Thomas Coudray (@[email protected])

cybersec, hacking, protocols and binary exploitation, OSINT, web3 & more @Ledger 🚀
~~ [email protected] (pkey on ~~

[Moshe Siman Tov Bustan @MosheTov]

TeamPCP: Attack of the Clones

We detected the first ever out in the wild Shai-Hulud clone copying from the TeamPCP leaked source code last week.

The Shai-Hulud variant is a part of a family of 4 different malwares by the same actor, including credential stealing logic, and also exfiltration of personal information (IP, Location, Hostname) AND a DDoS botnet server designed to attack servers directly from the victim's machine!

The malwares are still live on npm, targeting developers via typo-squatting and Axios impersonation.

For more details, and a full technical breakdown of all the four malicious packages:
https://t.co/Ske6Bnynh7

[Ledger Donjon @DonjonLedger]

Exploiting Keyspace Reduction and Relay Attacks on NFC cards. 🔓📡

Proud to see @DonjonLedger’s name on this research — thanks to @doegox.

Go read it: https://t.co/24oUY0ZhU1

[Charles Guillemet @P3b7_]

🚨 Shai-Hulud 2.0: A new wave of npm supply-chain attacks targeting major packages (Zapier, ENS, PostHog, Postman & more) is ongoing.

Attackers inject malicious code into published versions, triggering during pre-install to gain code execution and exfiltrate environment vars, API keys, Git creds, and CI/CD secrets, then quietly exfiltrate everything.

If you use affected packages: PLEASE check this carefully: consider your credentials and secrets compromised, audit your infrastructure and rotate your credz.

If you don't have close CI monitoring, you might consider shutting down your systems!

This attack doesn't seem to target crypto in particular, but could be an efficent way to exploit exfiltrated secrets.

Stay safe.

https://t.co/vEuRluh4tv

[Charles Guillemet @P3b7_]

In my view, upgradability is best practice, security is never static, it’s a continuous journey where you always need to raise the bar.

What we recommend for Tangem users:
For best security practices, we strongly advise using very long passwords with letters, numbers & symbols.

[Feross @feross]

🚨 Your browser extensions are spying on you.
Even the ones with the blue checkmark.

Day 2 of Socket Launch Week:
We’re now protecting the Chrome extension ecosystem. 🛡️

(1/7)

[Charles Guillemet @P3b7_]

For me, the biggest takeaway from the ByBit hack is this: Corporations and financial institutions must use enterprise-grade custody solutions

Storing $1.4B in a Safe{Wallet} free smart contract with a group of signers designed for retail users should be a relic of the past🧵

[Charles Guillemet @P3b7_]

🚨 Bybit’s $1.4B Hack: The Biggest in History

Yesterday, Bybit CEO Ben Zhou announced they had been compromised, with 401,000 ETH stolen ($1.4B). This marks the third major hack in six months attributed to Lazarus, which has stolen over $3B to date.

[Thomas Coudray (@[email protected]) @ahmanone]

@blankthedev @trentdotsol Not accurate—https://t.co/XNComNLLN8's CDN caching can delay updates, making malicious versions temporarily accessible despite zero downloads showing

[Salvatore Ingala @salvatoshi]

By far the best #miniscript experience available today in the market.

[Charles Guillemet @P3b7_]

I’m pleased to tell you that today, we announced a new Ledger device with a secure E Ink touchscreen, a new standard for hardware wallets.
Here’s what you should know about Ledger Flex! 🧵

[Tavis Ormandy @taviso]

This strange tweet got >25k retweets. The author sounds confident, and he uses lots of hex and jargon. There are red flags though... like what's up with the DEI stuff, and who says "stack trace dump"? Let's take a closer look... 🧵1/n

[mitsh @bmitsh]

Pycrate has a new home : https://t.co/4GfPlm5vmL !
Please update any references to this new organization, and do not hesitate to participate and contribute !

Pycrate is the goto Python library for anything related to cellular and mobile signalling.

[Nass Eddequiouaq @nassyweazy]

Most individuals complaining about Ledger Recover evidently lack understanding of wallet security or, indeed, security in the real-world in general.

The solution, if implemented properly, will be a step in the right direction.

When I say "in the right direction", I imply that it would meet the expectations of 95% of humanity, who already place faith in ID-based recovery for their bank accounts, loans, credits, and more. After all, KYC procedures at all leading financial institutions utilize similar mechanisms. We should not be in a rush to reinvent the wheel until we have more seamless tools, primed and ready for wider adoption.

When I say "if implemented properly", I'm referring to the numerous methods to verify the authenticity of an ID. I honestly presume Ledger will uphold rigorous standards in this regard, mirroring the protocols employed by your bank today.

Ultimately, the safety of your crypto assets and NFTs is a function of the hardware and software used.

The hardware, designed, created, and shipped by scores of companies, can be tampered with by any employee along the supply chain.

Similarly, the software, provided by the wallet provider, maintained by dependency libraries, and hosted by infrastructure providers, can also be compromised.

Rejecting this feature because it necessitates collusion among three disparate entities to retrieve an encrypted recovery seed is, in most instances, irrational. The community should instead demand transparency concerning the measures and controls in place to segregate these parties, akin to the call for transparency regarding Google's Titan security chip supply chain.

To hack an institution engaged in crypto custody, potentially dealing with billions of dollars, would likely require collusion among 3-5 employees. And remember, orchestrating such an act across three separate companies is exponentially more challenging.

This entire discourse boils down to checks and balances and the implementation of layered defenses. I am a staunch advocate for creating a web3 that initially targets the low hanging fruits (such as people losing their keys or falling victim to scams) rather than chasing after unlikely scenarios that could detrimentally affect the user experience, thus potentially prompting users to ignore safety features altogether.

[Thomas Coudray (@[email protected]) @ahmanone]

@Ledger So it does not change anything in term of new introduced attack surface if we are not activating the feature 👏 in anyway we somehow have to trust the firmware code with or without this feature

[P1 Security @p1security]

P1 Security Lab is happy to release hermes-dec, an open-source disassembler and decompiler for the React Native Hermes bytecode: https://t.co/rLkP9HLS3a. We hope this will foster the security research around mobile apps based on this environment. #telecomsecurity #android #ios

[Thomas Coudray (@[email protected]) @ahmanone]

@p1security Looking forward to it! 🥳

[P1 Security @p1security]

Old GPRS encryption algorithms should be phased out, both from networks and handsets. See our last blogpost on this topic: https://t.co/WSYg2wech2 #cybersecurity #gprs

[Thomas Coudray (@[email protected]) @ahmanone]

@Dinosn Is there a compressive list of all “behavior that indicates a cellular attack” ? all the provided example (incorrect frequencies, unknown Network, frequent loc udates, ...) won't detect a correctly configured IMSI catcher, isn't it?

[Emile Aben @meileaben]

Observations on how the #Internet infrastructure in #Ukraine is holding up:
https://t.co/qQikOyWJnG

[Ah Med @A_Web_Plus]

We are #hiring. Know anyone who might be interested?
Software development on our vulnerability scanner (Python, angular, RoR, rust, lua) & operators telecom hacking(SS7, Diameter, RAN, SIP/VoLTE/VoWiFi, 5G, ...) and DevOps. Remote ✅
https://t.co/yj998PSZc4