[SC] Cryptocurrencies #1145 1BTC nog altijd geen 1 miljoen

quote:

Op donderdag 14 december 2023 15:19 schreef Erasmus het volgende:

[..]
Hierbij indirect toegegeven dat je gokverslaafd bent (lol).

Sterkte!

quote:

Op donderdag 14 december 2023 15:08 schreef TomNook het volgende:
Zou iemand een coin op kunnen noemen waarbij je aan de hand van AI sportwedstrijden kunt voorspellen en kunt wedden? Iemand?

quote:

Op donderdag 14 december 2023 15:39 schreef Mortaxx het volgende:
Daarom heb ik geen ledger

quote:

Op donderdag 14 december 2023 14:45 schreef dimmak het volgende:
[ twitter ]

Het is weer zover..

[ twitter ]

Ouch..

Het gaat om de Ledger Connect Kit. De hardware wallet en Ledger Live zijn niet aangetast.

quote:

Op donderdag 14 december 2023 15:47 schreef onlogisch het volgende:

[..]
Gewoon een A4tje toch.

@:TheFreshprince

quote:

Op donderdag 14 december 2023 17:30 schreef TheFreshPrince het volgende:

[..]
Werkt al 12,5 jaar feilloos hier

quote:

Op donderdag 14 december 2023 17:56 schreef aTypisch het volgende:

[..]
ligt er wel een beetje aan hoe je de tekens op dat papiertje genereert

quote:

Hi everyone,

Today we experienced an exploit on the Ledger Connect Kit, a Javascript library that implements a button allowing users to connect their Ledger device to third party DApps (wallet-connected Web sites).

This exploit was the result of a former employee falling victim to a phishing attack, which allowed a bad actor to upload a malicious file to Ledger’s NPMJS (a package manager for Javascript code shared between apps).

We worked swiftly, alongside our partner WalletConnect, to address the exploit, updating the NPMJS to remove and deactivate the malicious code within 40 minutes of discovery. This is a good example of the industry working swiftly together to address security challenges.

Now, I’d like to address why this happened, how we will improve our security practices to mitigate this specific risk in the future, and share our recommendation to the industry, so we can be stronger together.

The standard practice at Ledger is that no single person can deploy code without review by multiple parties. We have strong access controls, internal reviews, and code multi-signatures when it comes to most parts of our development. This is the case in 99% of our internal systems. Any employee who leaves the company has their access revoked from every Ledger system.

This was an unfortunate isolated incident. It is a reminder that security is not static, and Ledger must continuously improve our security systems and processes. In this area, Ledger will implement stronger security controls, connecting our build pipeline that implements strict software supply chain security to the NPM distribution channel.

It is also a reminder that collectively we need to continue to raise the bar for security around DApps where users will engage in browser-based signing. It was Ledger’s service that was exploited this time, but in the future this could happen to another service or library.

At Ledger, we believe clear signing, as opposed to blind signing, will help mitigate these issues. If the user can see what they sign on a trusted display, unintentionally signing rogue transactions can be avoided.

Ledger devices are open platforms. Ethereum has a plugin system that allows DApps to implement clear signing, and DApps who would like to implement this protection for their users can learn how on developer.ledger.com. In the same way we saw the community come together today, we look forward to your help bringing clear signing to all DApps.

Ledger has engaged with authorities and is doing all we can to help as this investigation unfolds. Ledger will support affected users in helping to find this bad actor, bring them to justice, track the funds, and work with law enforcement to help recover stolen assets from the hacker. We deeply regret the events that unfolded today for affected individuals.

The situation is now under control and the threat has passed. We understand the panic this caused for the community and broader ecosystem.

A full timeline is available below so you can see how our teams and partners responded.

Merci,
Pascal Gauthier

Chairman & CEO

—–

Here is the timeline of what we know about the exploit at this moment:

This morning CET, a former Ledger Employee fell victim to a phishing attack that gained access to their NPMJS account. The attacker published a malicious version of the Ledger Connect Kit (affecting versions 1.1.5, 1.1.6, and 1.1.7). The malicious code used a rogue WalletConnect project to reroute funds to a hacker wallet. Ledger’s technology and security teams were alerted and a fix was deployed within 40 minutes of Ledger becoming aware. The malicious file was live for around 5 hours, however we believe the window where funds were drained was limited to a period of less than two hours. Ledger coordinated with WalletConnect who quickly disabled the the rogue project. The genuine and verified Ledger Connect Kit version 1.1.8 is now propagating and is safe to use.

For builders who are developing and interacting with the Ledger Connect Kit code: connect-kit development team on the NPM project are now read-only and can’t directly push the NPM package for safety reasons. We have internally rotated the secrets to publish on Ledger’s GitHub. Developers, please check again that you’re using the latest version, 1.1.8.

Ledger, along with WalletConnect and our partners, have reported the bad actor’s wallet address. The address is now visible on Chainalysis. Tether has frozen the bad actor’s USDT.

We remind users to always Clear Sign with your Ledger. What you see on the Ledger screen is what you actually sign. If you still need to blind sign, use an additional Ledger mint wallet or parse your transaction manually. We are actively talking with customers whose funds might have been affected, and working proactively to help those individuals at this time. We are also filing a complaint and working with law enforcement on the investigation to find the attacker. On top of that, we’re studying the exploit in order to avoid further attacks. We believe the attacker’s address where the funds were drained is here: 0x658729879fca881d9526480b82ae00efc54b5c2d

We would like to thank WalletConnect, Tether, Chainalysis, zachxbt, and the whole community that helped us and continue to help us quickly identify and solve this attack. Security will always prevail with the help of the whole ecosystem.

The Ledger team

quote:

We have strong access controls, internal reviews, and code multi-signatures when it comes to most parts of our development. This is the case in 99% of our internal systems.

quote:

Op vrijdag 15 december 2023 08:37 schreef recursief het volgende:
Ja dat is k?¤&&(;t en een slechte beurt van Ledger.

Dit baart me nog de meeste zorgen:
[..]
Je kan geen strenge protocollen hanteren voor 99% van je systemen. Dat moet 100% zijn. De zwakste schakel bepaalt hoe secure je bent.

quote:

Verder zou ik browser signing altijd wantrouwen. Bijvoorbeeld voor PCS en Metamask gebruik(te) ik altijd een aparte wallet met maar een beperkte hoeveelheid assets.

quote:

Op vrijdag 15 december 2023 09:08 schreef onlogisch het volgende:
Ja, of je moet gewoon accepteren dat er nooit 100% garantie geboden kan worden. Er is ook geen 100% garantie dat je hart morgen nog tikt, je auto het nog doet of je portemonnee niet wordt gestolen.

quote:

Op vrijdag 15 december 2023 09:08 schreef onlogisch het volgende:
Ja, of je moet gewoon accepteren dat er nooit 100% garantie geboden kan worden. Er is ook geen 100% garantie dat je hart morgen nog tikt, je auto het nog doet of je portemonnee niet wordt gestolen.

quote:

Op vrijdag 15 december 2023 10:43 schreef aTypisch het volgende:

[..]
onlogisch snapt er niet zoveel van

quote:

Op vrijdag 15 december 2023 10:45 schreef Bezsen het volgende:

[..]
Niet voor niets verloor onlogisch zijn waves wallet