Blockchain Auditors Say $4m Crypto Theft Enabled By Logging Tech

Uploaded on 2022-08-19 in TECHNOLOGY-Key Areas-Blockchain, TECHNOLOGY--Hackers, FREE TO VIEW, BUSINESS-Services-Financial

Blockchain auditors have suggested the reason behind a massive $4 million hack on several crypto-currency wallet providers is a misconfiguration in a widely used event-logging technology. 

Crypto-currency tokens Solana (SOL) and USD Coin (USDC) were among those stolen from Slope wallets by an unknown attacker, after the wallets were found to be leaking seedphrases in plaintext. Seedphrases are strings of randomly generated words used to recover crypto-currency wallets. They are considered secure, and only the owners are supposed to know what these strings are.

Blockchain auditors Zellic and OtterSec have both published the findings from their respective investigations, which are still ongoing, have suggested the reason behind a massive $4 million hack on several crypto-currency wallet providers is due to a misconfiguration in a widely-used event-logging technology.

Professional cyber criminals know that blockchain’s algorithms are secure and have busied themselves looking for other ways to manipulate and penetrate them.

Slope, Solana & Phantom Wallets

In a recent incident, the blockchain platform Solana reported that 7767 wallets were impacted during a security incident in which $4 million was stolen. In addition to Solana customers, Slope and Phantom users were also affected. While the cause of the exploit is unknown, Solana has said that hardware wallets were not affected in the incident and users are strongly encouraged to use this type of wallet. The firm says that engineers from several different operating environments are investigating the incident.

The attack against Solana is the latest in a series of attacks targeting the crypto currency industry and users are advised to take particular care in securing their profiles and wallets, such as revoking third-party permissions and setting up extra security measures.

Blockchain - An Immutable Ledger

Known as an "immutable ledger," blockchain is supposed to be impervious to bad actors and this is one of the reasons blockchain has become so popular is that its design prevents anyone from deleting or changing a record once it has been created. 

This renders blockchain especially useful for crypto currency applications, where it’s important that records of spent money can’t be changed or deleted, as well as e-voting, financial records, manufacturing records, product provenance, and many other applications. However, the ownership blockchains for these coins and tokens are also vulnerable to type of hacking and fraud.
 
Blockchain’s auditors Zellic and OtterSec have concluded the issue stemmed from a misconfiguration in Sentry, an event-logging platform used by many websites and mobile apps in the industry, including the Slope wallet for iOS and Android. Other wallets also affected include Phantom, Solflare, and TrustWallet. 

  • Zellic said “any interaction in the app would trigger an event log. Unfortunately, Slope didn't configure Sentry to scrub sensitive info. Consequently, the seedphrases were leaked to Sentry”.
  • According to  OtterSec, anyone with access to Sentry could access users’ private keys, allowing them to recover wallets that don’t belong to them and transfer tokens to their own personal wallet. 

Zellic’s research suggested that Slope had only been using Sentry for a week before the breach was confirmed. It also found it’s possible to scrub data that doesn’t need to be logged in Sentry via the platform’s software developer kit or via server-side scrubbing.

Almost 1,400 of the addresses in the exploit were present in Sentry logs, although this does not account for all the hacked addresses. The research suggests that there are thousands of additional wallets that contain crypto currency tokens and could currently be vulnerable to additional attacks from the still-unknown hacker.

Owners of a Slope wallet are strongly advised to transfer all tokens into a different method of storage as soon as possible, such as a hardware ledger or centralised exchange. 

ITPro:    Techcentral:     Techopedia:    AnalyticsInsight:     Reddit:     Monash University:     

Oodaloop:    @Zellico.ai:     @osec_io

You Might Also Read: 

Chainalysis Crypto Theft Hotline:   
  

« Killnet Turn Their Attention To Lockheed Martin
Protecting Medical Devices From Cyber Attacks »

CyberSecurity Jobsite
Perimeter 81
Cyrin

Real Attacks. Real Tools. Real Scenarios.
Schedule a demo

Go Cyber

Training that transforms behaviours

Sign Up: Cyber Security Intelligence Newsletter

Directory of Suppliers

Authentic8

Authentic8

Authentic8 transforms how organizations secure and control the use of the web with Silo, its patented cloud browser.

CYRIN

CYRIN

CYRIN® Cyber Range. Real Tools, Real Attacks, Real Scenarios. See why leading educational institutions and companies in the U.S. have begun to adopt the CYRIN® system.

Syxsense

Syxsense

Syxsense brings together endpoint management and security for greater efficiency and collaboration between IT management and security teams.

LockLizard

LockLizard

Locklizard provides PDF DRM software that protects PDF documents from unauthorized access and misuse. Share and sell documents securely - prevent document leakage, sharing and piracy.

Cyber Security Supplier Directory

Cyber Security Supplier Directory

Our Supplier Directory lists 6,000+ specialist cyber security service providers in 128 countries worldwide. IS YOUR ORGANISATION LISTED?

Information Risk Management (IRM)

Information Risk Management (IRM)

IRM is an international consultancy dedicated to helping organisations solve key business issues. We provide strategic cyber security advice across a wide range of sectors.

QinetiQ

QinetiQ

QinetiQ is one of the world's leading defence technology and security companies. Areas of activity include air, land, sea and space systems, weapons, robotics, C4ISR and cyber security.

ThetaRay

ThetaRay

ThetaRay’s solution for Industrial cyber security protects against unknown cyber-attacks that target industry and critical infrastructure.

Equilibrium Security Services

Equilibrium Security Services

Equilibrium Security Services is a specialist cyber security company providing a full spectrum of IT security solutions from consultancy to design & implementation and managed security services.

NetMonastery DNIF

NetMonastery DNIF

NetMonastery is a network security company which assists enterprises in securing their network and applications by detecting threats in real time.

Tempered Networks

Tempered Networks

Tempered Networks delivers the first purpose-built platform for IIoT cybersecurity that allows customers to connect and secure devices in minutes without the need for specialized skills.

Lynx Technology Partners

Lynx Technology Partners

Lynx Technology Partners is a full service, full life-cycle risk-based security consulting firm.

Silverskin Information Security

Silverskin Information Security

Silverskin is a cyber attack company that specializes in having knowledge of the attacker's mindset to identify vulnerabilities and build effective and persistent defences.

Exatel

Exatel

Exatel is Poland’s leading provider of ICT security services.

Serverless Computing

Serverless Computing

Serverless Computing London will help architects, developers and CIOs decide on the best path to a more efficient, scalable and secure computing future.

Data Protection People

Data Protection People

Data Protection People are specialists in Data Privacy, Governance, and Information Security.

Council of Europe Convention on Cybercrime

Council of Europe Convention on Cybercrime

The Council of Europe helps to protect societies worldwide from the threat of cybercrime through the Convention on Cybercrime.

Thrive

Thrive

Thrive delivers the experience, resources, and expertise needed to create a comprehensive cyber security plan that covers your vital data, SaaS applications, end users, and critical infrastructure.

WhiteHawk

WhiteHawk

WhiteHawk is the first online Cyber Security Exchange. We help you understand your cyber risk and match you to tailored and affordable solutions.

CyberXposure

CyberXposure

CyberXposure has been built by a team comprising of Cyber Security Professionals and SAAS experts in data backup, disaster recovery and cyber-security.

Phylum

Phylum

Phylum provides powerful, automated software supply chain risk analysis that protects organizations, defends developers and enables secure innovation.