Compound

DeFi

Celer Network

Security

Notable

You can also read this news on COINTURK NEWS: <a href="https://en.coin-turk.com/web3-experts-share-advice-on-avoiding-phishing-attacks/" data-wpel-link="internal">Web3 Experts Share Advice on Avoiding Phishing Attacks</a> 
A security vulnerability in Squarespace domains threatens the decentralized finance (DeFi) space with phishing attacks. On July 11, security researcher ZachXBT shared a Telegram post warning the community to avoid the Compound Finance website, which redirected users to a phishing site. 
<h2 class="p1" style="text-align: justify" id="new-attack-method-in-the-web3-space">New Attack Method in the Web3 Space</h2> 
The first protocol compromised due to the vulnerability was the DeFi protocol Compound Finance. Following this, Celer Network announced it had also been attacked but successfully thwarted the attempt. Meanwhile, DefiLlama developer 0xngmi shared a list of domain names vulnerable to the same attack vector. The list included over 100 protocols, such as Polymarket, dYdX, and Pendle Finance. 
CoinGecko founder Bobby Ong explained that the attack originated from Squarespace’s domain registrar. The executive noted that after <a>Google</a> sold its domain <a href="https://finance.coin-turk.com/" data-wpel-link="exclude">business</a> to Squarespace, mandatory domain transfers led to the removal of two-factor authentication (2FA). This step left domains vulnerable. According to Ong, the community should wait for the issue to be resolved before re-engaging with crypto: 
<blockquote> 
 “The best thing to do is not interact with crypto and rest until everything is resolved in the next few days.” 
 <img loading="lazy" loading="lazy" decoding="async" class="aligncenter wp-image-370063" src="https://coin-turk.com/wp-content/uploads/2024/07/bobby.png" alt="" width="500" height="272"> 
</blockquote> 
<h2 class="p1" style="text-align: justify" id="notable-statements-on-the-issue">Notable Statements on the Issue</h2> 
Security researcher Samzsun suggested that those affected by the recent domain takeover incident at Squarespace might consider transferring to other providers. The white-hat <a href="https://newslinker.co/category/cybersecurity/" target="_blank" rel="noopener" data-wpel-link="exclude">hacker</a> recommended Cloudflare, Amazon Web Services Route 53, MarkMonitor, and CSC DBS. Meanwhile, Unstoppable Domains (UD) founder and CEO Matthew Gould took the opportunity to explain how such attacks could be prevented with <a href="https://en.coin-turk.com/2023-the-year-of-growth-and-decline-in-blockchain-networks/" data-wpel-link="internal">Web3</a> domains: 
<blockquote> 
 “By creating verified on-chain records for domains, we can offer an extra layer of protection to browsers, and others can help combat such attacks by verifying.” 
</blockquote> 
The executive added that users could even configure DNS records to be non-updatable unless a verified on-chain signature is provided. He also suggested not allowing record updates without signatures from wallets. This would require hackers to attack both the registrar and the user separately: 
<blockquote> 
 “So if your UD account is compromised or UD’s security as a registrar is breached but your wallet is not, the malicious user cannot change your domain in DNS.” 
</blockquote> 
<h5>The post first appeared on COINTURK NEWS: <a href="https://en.coin-turk.com/web3-experts-share-advice-on-avoiding-phishing-attacks/" data-wpel-link="internal">Web3 Experts Share Advice on Avoiding Phishing Attacks</a></h5>

Web3 Experts Share Advice on Avoiding Phishing Attacks

Зміст

COINTURK NEWS

Інші статті, опубліковані 12 лип. 2024 р.

Is Worldcoin (WLD) a Buy or Sell? Analyzing the Impact of Token Unlocks

Behind the Code: BlockDAG’s Documentary Reveals All on Aug 22 as Presale Hits $57.6M! Polkadot & ...

SEC Loses Key Ripple Case Points

Is It Too Late To Buy FOFAR? Fofar Price Skyrockets 385% As This Explosive AI Meme Coin Offers La...

COPIED Act seeks to regulate AI deepfakes with mandatory watermarks

Retik Finance: Is this project Legit?

Приєднуйтеся до нашої безкоштовної розсилки для отримання щоденних оновлень щодо крипто!