Firms have mere hours to deflect cyber attacks, warns cybersecurity CEO

August 22, 2023 Coin Telegraph

Palo Alto Networks CEO Nikesh Arora has warned that “bad actors are getting faster” and stressed that companies need to beef up cybersecurity defenses.

Palo Alto Networks CEO Nikesh Arora has urged companies to modernize their cybersecurity systems, cautioning that bad actors have become much faster at breaching company defenses than ever before.

Speaking to Jim Cramer on CNBC’s “Mad Money” on Aug. 21, the cybersecurity firm CEO said that companies with outdated security systems need to take particular heed, as cybercriminals are only getting faster.

“It’s important for us to make sure we’re ready to deflect the stuff in hours, not in days,” Arora explained.

He stressed that outdated cybersecurity solutions need modernizing, and even suggested that artificial intelligence could be put to the task.

“Put that in some sort of an AI stack, so you can actually do this in more real time. Because the bad actors are moving faster.”

In June, ChatGPT creator OpenAI announced a $1 million cybersecurity grant program to enhance and measure the impact of AI-driven cybersecurity technologies.

Palo Alto Networks CEO Nikesh Arora told @jimcramer that companies need updated cybersecurity systems to protect against hackers who are getting faster and more skilled.https://t.co/Vajy9LnJiP
— Mad Money On CNBC (@MadMoneyOnCNBC) August 22, 2023

This year has been a bumper one for crypto hackers, particularly when it comes to decentralized finance protocols.

More than $300 million in crypto was lost to hacks and exploits in the second quarter of 2023, as reported by Cointelegraph.

Meanwhile, August has already seen its fair share of crypto exploited with seven-figure losses for Exactly Protocol, Zunami Protocol, Steadefi Protocol, and Cypher Protocol, according to the De.Fi Rekt database. However, not all of them were traditional cybersecurity breaches, as many consisted of smart contract code bugs and flash loan exploits.

In late July, the Securities and Exchange Commission voted to adopt new rules on cybersecurity disclosure, which would impact listed companies, including cryptocurrency firms.

The regulator will require public companies to disclose “material” cybersecurity breaches within four days claiming it was necessary to collect the data “to protect investors.”

However, corporations pushed back claiming that the short announcement period is unreasonable. They are also concerned that it would require public disclosure which could harm corporations and open them to further exploitation by cybercriminals.

“You really don’t want to be exposed, telling the SEC that you have been breached, you haven’t fixed it yet,” Arora said urging that its clients fix things much faster.

Magazine: Web3 Gamer: GTA 6 crypto rumors, Dr Who/Sandbox, Thai tourist NFTs review

Binance applies for Taiwan AML compliance: Report

August 11, 2023 Coin Telegraph

AML

The world’s leading crypto exchange by trading volume has reportedly applied to register in Taiwan under the new AML compliance.

Binance, the world’s leading crypto exchange by trading volume, has reportedly applied to be registered in Taiwan under the Money Laundering Control Act and the Financial Supervisory Commission (FSC).

The FSC reportedly informed dozens of domestic crypto service providers that Binance is applying for Anti-Money Laundering (AML) compliance, according to a report published in local media. The report cited Chen Peiyun, the co-founder of Taiwan’s currency exchange BitShine, as the source of the information who revealed that the FSC named Binance as one of the exchange prospects that is planning to enter Taiwanese crypto market via AML compliance.

Binance has not yet responded to Cointelegraph's request for comment.

While the cryptocurrency industry is largely unregulated in Taiwan, the FSC introduced AML guidelines in July 2021, requiring all crypto exchanges operating or offering their services in the country to comply with it.

Binance currently operates in Taiwan through a local entity called 'Binance International Limited Taiwan Branch (Seychelles).' The registration information shows that Binance’s local entity was registered on May 12, 2023.

Apart from its registration in the island country, the crypto exchange has also collaborated with the local government to fight cybercrime. Binance didn't respond to Cointelegraph's requests for comments at the time of writing.

FSC became the primary regulator of cryptocurrencies in the island country in March earlier this year. At the time of the announcement the regulatory body's chief had noted that the focus would be on developing major rules and policies, including the separation of customer assets from company funds and investor protection practices.

Taiwan made it clear that its crypto policies will be independent of mainland China, given, the Beijing government has imposed a blanket ban on crypto related activities since 2021.

The reports about Binance entering the Taiwanese crypto market come at a time when the crypto exchange has faced regulatory pushback in America and Europe. The exchange is facing multiple lawsuits in the United States while it has withdrawn from multiple judications in Europe after regulatory concerns.

Magazine: DeFi faces stress test, DoJ fears run on Binance, Hong Kong’s crypto trading: Hodler’s Digest, July 30 – Aug. 5

Worldcoin’s Orb had serious security vulnerability in operator onboarding: CertiK

August 4, 2023 Coin Telegraph

Coin Telegraph

The smart contract auditor found that operator verification could have let operators into the system without a verified ID or even being a company.

The controversial Worldcoin project had a serious security vulnerability, CertiK has disclosed on X (formerly known as Twitter). Worldcoin pays people to become part of its World ID ecosystem by submitting scans of their irises through a device Worldcoin calls an Orb.

According to security platform CertiK, the vulnerability in the vetting process for operators could have allowed an attacker to bypass the verification process and operate an Orb without being interviewed or having a proper ID. “It would not need to be a company,” according to the post.

1/ On May 29th, CertiK reported a security vulnerability to #WorldCoin’s security team that could potentially allow an attacker to become an Orb operator by bypassing the verification process.
— CertiK (@CertiK) August 3, 2023

CertiK reported the vulnerability to the Worldcoin (WLD) security team as a “standard whitehat disclosure,” and it has been fixed, it said. The discovery of the vulnerability could add fuel to the worldwide controversy surrounding the project’s privacy and data use.

Critics have already suggested that the project, launched by OpenAI founder Sam Altman and intended to support its World App wallet by filtering out bots, is ethically questionable and contains the makings of a “dystopian nightmare.” The project is not open-source. Regulators have been skeptical as well.

The project depends on mass adoption for its success. Millions of people around the world have eagerly lined up for the opportunity to sell their retinal data for around $50. Observers have speculated that the project has not gained the support it was hoping for, but its momentum has not diminished.

HERE WE GO FOLKS: Hundreds of youth voluntarily line-up to have their eyeballs scanned with a Worldcoin orb to get their new digital ID with “free money” Worldcoins in their new digital wallet. This is exactly how #CBDC will be rolled out globally…
pic.twitter.com/whWgxdg7lm
— Patrick Henningsen (@21WIRE) July 26, 2023

The project claimed to be attracting 400,000 new users per week in mid-July, and that number has increased to over 545,000 at the time of writing, according to the project’s website, for a total of over 2,188,000. It recorded a daily average of over 193,000 wallet transactions over the past seven days.

The website also stated that 366 orbs have been active in the last week, and 2,000 of them have been manufactured.

Magazine: When privacy is a privilege: Ontology’s Jun Li on blockchain-based digital ID

Ensuring integrity of blockchain transactions: Trust through audits

August 4, 2023 Coin Telegraph

Coin Telegraph

Reliable auditing procedures are important for ensuring the integrity of blockchain networks.

Blockchain auditing is the process of examining and verifying the data and transactions stored within a blockchain network. It focuses on assessing the integrity and accuracy of the information recorded on the blockchain to ensure it aligns with the intended rules, protocols and regulations.

Through the audit process, smart contract code is painstakingly examined to identify vulnerabilities of all levels, ranging from minor loopholes to critical weaknesses that could potentially expose millions to risk.

Auditors review and reveal centralization issues, ensure the project code functions as the developer intended, and optimize the code's efficiency. They address key areas such as mathematical operations, logical issues, control flow, access control and compiler errors. By doing this, the probability of a smart contract vulnerability is substantially reduced, providing an essential safeguard in the world of Web3.

Sheldon Xia, founder and CEO of crypto exchange Bitmart, told Cointelegraph, "Auditing significantly reduces risks associated with smart contract vulnerabilities.”

However, auditing is not a panacea. Many projects often do not have their entire code audited due to time and budget constraints, leaving sections of the code unchecked and potentially susceptible to issues.

Furthermore, audits must be continuous, as code is frequently updated or forked, making single audits insufficient for long-term security.

In addition, there's the challenge of ensuring that the deployed code is the one that was actually audited and not something different. This emphasizes the need for both transparency and traceability in the deployment process, underlining the necessity of a more holistic approach to security that goes beyond mere code auditing.

Auditing blockchain systems is crucial for several reasons.

Firstly, auditing ensures the verification of transactions recorded on the blockchain. This involves scrutinizing the transaction history, validating inputs and outputs, and confirming that the transactions comply with predefined rules and smart contracts. By doing so, auditing helps prevent fraudulent or erroneous transactions and maintains the integrity of the blockchain network.

Secondly, blockchain auditing plays a vital role in security and fraud detection. Auditors thoroughly review the transactions, and access controls and cryptographic mechanisms to identify unauthorized or suspicious activities within the blockchain network. This aspect is particularly critical in financial systems, supply chains and sensitive data management with high potential risks.

Auditing enhances accountability by holding participants responsible for their actions within the blockchain network. It helps identify discrepancies or inconsistencies, ensuring all stakeholders are accountable for their activities.

Furthermore, auditing instills trust and confidence among stakeholders in blockchain-based systems. By optimizing the blockchain network based on audit findings, organizations can ensure it can handle increasing transaction volumes and meet desired performance objectives.

The importance of reliable auditing processes

While auditors play an essential role in the security of blockchain networks, founders must select reputable organizations. One drawback associated with shady auditing firms is a conflict of interest. These entities may have undisclosed conflicts that compromise their independence and objectivity.

They could be financially tied to the projects they audit or maintain undisclosed partnerships or investments that introduce bias into their evaluations. Such conflicts undermine the integrity of the audit process and raise doubts about the impartiality of their findings.

Magazine: 6 Questions for Simon Davis of Mighty Bear Games

Transparency is crucial in auditing to ensure accountability and build trust. However, shady auditing firms often lack transparency in their operations. They provide limited or vague information about their methodologies, processes and auditors' qualifications.

In March 2023, Cointelegraph reported that banks associated with the defunct crypto exchange FTX may have relied on the misleading and faulty financial information provided by proof-of-reserve examinations by auditors associated with the Public Company Accounting Oversight Board.

In another report by Cointelegraph in December 2022, the SEC’s acting chief accountant Paul Munter stressed that investors shouldn't place too much confidence in a company's proof-of-reserve audits. Munter said these proof-of-reserve reports lack sufficient information for stakeholders to determine whether the company has enough assets to meet its liabilities. This lack of transparency makes it challenging to evaluate the reliability and credibility of their findings, raising concerns about the validity of their audits.

Although a third party should conduct audits, the lack of true independence among many auditors means that the results are sometimes unreliable. In other words, they may have an incentive to avoid disappointing customers.

Inadequate due diligence is another drawback associated with shady auditing firms. Effective audits require thorough analysis, including a comprehensive review of project documentation, source code, financial records and security measures.

Some firms may perform inadequate due diligence or rely on incomplete or inaccurate information from their audit projects. Consequently, their reports can be misleading or inaccurate, failing to identify significant risks or vulnerabilities.

An incomplete or misleading audit can have severe consequences for the reputation and trustworthiness of a blockchain project. If investors, users or regulators discover an audit report is unreliable or conducted by an untrustworthy firm, it erodes confidence in the project.

This diminished trust can result in decreased adoption, loss of investments and potential legal repercussions.

Best practices for effective auditing in blockchain systems

In exploring best practices for conducting audits in blockchain environments, auditors must deeply understand how blockchain systems work. This includes knowledge of the underlying architecture, consensus mechanisms and transaction validation processes.

Such expertise enables auditors to identify potential vulnerabilities and evaluate the overall security and integrity of the system. Comprehensive documentation is essential to the auditing process, ensuring that all relevant information about the blockchain system is thoroughly recorded.

Technical specifications, smart contracts, cryptographic algorithms and other critical components must be documented to gain insights into the system's functionality and identify potential risks and vulnerabilities.

Moreover, auditors should thoroughly review the codebase of the blockchain system and conduct a detailed analysis of smart contracts. This process entails assessing the code for vulnerabilities, logic flaws and potential attack vectors exploited by malicious actors.

Specialized tools and techniques may be employed to ensure the accuracy and security of the system during the code review and smart contract analysis.

End-to-end security is key

The reality is that auditing alone is not enough. A more holistic, comprehensive approach is required. While auditing addresses code-based risks, Know Your Customer procedures tackle the human risk factor, thereby providing a more comprehensive security overview. However, striking the right balance between the anonymity offered by Web3 and the trust fostered through KYC can be a delicate process.

Of course, KYC is not foolproof either, with cases of bad actors misrepresenting themselves and passing KYC checks, creating a false sense of trust around a project. This means that rigorous screening processes conducted by seasoned professionals are needed. KYC verification is only as meaningful as the process behind it is comprehensive.

Alpen Sheth, partner at Borderless Capital, a crypto venture capital firm, told Cointelegraph, “It's important to remember that auditing should be an ongoing process to keep up with code changes and the evolution of the ecosystem. We acknowledge that security is an integral part of sustainable growth and development in the blockchain space."

Chinese police vs. Web3, blockchain centralization continues: Asia Express

In this complex landscape, investors should also exercise due diligence. Alongside reading and understanding audit reports, they should also look for projects audited by reputable firms, track project code updates and their corresponding audits, know the team behind the project and their track record, and consider the proportion of audited code within the project.

As the Web3 ecosystem continues to grow, a multifaceted approach combining comprehensive auditing, robust KYC processes, and investor due diligence is necessary to ensure optimal security. This, alongside a concerted effort to address the challenges of centralization risks, can provide a more secure foundation for the continued growth and success of Web3 projects.

The anatomy of a cyberattack

August 4, 2023 Coin Telegraph

Coin Telegraph

Explore the inner workings of a cyberattack, and understand its stages and techniques to strengthen cybersecurity defenses.

Cyberattacks have emerged as a serious threat to people, organizations and governments in today’s digitally connected world. A cyberattack is a malicious attempt to exploit vulnerabilities in computer systems, networks or software for nefarious purposes. Understanding the anatomy of a cyberattack is essential for individuals, businesses and governments to develop effective cybersecurity strategies.

To shed light on the changing environment of cyber threats, this article will discuss the essential elements of a cyberattack, and the stages involved in phishing and ransomware attacks.

The stages involved in a cyberattack

Reconnaissance

The attackers gather data on the target during the reconnaissance phase. To find potential vulnerabilities, targets, and important assets, they employ a variety of tactics and engage in active or passive reconnaissance.

Active reconnaissance involves scanning networks for prospective access points, whereas passive reconnaissance in a cyberattack involves gathering information about the target without directly engaging with its systems or networks.

Weaponization

Once the attackers have located their targets and weak points, they weaponize the attack by writing malicious code or taking advantage of already-known weaknesses. This frequently entails developing malware that can harm or gain illegal access to the target system, such as viruses, trojans, or ransomware.

Delivery

The malicious payload must now be delivered to the target. Attackers employ a variety of techniques to infect unsuspecting victims with malware, including phishing emails, harmful links, infected attachments and watering hole assaults.

Exploitation

During this phase, attackers use the flaws in the target network or system to obtain unauthorized access. They use security flaws, unpatched software or shoddy authentication procedures to access the target.

Installation

Once the attackers have access to the target system, they install the virus to keep it persistent and under their control. They can also increase their credentials to get more advanced and lateral network access.

Command and control

Attackers create a command and control infrastructure to keep in touch with the compromised systems. This is known as command and control (C2). This enables them to communicate, exfiltrate information and covertly carry out their nefarious actions.

Actions on objective

After seizing control of the target system, attackers move on to completing their primary goals. This might entail data theft, data alteration, requests for ransom or the launch of additional assaults against different targets.

Covering tracks

To prevent detection and keep their foothold, attackers hide their existence in the compromised systems by deleting logs, wiping out evidence of their activity and disguising their presence in the logs.

Understanding the anatomy of a phishing attack

A phishing attack is a type of cyberattack in which attackers use social engineering techniques to deceive individuals or organizations into divulging sensitive information, such as login credentials, financial details, or personal data.

For instance, an attacker can remotely control an infected computer by installing remote access trojans (RATs). After deploying the RAT on a compromised system, the attacker can send commands to the RAT and retrieve data in response.

The attackers often impersonate trusted entities, such as banks, online services or colleagues, to gain the victim’s trust and manipulate them into taking specific actions that compromise their security. The stages involved in a phishing attack include:

Reconnaissance: Attackers research and identify potential targets — often through social engineering or web scraping — to collect email addresses and personal information.
Weaponization: Cybercriminals craft deceptive emails containing malicious links or attachments designed to look legitimate, enticing victims into clicking or downloading them.
Delivery: Phishing emails are sent to the targeted individuals or organizations, tricking them into opening malicious links or attachments.
Exploitation: When victims click on malicious links or open infected attachments, the attackers gain unauthorized access to their systems or harvest sensitive information.
Installation: The attackers may install malware on the victim’s device, such as keyloggers or spyware, to steal credentials and monitor activities.
C2: The attackers maintain communication with the compromised systems, enabling them to control the malware remotely.
Actions on objective: Cybercriminals may use stolen credentials for financial fraud, gain unauthorized access to sensitive data, or even launch further attacks against other targets.
Covering tracks: After achieving their objectives, attackers may attempt to erase evidence of the phishing attack to avoid detection.

Understanding the anatomy of a ransomware attack

A ransomware attack is a type of cyberattack in which malicious software, known as ransomware, is deployed to encrypt a victim’s data or lock them out of their computer systems or files. The attackers demand a ransom payment from the victim to provide the decryption key or restore access to the encrypted data.

Reconnaissance: Attackers identify potential victims based on their vulnerabilities, often through automated scans of open ports and exposed services.
Weaponization: Cybercriminals package ransomware into malicious software that encrypts the victim’s data and demand a ransom for its release.
Delivery: The ransomware is delivered via various methods, such as infected email attachments or malicious websites.
Exploitation: Once the victim’s system is infected, the ransomware exploits software vulnerabilities to encrypt the files and render them inaccessible.
Installation: The ransomware gains persistence on the victim’s system, making it difficult to remove without the decryption key.
C2: Ransomware communicates with the attacker’s server to provide the decryption key after the ransom is paid.
Actions on objective: The objective is to extort the victim by demanding a ransom payment in exchange for the decryption key to recover the encrypted data.
Covering tracks: Ransomware attackers often cover their tracks by using encryption and anonymizing technologies to avoid detection.

Understanding the anatomy of a cyberattack is crucial to developing effective cybersecurity measures. By recognizing the stages involved in a cyberattack, individuals and organizations can proactively implement security controls, educate users about potential threats, and employ best practices to defend against the ever-evolving landscape of cyber threats. Cybersecurity is a collective responsibility, and with vigilance and proactive measures, one can mitigate the risks posed by cybercriminals.

BlackBerry reveals top crypto-focused malware amid rising cyberthreats

August 3, 2023 Coin Telegraph

Coin Telegraph

When it comes to Blackberry’s list of the most prevalent malware families, SmokeLoader, RaccoonStealer (also known as RecordBreaker) and Vidar top the charts.

In the process of stopping over 1.5 million cyberattacks between March to May, the cybersecurity arm of the defunct smartphone goliath BlackBerry identified malware families that actively try to hijack computers to mine or steal cryptocurrencies.

The three industries most affected by cyberattacks are finance, healthcare and government, according to the BlackBerry report. A commodity malware named RedLine is one of the long-standing financial threats — tasked with harvesting information including cryptocurrency and banking information.

*The three industries with the highest distribution of stopped cyberattacks and stopped unique/different samples during this period. Source: BlackBerry*

Clop ransomware — a variant of the CryptoMix ransomware family — was a common threat that specifically targeted banking and financial institutions. This malware was responsible for the data breach of fintech banking platform Hatch Bank.

When it comes to Blackberry’s list of the most prevalent malware families, SmokeLoader, RaccoonStealer (also known as RecordBreaker) and Vidar top the charts. SmokeLoader is one of the oldest rogue financial tools from 2011, which has primarily been used by Russian-based threat actors to load crypto miners among other malware.

RaccoonStealer has been used to steal cryptocurrency wallet data and is being reportedly sold across the dark web. Vidar also is being widely used to harvest cryptocurrency wallets.

Think only enterprises get hacked? If you’re a mid-market or small business, you still have a big target on your small or mid-size back. BlackBerry's @aboutsecurity shares why cybercriminals select targets based on impact & how much they're willing to pay. https://t.co/2LBlurWMiL
— BlackBerry (@BlackBerry) August 3, 2023

Linux was the biggest target out of all operating systems, and BlackBerry advised organizations to apply security patches regularly. Hackers target Linux to hijack and use computer resources for mining cryptocurrencies. A new strain of infostealer named Atomic macOS (AMOS) targets macOS users, primarily used to collect credentials from keychains, browsers, and crypto-wallets among others.

OpenAI, the creator of ChatGPT and Dall-e, recently announced a $1 million cybersecurity grant program to enhance and measure the impact of AI-driven cybersecurity technologies.

*OpenAI cybersecurity grant program. Source: OpenAI*

“Our aim is to foster the advancement of AI-driven cybersecurity capabilities for defenders through grants and additional assistance,” stated OpenAI, in its official announcement.

Magazine: Deposit risk: What do crypto exchanges really do with your money?

Binance’s CZ warns crypto community about emerging scam

August 2, 2023 Coin Telegraph

Binance

The scheme consists of mirroring addresses and sending dust transactions to users to trick them into sending funds to the scammer's wallet.

Binance CEO Changpeng 'CZ' Zhao warned his followers on X about a tricky and increasingly popular scam targeting the crypto community, in which fake wallet addresses are used to defraud users during transactions.

The scheme generates addresses with the same starting and ending characters as the user's original address. Once the mirrored address has been generated, the scammer sends the target dust transactions that will reflect on the victim's transaction history. If the victim copies and pastes an address from one of the dust transactions, the funds will be sent to the scammer.

According to CZ, a well-experienced crypto operator fell victim to this scam on Aug. 1, sending cryptocurrencies worth $20 million to a dust address. The operator noticed the error right after the transaction and requested Binance to freeze the Tether (USDT) before it reached the scammer.

I want to share this (luckily) unsuccessful, but very clever and close scam incident from yesterday . Saved $20m. Hope it may also save you one day.

The scammers are so good now they generate addresses with the same starting and ending letters, which is what most people check… https://t.co/DFpdX8aNay
— CZ Binance (@cz_binance) August 2, 2023

The incident could be avoided by using a blockchain domain, such as the Ethereum Name Service (ENS). Blockchain domains are similar to email addresses, allowing users to identify wallets using regular words rather than a long string of letters and numbers. Binance users can purchase domains through the platform.

Furthermore, security specialists do not recommend users copy and paste addresses from applications to transfer funds. Users are also advised to use strong, unique passwords for crypto accounts and enable two-factor authentication (2FA) on applications.

The timely response from Binance helped the user avoid a major security incident, but other victims were less fortunate. Replying to CZ's thread, another user reported sending $20,000 USDT for a dust address in a similar scam. Still, after contacting Binance's support team within 20 minutes after the transaction, no option was provided to freeze the funds. Nearly 12 hours later, the victim's funds were transferred to a crypto mixer with no chance of recovery.

Users of Coinbase have reported similar security incidents. Victims have reported scams and phishing attacks related to the company's services and applications, including claims that scammers are contacting clients using the domain name of the crypto exchange.

Magazine: Tokenizing music royalties as NFTs could help the next Taylor Swift

Bug bounties can help secure blockchain networks, but have mixed results

July 11, 2023 Coin Telegraph

Coin Telegraph

How bug bounties can improve security by using talent from the blockchain community.

Bug bounties are programs organizations offer to incentivize security researchers or ethical or white hat hackers to find and report vulnerabilities in their software, websites or systems. Bug bounties aim to improve overall security by identifying and fixing potential weaknesses before malicious actors can exploit them.

Organizations that implement bug bounty programs typically establish guidelines and rules outlining the scope of the program, eligible targets, and the types of vulnerabilities they are interested in. Depending on the severity and impact of the discovered vulnerability, they may also define the rewards offered for valid bug submissions, ranging from small amounts of money to significant cash prizes.

Security researchers participate in bug bounty programs by searching for vulnerabilities in designated systems or applications. They analyze the software, conduct penetration testing, and employ various techniques to identify potential weaknesses. Once a vulnerability is discovered, it is documented and reported to the organization running the program, usually through a secure reporting channel provided by the bug bounty platform.

Upon receiving a vulnerability report, the organization’s security team verifies and validates the submission. The researcher is rewarded according to the program’s guidelines if the vulnerability is confirmed. The organization then proceeds to fix the reported vulnerability, improving the security of its software or system.

Bug bounties have gained popularity because they provide a mutually beneficial relationship. Organizations benefit from the expertise and diverse perspectives of security researchers who act as an additional layer of defense, helping identify vulnerabilities that may have been overlooked. On the other hand, researchers can showcase their skills, earn financial rewards and contribute to the overall security of digital ecosystems.

Discovering vulnerabilities within a platform’s code is crucial when it comes to protecting users. According to a report by Chainalysis, around $1.3 billion worth of crypto was stolen from exchanges, platforms and private entities.

Bug bounties can help to encourage responsible and coordinated vulnerability disclosure, encouraging researchers to report vulnerabilities to the organization first rather than exploiting them for personal gain or causing harm. They have become integral to many organizations’ security strategies, fostering a collaborative environment between security researchers and the organizations they help protect.

Getting involved

Communities can play a crucial role in bug hunting by leveraging their diverse perspectives and skill sets. When organizations engage the community, they tap into a vast pool of security researchers with varying backgrounds and experiences.

Troy Le, head of business at blockchain auditing firm Verichains, told Cointelegraph, “Bug bounty programs harness the power of the community to enhance the security of blockchain networks by engaging a wide range of skilled individuals, known as security researchers or ethical hackers.”

Le continued, “These programs incentivize participants to search for vulnerabilities and report them to the bounty organization. Organizations can leverage a diverse talent pool with varying expertise and perspectives by involving the community. Ultimately, bug bounty programs promote transparency, facilitate continuous improvement, and bolster the overall security posture of blockchain networks.”

In addition to diverse perspectives, engaging the community in bug hunting offers scalability and speed in the discovery process.

Organizations often face resource constraints, such as limited time and manpower, which can hinder their ability to thoroughly assess their systems for vulnerabilities. However, by involving the community, organizations can tap into a large pool of researchers who can work simultaneously to identify bugs.

This scalability allows for a more efficient bug discovery process, as multiple individuals can review different aspects of the system concurrently.

Another advantage of engaging the community in bug hunting is the cost-effectiveness compared to traditional security audits. Traditional audits can be expensive, involving hiring external security consultants or conducting in-house assessments. On the other hand, bug bounty programs provide a cost-effective alternative.

Recent: Google Cloud furthers Bitcoin Lightning ambitions with Voltage partnership

This pay-for-results model ensures that organizations only pay for actual bugs found, making it a more cost-efficient approach. Bug bounties can be tailored to fit an organization’s budget, and the rewards can be adjusted based on the severity and impact of the reported vulnerabilities.

Pablo Castillo, chef technology officer of Chain4Travel — the facilitator of the Camino blockchain — told Cointelegraph, “Engaging the community in bug hunting has many benefits for both organizations and security researchers. For one, it expands access to talent and expertise, allowing them to tap into a diverse set of skills and perspectives.”

Castillo continued, “This increases the chances of discovering and effectively addressing vulnerabilities, thereby improving the overall security of blockchain networks. It also fosters a positive relationship with the community, building trust and reputation within the industry.”

“For security researchers, participating in bug bounty programs is an opportunity to showcase their skills in a real-world scenario, gain recognition and potentially earn financial rewards.”

This collaboration not only strengthens the organization’s security posture but also provides recognition and rewards to the researchers for their valuable contributions. The community benefits by gaining access to real-world systems and the opportunity to sharpen their skills while making a positive impact.

Crypto projects launching without auditing

Many crypto projects launch without conducting proper security audits and instead rely on white hat hackers to uncover vulnerabilities. Several factors contribute to this phenomenon.

Firstly, the crypto industry operates in a fast-paced and highly competitive environment. Being the first to market can provide a significant advantage. Comprehensive security audits can be time-consuming, involving extensive code review, vulnerability testing and analysis. By skipping or delaying these audits, projects can expedite their launch and gain an early foothold in the market.

Secondly, crypto projects, especially startups and smaller initiatives, often face resource constraints. Conducting thorough security audits by reputable auditing firms can be expensive.

These costs include hiring external auditors, allocating time and resources for testing, and addressing the identified vulnerabilities. Projects may prioritize other aspects, such as development or marketing due to limited budgets or prioritization decisions.

Another reason is blockchains’ decentralized nature and the crypto space’s strong community-driven ethos. Many projects embrace the philosophy of decentralization, which includes distributing responsibilities and decision-making.

However, there are significant downsides to launching crypto projects without proper audits and relying solely on white hat hackers. One major downside is the increased risk of exploitation. Without a thorough codebase assessment, potential vulnerabilities and weaknesses may remain undetected.

Malicious actors can exploit these vulnerabilities to compromise the project’s security, leading to theft of funds, unauthorized access or system manipulation. This can result in significant financial losses and reputational damage.

Another downside is the incomplete or biased nature of security assessments. While white hat hackers play a crucial role in identifying vulnerabilities, they do not provide the same level of assurance as comprehensive audits conducted by professional security firms.

White hat hackers may have biases, areas of expertise or limitations regarding time and resources. They may focus on specific aspects or vulnerabilities, potentially overlooking other critical security issues. The overall security assessment may be incomplete without a holistic view provided by a thorough audit.

Castillo said, “While white hat hackers play a critical role in identifying vulnerabilities, relying solely on them may not provide comprehensive coverage. Without proper security audits with established providers, there is a greater chance of missing critical vulnerabilities or design flaws that malicious actors could exploit.”

Castillo continued, “Inadequate security measures can lead to various risks, including potential breaches, loss of user funds, reputational damage and more. To sum up: Launching without an audit could put the project at risk of non-compliance, leading to legal issues and financial penalties.”

Furthermore, relying solely on white hat hackers may lack the accountability and quality control measures typically associated with professional audits. Auditing firms follow established methodologies, standards and best practices in security testing.

They also adhere to industry regulations and guidelines, ensuring a consistent and rigorous evaluation of the project’s security posture. In contrast, relying on ad hoc assessments by individual white hat hackers may result in inconsistent methodologies, varying levels of rigor and potential gaps in the security assessment process.

Moreover, the legal aspects surrounding the actions of white hat hackers can be ambiguous. While many projects appreciate and reward responsible disclosure, the legal implications can vary depending on the jurisdiction and project policies.

White hat hackers may face challenges in claiming rewards, receiving proper recognition, or even encountering legal repercussions in some cases. Without clear legal protection and well-defined frameworks, there can be a lack of trust and transparency between the project and the hackers.

Lastly, relying solely on white hat hackers may result in a narrower range of expertise and perspectives than a comprehensive audit. Auditing firms bring specialized knowledge, experience and a systematic approach to security testing.

They can identify complex vulnerabilities and potential attack vectors that individual hackers may miss. By skipping audits, projects risk not uncovering critical vulnerabilities that could undermine the system’s security.

Le said, “Launching crypto projects without proper security audits and relying solely on white hat hackers carries significant risks and downsides.”

Le stressed that proper security audits conducted by experienced professionals “provide a systematic and thorough evaluation of a project’s security posture.” These audits help identify vulnerabilities, design flaws and other potential risks that might go unnoticed.

“Neglecting these audits can result in serious consequences, including loss of user funds, reputational damage, regulatory issues and even project failure,” Le said. “It is essential to adopt a balanced approach that includes both bug bounty programs and professional security audits to ensure comprehensive security coverage and mitigate potential risks.”

Recent: Animoca still bullish on blockchain games, awaits license for metaverse fund

While involving white hat hackers and the community in security testing can provide valuable insights and contributions, relying solely on them without proper audits presents significant downsides.

It increases the risk of exploitation, can result in incomplete or biased security assessments, lacks accountability and quality control, offers limited legal protection, and may lead to the oversight of critical vulnerabilities.

To mitigate these downsides, crypto projects could prioritize comprehensive security audits conducted by reputable professional auditors while still leveraging the skills and enthusiasm of the community through bug bounty programs and responsible disclosure initiatives.

Collect this article as an NFT to preserve this moment in history and show your support for independent journalism in the crypto space.

Coinbase domain name reportedly used by scammers in high-profile attacks

July 7, 2023 Coin Telegraph

Coin Telegraph

Twitter users have been sharing security incidents surrounding the crypto exchange, including claims that scammers are using Coinbase's domain name on attacks.

Update (July 7 at 9:33 PM UTC): This article has been updated to include Coinbase's response.

Coinbase's users have been turning to Twitter to report scams and phishing attacks involving the company's services and applications in the recent weeks, including claims that scammers are using the crypto exchange's domain name.

The most recent case was disclosed on July 7 by a Twitter user identified as Daniel Mason, who allegedly received texts and emails from scammers with links under the domain Coinbase.com.

The fraudster contacted Mason using a real phone number, then triggered an email from a Coinbase.com domain, followed by a phishing text message directing him to a Coinbase subdomain URL, before verifying Mason's address, social security number, and driver's license number.

I founded an identity / security company.
I'm currently building an auth company.
But my Coinbase account *almost* got phished.

This is the (2nd) most legit fraud attack I've ever experienced personally. Wild story below.
— Daniel Mason (SF next week ) (@dgmason) July 7, 2023

As Mason notes, the scammer was well-spoken and a native English speaker. The fraudster reportedly said during a phone call that Mason would receive an email from Coinbase regarding an alleged breach of his account. Immediately, an email arrived from help@coinbase.com. "Did he create a case on my behalf? Or access Coinbase mail servers?," Mason commented on Twitter.

Mason's experience is one of many on the social media platform reporting security incidents involving the crypto exchange. A brief look at Coinbase's support page shows users complaining about several types of scams, including phishing on Coinbase Wallet and criminals using the company's web address.

Cointelegraph spoke with a victim of a similar approach. The individual, who asked to remain anonymous, claims to have called Coinbase's support line to verify the authenticity of an email about their account being compromised. The employee then confirmed it was real communication, but the email was the work of a hacker.

"An employee of Coinbase authenticated a hacker as a Coinbase employee, who then stole my crypto. They then strung me along before taking no accountability, even though I had a witness, time and date of call, and the employee I spoke to," said the individual. The case is now under litigation. Among funds frozen and stolen, the victim claims to have lost roughly $50,000 in assets.

The reports follow the same pattern as the attack on Twitter user Jacob Canfield. Canfield reportedly received a text message and phone calls from a fraudster on June 13, citing an alleged change in his two-factor authentication (2FA).

Holy shit.

I just got attacked with one of the most complex scams in #crypto that I have seen to date.

Please read if you use @coinbase.

This just happened 15 minutes ago.

THIS IS A WARNING FOR ALL COINBASE USERS!

There has been some sort of a data breach.

First, I… pic.twitter.com/aOVWLpAtY4
— Jacob Canfield (@JacobCanfield) June 13, 2023

"They then sent me to the 'security' team to verify my account to avoid a 48 hour suspension. They had my name, my email and my location and sent a 'verification code' email from help@coinbase.com to my personal email," Canfield explained, adding that the criminal "got angry and hung up the phone" when told the code would not be sent.

The email help@coinbase.com is listed on the exchange's support page as a reliable and official address. The company's blog also states that its staff will never ask users for passwords, two-step verification codes, or request remote access to devices.

In a statement to Cointelegraph, Coinbase said it has “extensive security resources dedicated to educating customers about preventing phishing attacks and scams. We work with international law enforcement to ensure that anyone scamming Coinbase customers is prosecuted to the fullest extent of the law. “

Security specialists recommend strong, unique passwords for crypto accounts and enabling two-factor authentication on applications.

Magazine: $3.4B of Bitcoin in a popcorn tin — The Silk Road hacker’s story

Yield Protocol declares full recovery from Euler hack, awaits user token exchange

June 27, 2023 Coin Telegraph

Coin Telegraph

The permissionless, collateralized fixed-rate borrowing and lending market restored operations in May and will now switch out user tokens worth $1.5 million.

Yield Protocol announced on June 27 that it had fully recovered from the Euler flash loan attack. Liquidity providers can now update their strategy tokens, the protocol said on Twitter. That was the last step to protocol restoration after “a long journey.”

Yield Protocol was one of the 11 decentralized finance protocols that suffered losses after the attack on the noncustodial lending protocol Euler Finance. It paused mainnet borrowing after the hack on March 13 and claimed losses from its liquidity pools were under $1.5 million. Euler lost over $195 million in the attack.

On May 18, Yield Protocol announced that it was “back in full swing” and users could borrow and lend for the June and September series. It said at that time that it would take “about a week” for users to be able to claim replacement tokens.

Yield Protocol worked with Euler on the return of the funds after Euler recovered most of its losses from the hackers in April, it recounted in a blog post. Then it went through the complex process of deploying 26 new contracts and executing about 300 permissioned calls to reset the fixed-yield token maturities and restore the protocol.

Protocol restoration on Mainnet is complete! We have now fully recovered the protocol from the Euler hack and the liquidity provider bug.

LPs are once again earning fees. To withdraw, LPs need to first upgrade their strategy tokens. View instructions here https://t.co/wVbPXrJKsy
— Yield Protocol (@yield) June 27, 2023

Swapping their liquidity provider tokens for new ones minted during the restoration process will make users whole. The bloggers commented:

“We are fortunate that the outcome of this hack will not result in losses to the Yield community. Nevertheless, it has been a very long journey back to full protocol restoration.”

Also in May, Yield Protocol weathered the discovery of a bug in its strategy contracts that required it to pause the protocol for two weeks.

Magazine: ‘Deflation’ is a dumb way to approach tokenomics… and other sacred cows

Cybersecurity

The importance of reliable auditing processes

Best practices for effective auditing in blockchain systems

End-to-end security is key

The stages involved in a cyberattack

Reconnaissance

Weaponization

Delivery

Exploitation

Installation

Command and control

Actions on objective

Covering tracks

Understanding the anatomy of a phishing attack

Understanding the anatomy of a ransomware attack

Getting involved

Crypto projects launching without auditing

Share this video