Hedera

Security

Watchtower

<p><em>Crypto-Sec is our bi-weekly round-up of crypto and cybersecurity stories and tips. </em></p>
<h2 class="wp-block-heading" id="h-biggest-phish-of-the-week-attacker-targets-hedera-users">Biggest phish of the week: Attacker targets Hedera users</h2>
<p>On June 26 a marketing email for Hedera was hacked, with the attacker sending out phishing emails to the teams subscribers. Hedera is the developer of Hedera Hashgraph, a proof-of-stake blockchain network launched in 2018.</p>
<p>The team acknowledged the hack in a post to X and warned users not to interact with any links in emails from marketing@hedera.</p>
<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter">
 <div class="wp-block-embed__wrapper">
  <blockquote class="twitter-tweet">
   <p>The marketing@hedera email has been compromised. Do not open any emails or links from this address. We'll provide more details soon.</p>— Hedera (@hedera) <a href="https://twitter.com/hedera/status/1805866980437803219?ref_src=twsrc%5Etfw" target="_blank" rel="noopener noreferrer nofollow">June 26, 2024</a>
  </blockquote>
 </div>
</figure>
<p><br>Phishing is a technique where an attacker poses as a trusted source and convinces the user to give away information or to perform an action the attacker desires. In this case, the attacker used the compromised Hedera email to pretend to be a representative of the development team.</p>
<p>The team has not yet disclosed what was in the phishing emails. However, most crypto phishing emails offer the user an enticing reward, such as a token airdrop, if they click on a link to navigate to the attackers fake website, which often appears to be from a trusted source. When the user connects to the website with their wallet, they are asked to authorize token approvals to receive the airdrop.</p>
<div class="container">
 <a href="https://servedbyadbutler.com/go2/;ID=169476;size=728x90;setID=601214;referrer=https%3A%2F%2Fcointelegraph.com%2Fmagazine%2Fwp-json%2Fwp%2Fv2%2Fposts%3F_embed%26per_page%3D100" target="_blank" rel="noopener noreferrer nofollow"><img src="https://servedbyadbutler.com/adserve/;ID=169476;size=728x90;setID=601214;referrer=https%3A%2F%2Fcointelegraph.com%2Fmagazine%2Fwp-json%2Fwp%2Fv2%2Fposts%3F_embed%26per_page%3D100;type=img"></a>
</div>
<div class="container">
 <a href="https://servedbyadbutler.com/go2/;ID=169476;size=300x250;setID=601213;referrer=https%3A%2F%2Fcointelegraph.com%2Fmagazine%2Fwp-json%2Fwp%2Fv2%2Fposts%3F_embed%26per_page%3D100" target="_blank" rel="noopener noreferrer nofollow"><img src="https://servedbyadbutler.com/adserve/;ID=169476;size=300x250;setID=601213;referrer=https%3A%2F%2Fcointelegraph.com%2Fmagazine%2Fwp-json%2Fwp%2Fv2%2Fposts%3F_embed%26per_page%3D100;type=img"></a>
</div>
<p>But instead of allowing the user to obtain the airdrop, these approvals allow the attacker to drain the users wallet. Users should consider being extra cautious when clicking links from emails, even if the emails come from what appears to be a trusted source. As the Hedera example illustrates, even trusted email addresses can be hacked or spoofed.</p>
<p>The Hedera team promised to provide more details soon. Cointelegraph could not determine how much crypto, if any, was lost due to the phishing emails at the time of publication.</p>
<h2 class="wp-block-heading" id="h-white-hat-corner-moveit-file-transfer-vulnerability-is-patched">White hat corner: MoveIt file transfer vulnerability is patched</h2>
<p>Security researchers discovered a critical vulnerability in the MoveIt file transfer software developed by Progress, according to an official bulletin from the softwares development team. However, the vulnerability has been <a href="https://community.progress.com/s/article/MOVEit-Transfer-Product-Security-Alert-Bulletin-June-2024-CVE-2024-5806" target="_blank" rel="noopener noreferrer nofollow">patched</a> in its current version.</p>
<p>Some large businesses use MoveIt Transfer to transfer files between employees. These files could contain customer data, private keys or other sensitive information. According to a report from cybersecurity firm Watchtower Labs, the vulnerability <a href="https://labs.watchtowr.com/auth-bypass-in-un-limited-scenarios-progress-moveit-transfer-cve-2024-5806/" target="_blank" rel="noopener noreferrer nofollow">allowed</a> an attacker to impersonate any user on an enterprises network as long as the attacker knew the users username.</p>
<p>To perform the attack, the hacker needed to supply the server with a username. In response, the server would ask for the users private key. But instead of producing the real key (which the attacker presumably wouldnt know), they could supply a file path containing a fake key they generated themselves.</p>
<p>Because of peculiarities in the way the MoveIt software handled this situation, it would produce an empty string as the public key. As a result, the authentication would appear to fail. However, Watchtower discovered that although the authentication would produce an error message and seem to fail, the crucial statuscode variable used to block invalid users would treat the attacker as if they had properly authenticated.</p>
<div class="article-suggest">
 <div class="article-suggest__title display3">
  Read also
 </div>
 <div class="article-suggest__items">
  <div class="article-suggest__item">
   <a href="https://cointelegraph.com/magazine/risks-benefits-venture-capital-funds-crypto-communities/" rel="noopener noreferrer nofollow"> <span>Features</span> <p>The risks and benefits of VCs for crypto communities</p> </a>
  </div>
  <div class="article-suggest__item">
   <a href="https://cointelegraph.com/magazine/attack-zkevms-cryptos-10x-moment/" rel="noopener noreferrer nofollow"> <span>Features</span> <p>Attack of the zkEVMs! Cryptos 10x moment</p> </a>
  </div>
 </div>
</div>
<p>As a result, the attacker would be able to access any files that the real user could access, allowing them to gain sensitive client or customer data.</p>
<p>Progress patched the vulnerability on June 25. However, some businesses may not have upgraded to the latest version yet. The developer stated, We strongly urge all MOVEit Transfer customers on versions 2023.0, 2023.1 and 2024.0 to upgrade to the latest patched version immediately. <br><br>The company said that MoveIt Cloud is unaffected by the vulnerability, as it has already been patched.</p>
<h2 class="wp-block-heading" id="h-address-poisoning-attack">Address poisoning attack</h2>
<p>Blockchain security firm Cyvers detected a large address poisoning attack on June 28. The victim lost over $70,000 worth of USDT.</p>
<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter">
 <div class="wp-block-embed__wrapper">
  <blockquote class="twitter-tweet">
   <p>ALERTOur AI-powered system has detected an address poisoning attack. <a href="https://t.co/P9B1inEQ9N" target="_blank" rel="noopener noreferrer nofollow">https://t.co/P9B1inEQ9N</a><br><br>The attacker initiated the poison transaction two days ago: <a href="https://t.co/VEQrT4VXYL" target="_blank" rel="noopener noreferrer nofollow">https://t.co/VEQrT4VXYL</a><br><br>Unfortunately, 23 hours ago, the victim mistakenly sent 70k USDT to the scammer.<br>The funds are <a href="https://t.co/Klq9KUSlTo" target="_blank" rel="noopener noreferrer nofollow">pic.twitter.com/Klq9KUSlTo</a></p>— Cyvers Alerts (@CyversAlerts) <a href="https://twitter.com/CyversAlerts/status/1806676887428612312?ref_src=twsrc%5Etfw" target="_blank" rel="noopener noreferrer nofollow">June 28, 2024</a>
  </blockquote>
 </div>
</figure>
<p><br>The attack began on June 25, when the victim <a href="https://arbiscan.io/tx/0x1187a3e85332978c78c8e269b1924b2f2924b1ea88cd77195e7f21a64a76a3fb" target="_blank" rel="noopener noreferrer nofollow">transferred</a> 10,000 USDT to a Binance deposit address that began with 0xFd0C0318 and ended with 1630C11B.</p>
<p>Shortly afterward, the attacker <a href="https://arbiscan.io/tx/0x30f00ed1ae48b59055b30c0cdca4ec96e7e567b23b048ea328670dff19c4f994" target="_blank" rel="noopener noreferrer nofollow">sent</a> 10,000 fake USDT from the victims account to an account under the attackers control. This transfer was not authorized by the victim, but because the fake token contained a malicious transfer function, it was successful.</p>
<p>The address these fake tokens were sent to began with 0xFd0Cc46B and ended with 6430c11B, containing the same first six and last four characters as the victims Binance deposit address. The attacker likely used a vanity address generator to create this similar-looking address.</p>
<p>Two days later, on June 27, the victim <a href="https://arbiscan.io/tx/0xe35fa66ba1238c203b8235197cf59869068dcbdb021f30c194a6ce93a31f0f5f" target="_blank" rel="noopener noreferrer nofollow">sent</a> 70,000 USDT to this malicious address. The victim probably cut and pasted the address from their transaction history, intending to deposit the funds to Binance. However, Binance did not receive the funds, and they are now in the attackers hands.</p>
<p>The Tether development team can freeze wallet addresses holding USDT. However, they will generally only freeze an address after a request from law enforcement. At the time of publication, this wallet still holds USDT and has not yet swapped it for other tokens, so a freeze may have already occurred. If the address has not yet been frozen, there is still time to make a complaint, and the victim may yet get their funds back.</p>
<p>However, it is also possible that the attacker may swap the USDT for Ether or other cryptocurrencies before the address is frozen, in which case the funds will be much more difficult to recover.</p>
<p>Crypto users should be aware that some wallet applications load transaction history directly from the blockchain. As a result, they sometimes show transactions as being from the user when they are, in fact, from a third party. Users are advised to check all characters of an address before sending a transaction, not just the first and last characters.</p>
<p>Unfortunately for this user, they may have learned this lesson at a high price, as they could be $70,000 poorer as a result of this mistake.</p>
<h2 class="wp-block-heading" id="h-centralized-exchanges">Centralized exchanges</h2>
<p>On June 22, Istanbul-based crypto exchange BtcTurk was exploited via a stolen private key. The exchange <a href="https://status.btcturk.com/" target="_blank" rel="noopener noreferrer nofollow">acknowledged</a> the attack on the following day. According to a Google translation, the statement read in part, Dear user, our teams have detected that there was a cyber attack on our platform on June 22, 2024, which caused uncontrollable [losses] to be taken.&nbsp;</p>
<p>The exchange stated that the attack was only performed against its hot wallets, and the bulk of its assets remain safe. It also claimed that it has enough financial strength to pay back users for the losses and that customer balances will be unaffected.</p>
<p>Cybersecurity firm Halborn <a href="https://www.halborn.com/blog/post/explained-the-btc-turk-hack-june-2024" target="_blank" rel="noopener noreferrer nofollow">estimated</a> that BtcTurk lost over $55 million in the attack.</p>
<p>According to onchain sleuth ZackXBT, the attacker likely <a href="https://t.me/investigations/135" target="_blank" rel="noopener noreferrer nofollow">deposited</a> 1.96 million AVAX ($54.2 million) to centralized exchanges Coinbase, Binance and Gate, which was subsequently swapped for Bitcoin, as onchain data shows nearly equivalent values of BTC being transferred out of these exchanges right after the AVAX was transferred in.</p>
<p>AVAX fell by 10%, apparently as a result of these swaps.</p>
<figure class="wp-block-image aligncenter is-resized">
 <img src="https://lh7-us.googleusercontent.com/docsz/AD_4nXdSLUB35rs52Jlv-y-ppu46Aov-F_NAUn3wWEs3jH_boL6R95MpvlVb0FUsv6TmMLl1bzT0dJFstewD3-kjepzp2B9NpcZaSys8U305WIx7cas_l3Lnt9SKI-_RgpRUNxIzwHdaBF7cm4B2IPb34y2_lA?key=IpNln8YNjPY2Bfsxxkuk7g" alt="" style="width: 100%;height:auto">
</figure>
<p><em>Reported attacker deposits to and from centralized exchanges. Source: (ZachXBT, Telegram</em>)</p>
<p>Since the attack, BtcTurk has launched new hot wallets with private keys that are not under the attackers control. The exchange has strongly advised users not to use old deposit addresses, as any funds sent to them will likely be stolen by the attacker. Instead, users should deposit using new addresses found within the apps interface.</p>
<div class="subscribe subscribe--inner">
 <div class="container">
  <div class="subscribe__inner">
   <div class="subscribe__content">
    <div class="subscribe__title display2">
     Subscribe
    </div>
    <div class="subscribe__desc text-l">
     The most engaging reads in blockchain. Delivered once a week.
    </div>
    <div class="wpcf7 no-js" id="wpcf7-f13672-o1">
     <div class="screen-reader-response">
      <p></p>
      <ul></ul>
     </div>
     <div style="display: none;">
     </div>
     <p>Email address</p>
     <p>SUBSCRIBE</p>
     <div class="wpcf7-response-output"></div>
    </div>
   </div>
   <div class="subscribe__img">
    <img src="https://s3.magazine.cointelegraph.com/magazine/wp-content/uploads/2022/10/reading-copy.png" alt="Subscribe to Magazine by Cointelegraph Newsletter.">
   </div>
  </div>
 </div>
</div>

Crypto-Sec: Phishing scammer goes after Hedera users, address poisoner gets $70K

Table of Contents

Cointelegraph

Other articles published on Jul 1, 2024

Join our free newsletter for daily crypto updates!