Bifrost

Edge

<div class="sg-post-des">
  Cybersecurity certification platform CER said the vast majority of wallets do not hire outside experts to perform penetration tests. 
</div> 
<div class="cointelegraph"> 
 <p>A July report from cybersecurity certification platform CER found that only six of 45, or 13.3%, of cryptocurrency wallet brands have undergone penetration testing to find security vulnerabilities. Of these, only half have performed tests on the latest versions of their products.&nbsp;</p> 
 <p>The three <a rel="noopener noreferrer nofollow" title="brands" href="https://thebittimes.com/tag/brands.html">brands</a> that have done up-to-date <a rel="noopener noreferrer nofollow" title="penetration" href="https://thebittimes.com/tag/penetration.html">penetration</a> tests are MetaMask, ZenGo, and Trust Wallet, according to the report. Rabby and Bifrost performed <a rel="noopener noreferrer nofollow" title="penetration" href="https://thebittimes.com/tag/penetration.html">penetration</a> <a rel="noopener noreferrer nofollow" title="testing" href="https://thebittimes.com/tag/testing.html">testing</a> on older versions of their software and LedgerLive did them on an unknown version (listed as “N/A” in the report). All other <a rel="noopener noreferrer nofollow" title="brands" href="https://thebittimes.com/tag/brands.html">brands</a> listed did not provide any evidence of having done these tests.</p> 
 <p>The report also provided an overall ranking of the security of each wallet, listing MetaMask, ZenGo, Rabby, Trust Wallet, and Coinbase wallet as being the most secure wallets overall.</p> 
 <figure> 
  <img src="https://cdn.thebittimes.com/images/2023/08/10/b3933ecc324812d622c1fdb23d683684.webp"> 
  <figcaption style="text-align: center;"> <em>CER rankings for wallet security. Source: CER.</em> 
  </figcaption> 
 </figure> 
 <p>“Penetration testing” is a method of finding security vulnerabilities in computer systems or software. A security researcher attempts to hack into the device or software and use it for purposes it wasn’t intended. In most cases, a penetration tester is given little to no information about how the product works. This process is used to simulate real-world attempts at hacking to uncover vulnerabilities before the product is released.</p> 
 <p>CER found that 39 out of 45 wallet brands didn't perform any penetration testing at all, not even on older versions of the software. CER speculated that the reason may be that these tests are expensive, especially if the company makes frequent upgrades to their products, stating, “We attribute it to the amount of updates an average app has, where each new update can disqualify the pentest made earlier.”</p> 
 <p>They found that the most popular wallet brands were more likely to perform security audits, including penetration tests, as they often had the funds to do so:</p> 
 <blockquote>
   “Essentially, popular wallets tend to adopt more robust security measures to protect their increasing user base. This seems logical – a higher user base often corresponds to more significant funds to secure, more visibility, and consequently, more potential threats. It can also result in a positive feedback loop, with more secure wallets attracting new users in higher numbers than the less secure ones.” 
 </blockquote> 
 <p>CER’s ranking of wallets was based on a methodology that included factors like bug bounties, past incidents, and security features, such as restore methods and password requirements.</p> 
 <p>Although most <a rel="noopener noreferrer nofollow" title="wallet" href="https://thebittimes.com/tag/wallet.html">wallet</a> <a rel="noopener noreferrer nofollow" title="brands" href="https://thebittimes.com/tag/brands.html">brands</a> don’t perform <a rel="noopener noreferrer nofollow" title="penetration" href="https://thebittimes.com/tag/penetration.html">penetration</a> <a rel="noopener noreferrer nofollow" title="testing" href="https://thebittimes.com/tag/testing.html">testing</a>, CER stated that many of them do rely on bug bounties to find vulnerabilities, which is often an effective means of preventing hacks. They rated 47 out of 159 individual <a rel="noopener noreferrer nofollow" title="wallet" href="https://thebittimes.com/tag/wallet.html">wallet</a>s as “secure” overall, meaning that they had a security score of above 60. These 159 <a rel="noopener noreferrer nofollow" title="wallet" href="https://thebittimes.com/tag/wallet.html">wallet</a>s included some that were from the same <a rel="noopener noreferrer nofollow" title="brands" href="https://thebittimes.com/tag/brands.html">brands</a>. For example, MetaMask for Edge browser was considered a separate <a rel="noopener noreferrer nofollow" title="wallet" href="https://thebittimes.com/tag/wallet.html">wallet</a> from MetamlMask for Android.</p> 
 <p><em><strong>Related: </strong><strong>Bug bounties can help secure blockchain networks, but have mixed results</strong></em></p> 
 <p>Wallet security has become an urgent issue in 2023 as over $100 million was lost in the Atomic Wallet hack on June 3. The Atomic team has speculated that the breach may have been caused by a virus or injection of malware in the company’s infrastructure, but the exact vulnerability that allowed the attack is still unknown. Web wallet MyAlgo also suffered a security breach in late February, resulting in an estimated loss to users of over $9 million.</p> 
 <template data-name="subscription_form" data-type="markets_outlook"></template> 
</div>

Only 6 out of 45 crypto wallet brands have undergone penetration testing: Report

TheBitTimes

Autres articles publiés le 9 août 2023

TikTok Star Bryce Hall Launches Capital University Podcast With Pompliano

Bitcoin’s price trapped in a narrow range amid record-low volatility

Coinbase Has Cited the Ripple Verdict 13 Times in Its Motion to Dismiss SEC Lawsuit

XRP Community Celebrates Exclusion from CoinGecko’s Security List

Harga SHIB Melesat 7 Persen Jelang Peluncuran Shibarium, Burnrate Token Juga Meningkat

Top Companies Benefiting from Bitcoin Holdings

Join our free newsletter for daily crypto updates!