hack

Trezor warned of a phishing email that has been sent out from its official domain due to a third-party security breach.
This follows last month’s security breach at shipping provider ShipMonk, which exposed the personal information of Trezor customers.
Hardware wallet maker Trezor said its third-party email provider had been breached, enabling phishing emails to be sent from its official domain.
"Please be aware that the email named 'Critical Security Alert: STM32 Entropy Vulnerability' is not coming from us, and it's a phishing attempt. Do not click on any link," Trezor wrote in an X post on Wednesday.
Trezor said it has since taken down the domain and is investigating the situation, including how the hackers were able to use its official domain for the phishing emails.
On the same day, BitBox, a Swiss bitcoin BTC-0.50%
hardware walletmaker,reporteda similar phishing email circulating under its disguise.
Marcello Paz, a crypto commentator with X username "MHPaz," said he received the phishing email, sharing screenshots showing that it asked customers to update their hardware wallets due to a "critical" vulnerability that could affect newer devices. The email credentials show official domain names and signatures, unlike typical phishing emails that use similar but fake addresses.
Not the first
Just last month, Trezor disclosed a major security incident in which a breach at its shipping provider, ShipMonk, exposed customers' personal information. While Trezor initially said around 13,700 customers had their names, cities, and email addresses leaked, the company said earlier this month that another 67,000 U.S. customers were affected by the same breach.
In June, Ledger's Donjon security research team disclosed a hardware vulnerability in the TROPIC01 chip used inside the Trezor Safe 7, demonstrating a lab-based laser attack that bypassed the chip's firmware verification system. Trezor said at the time no user funds were at risk.
A 2020 Ledger breach exposed information belonging to more than 270,000 customers, with names, email addresses, phone numbers and, in some cases, home addresses later published on a hacking forum. Ledger customers have continued to report receiving scam phone calls and physical letters years later.
#Bitcoin #Hack #hardware
$BTC

Harmony acaba de publicar una actualización forense sobre el caso de la acuñación fraudulenta de ONE.
Al principio, el mercado decía que se habían acuñado alrededor de 4B ONE. Pero la reconstrucción más reciente muestra que el total de la emisión forjada entre shards llega hasta ~3.01T ONE, a través de 6 transacciones y 4 billeteras del atacante.
Lo más destacable está en la vulnerabilidad de replay de recibos entre shards:
El atacante puede modificar los identificadores en el Merkle proof que no han sido autenticados, haciendo que los recibos que ya fueron procesados por el sistema se interpreten erróneamente como que nunca se usaron → el recibo se verifica nuevamente → el shard de destino recibe el crédito ONE sin un débito correspondiente en el shard de origen.