of the blockchain, "which will take months for some node configurations." This vulnerability affects about 50% of nodes at present Parity, which accounts for 12% of the entire network according to Ethernodes' data. The OpenEthereum team is working on a transformation process that would help nodes avoid costly resynchronization.

4) Bitfly (Ethermine mining Pool's parent company) tweeted that today the ETC block chain underwent a 3,693 block chain reorganization at block height 10904146. This causes all state builder nodes to stop synchronizing. This may have been the result of a 51 per cent attack, after which officials sought an immediate halt to deposits and withdrawals on all exchanges and an investigation into all recent transactions.

5) On August 30, Bitfly Mine tweeted that another massive 51% attack on ETC today resulted in the restructuring of more than 7,000 blocks, equivalent to about two days of mining time. All missing blocks are removed from balances that have never expired, and all expenditures are checked for missing transactions.

6) On August 25, Filecoin space race started, CDSI Alliance node "T02398" was subjected to a large number of malicious and illegal attacks. The attacker sent a large number of messages through the filtered whitelist to block the nodes, consuming a large number of calculations of Lotus nodes so that the nodes could not complete their tasks normally and finally lost computing power.

PeckShield review: Once the vulnerability on the public chain is found, it will have a great impact on the whole chain ecology. Therefore, the public chain must do security testing and vulnerability detection before the official release, and seek third-party security company audit, so as to avoid the vulnerability threat affecting the public chain ecology.

Exchange correlation

A total of one exchange-related security incident occurred in August:

1) Coinbit, The third largest digital currency exchange in South Korea, has been closed down by South Korean police for investigation. Its chairman and operator are suspected of internal trading and market price manipulation. Coinbit is understood to be the country's third-largest exchange after Bithumb and Upbit. Police said the company was suspected of making at least 100 billion won ($85 million) through illegal means. Coinbit was also suspected of falsifying more than 99 percent of its trading volume.

PeckShield review: Hackers who steal assets and launder money, no matter how sophisticated, typically use the exchange as part of a cash-out channel. This undoubtedly raises the requirements for KYC and KYT businesses of all major digital asset exchanges, and the exchanges should strengthen the review of AML anti-money laundering and capital compliance. Details can be found at www.coinholmes.com.

Blackmail associated

There were a total of 4 security incidents related to extortion in August:

1) In the past few weeks, a criminal gang has launched a DDoS attack on some of the world's largest financial services providers and demanded ransom in bitcoin. Using names like the Armada Collective and Fancy Bear -- both borrowed from well-known hacking groups -- the group is known to send emails to companies threatening DDoS attacks and demanding bitcoins for ransom.

2) The ransomware crime group REvil, also known as Sodinokibi, claimed to have successfully attacked the U.S. wine and spirits giant Brown-Forman Corp, with hackers selling stolen data for about $1.5 million on its official dark Web blog. However, Brown-Forman Corp said in a statement that it had succeeded in preventing the cybercrime group from encrypting the files.

3) Austrian police are investigating a surge in bomb threats and extortion after a number of companies received extortion emails for Bitcoin Tuesday morning. According to the emails, if they don't pay $20,000 worth of Bitcoin in the next 80 hours, they will detonate the bomb. Austrian media said the emails also contained instructions on how to buy bitcoin.

4) Tesla successfully cracked a planned ransomware attack by cooperating with the FBI. The attack is believed to have targeted a Tesla factory in Nevada, demanding millions of dollars in bitcoin.

PeckShield review: Extortion security incidents have been a major threat to the entire Internet ecosystem, not just the blockchain ecosystem. Moreover, after the popularity of cryptocurrencies in the blockchain field, criminals often take advantage of the good anonymity of cryptocurrencies such as Bitcoin to carry out extortion fraud.

Other fraud ran away and other events

In addition to the above, a number of fraudulent run-away incidents occurred in August, such as:

1) Anning Branch of Lanzhou Municipal Public Security Bureau recently successfully broke up a criminal gang that used a fake financial platform to carry out telecom and Internet fraud. A total of 41 suspects were arrested, more than 270,000 yuan of stolen money was frozen, two BMW cars were seized and more than 100 tools (parts) such as mobile phones and computers were used to commit the crime.

2) On August 20, the Public Security Bureau of Suzhou, Jiangsu province, learned that in the "Net 2020" special operation, the city cracked a criminal case against virtual currency hackers and arrested several suspects. The suspect specially USES the hacker means to steal the account password, to steal the virtual currency, and through the dark network to contact the professional money laundering sales gang to cash, involving more than 30 million yuan.

3) Mitiga, an Israeli cybersecurity firm, recommends that all customers of Amazon Web Services, which runs some programs, check if they are maliciously infected with menlo Coin mining software. In a report today, Migita says that anyone running EC2 instances based on Community AMIs (Amazon Machine Images) is vulnerable to the encryption mining software. Migita is understood to be examining a financial machine

4) Tencent Security Threat Intelligence Center has detected a large number of attacks against domestic cloud server tenants originating from overseas IP and some domestic IP. The attacker USES SSH (port 22) to blow up the login server, and then executes malicious commands to download the Muhstik botnet Trojan. The botnet will control the fallen server to perform SSH lateral movement, download a Menlo Coin-mining Trojan, and accept remote commands to launch a DDoS attack.

5) Spanish cryptocurrency payment app and credit card issuer 2Gether has admitted that hackers stole $1.4 million on Friday (July 31) and that the company could not immediately repay users affected by the attack, and has proposed a compromise. 2Gether has been trying to find the money, but talks with an investment group have failed to find the money to repay all users of the stolen funds.

6) On August 15, police in Hong Kong, China, arrested three men on suspicion of swindling nearly HK $230,000 (US $30,000) from a Bitcoin ATM, in the city's first case of its kind. Police took action over the past two days after two cryptocurrency exchanges filed reports. The exchanges suspect criminals have taken advantage of "vulnerabilities" in ATMs that allow them to withdraw cash without official authorization.

7) Recently, in the process of conducting hurricane 2020 special operation, Guangzhou Baiyun Police discovered and broke up a digital currency transaction with the help of "run-away" platform, thus serving as a telecom fraud "money laundering" gang, captured 9 suspects involved, and seized a batch of involved items such as mobile phones and bank CARDS.

PeckShield review: Security risks caused by users' lack of security awareness and normative operation are constantly emerging. Phishing attacks, frauds and other incidents are typical. It is hereby reminded that users should keep all kinds of private information carefully. Any small negligence may cause irreparable loss.