The “authenticity verification” for hardware wallets was itself the thing stolen this time.
According to Cointelegraph, Keystone confirmed that after hackers breached its website, they stole a key used to verify whether devices are genuine, in addition to the previously disclosed leak of customer information. The company said the attackers could potentially use the key to produce counterfeit wallets that pass authenticity checks. If these devices are sold or sent to users, they could unknowingly use them as genuine products, putting their assets at risk of theft.
Keystone said it plans to destroy 18,835 devices in its inventory that contain the key, and has suspended production and shipments of the affected devices. The report said the attackers exploited a vulnerability in a third-party monitoring tool used on its website to gain elevated privileges.
Observation 1: The risk has spread from information to the devices themselves. Buying a counterfeit device that “passes verification” is tantamount to handing your private keys to someone else. Observation 2: Fixes for supply-chain security incidents like this typically take weeks. Until patches and replacement plans are in place, the brand’s reputation will be under pressure.
Would you replace your device right away, or wait for the company to announce a replacement plan?
Source: Cointelegraph
Image 1: Keystone breach escalates: Hackers steal key used to verify hardware wallets as genuine · Image from the source report
Image source: https://cointelegraph.com/news/keystone-breach-deepens-hackers-stole-key-used-to-verify-wallets-as-genuine?utm_source=rss_feed&utm_medium=rss&utm_campaign=rss_partner_inbound
According to Cointelegraph, Keystone confirmed that after hackers breached its website, they stole a key used to verify whether devices are genuine, in addition to the previously disclosed leak of customer information. The company said the attackers could potentially use the key to produce counterfeit wallets that pass authenticity checks. If these devices are sold or sent to users, they could unknowingly use them as genuine products, putting their assets at risk of theft.
Keystone said it plans to destroy 18,835 devices in its inventory that contain the key, and has suspended production and shipments of the affected devices. The report said the attackers exploited a vulnerability in a third-party monitoring tool used on its website to gain elevated privileges.
Observation 1: The risk has spread from information to the devices themselves. Buying a counterfeit device that “passes verification” is tantamount to handing your private keys to someone else. Observation 2: Fixes for supply-chain security incidents like this typically take weeks. Until patches and replacement plans are in place, the brand’s reputation will be under pressure.
Would you replace your device right away, or wait for the company to announce a replacement plan?
Source: Cointelegraph
Image 1: Keystone breach escalates: Hackers steal key used to verify hardware wallets as genuine · Image from the source report
Image source: https://cointelegraph.com/news/keystone-breach-deepens-hackers-stole-key-used-to-verify-wallets-as-genuine?utm_source=rss_feed&utm_medium=rss&utm_campaign=rss_partner_inbound
