Bitcoin Forum
May 12, 2024, 04:13:51 AM *
News: Latest Bitcoin Core release: 27.0 [Torrent]
 
   Home   Help Search Login Register More  
Pages: « 1 2 3 4 5 [6]  All
  Print  
Author Topic: Ledger database leak --> Phishing  (Read 1839 times)
Csmiami
Copper Member
Legendary
*
Offline Offline

Activity: 1596
Merit: 1319


I'm sometimes known as "miniadmin"


View Profile WWW
January 26, 2021, 01:58:23 PM
Last edit: January 26, 2021, 03:59:36 PM by Csmiami
 #101

The caller requested a password and account identification numbers.
Why do I have the feeling this refers to the seed? Can't really think of any way of loosing the funds on a physicall device just because of a SIM swapping....

1715487231
Hero Member
*
Offline Offline

Posts: 1715487231

View Profile Personal Message (Offline)

Ignore
1715487231
Reply with quote  #2

1715487231
Report to moderator
Even if you use Bitcoin through Tor, the way transactions are handled by the network makes anonymity difficult to achieve. Do not expect your transactions to be anonymous unless you really know what you're doing.
Advertised sites are not endorsed by the Bitcoin Forum. They may be unsafe, untrustworthy, or illegal in your jurisdiction.
1715487231
Hero Member
*
Offline Offline

Posts: 1715487231

View Profile Personal Message (Offline)

Ignore
1715487231
Reply with quote  #2

1715487231
Report to moderator
Rizzrack
Copper Member
Hero Member
*****
Offline Offline

Activity: 764
Merit: 700


Defend Bitcoin and its PoW: bitcoincleanup.com


View Profile WWW
January 26, 2021, 03:13:01 PM
Merited by vapourminer (1)
 #102

Why do I have the feeling this refers to the seed? Can't really think of way of loosing the funds on a physicall device just because of a SIM swapping....
This is what it sounds like. If he "confirmed" the passphrase with the "operator" than it's 100% on him. These thieves can be very tricky but this should be common sense.
I guess this in one of the reasons the masses are reluctant to use crypto, because there is no 0800 number to call and get them back if you do some dumb shit. Both privacy and comfort come with their price tags.
Look on the bright side. In a parallel universe the "Facebook hardware wallet" might have the seed in plain text. At least it's not the case here.

stompix
Legendary
*
Offline Offline

Activity: 2884
Merit: 6317


Blackjack.fun


View Profile
January 26, 2021, 03:57:20 PM
Merited by vapourminer (1)
 #103

I don't understand what sim swap happened nor how you could blame anybody but the victim in this case.

Quote
as-yet-unnamed, called Daly City police on January 14 to report that he received a text from a person purporting to represent telecommunications provider T-Mobile, who said his account was frozen after multiple attempts were made to change his password.

This ain't swim swapping.
If a sim swap would have happened his original sim would have been deactivated by the telecom company and he would have not received any call.
Probably the first one is a different scammer.

Quote
He later received a call from a blocked number. The caller identified himself as an operator for Ledger, the crypto wallet hardware company that held the man’s Bitcoin, informing him that his account had been compromised. The caller extracted his passcode and anonymous account identification numbers.

So an unknown guy called him, told him he is a Ledger operator, and got probably the seed from him.
He lost $27k but this was totally his fault.



.
.BLACKJACK ♠ FUN.
█████████
██████████████
████████████
█████████████████
████████████████▄▄
░█████████████▀░▀▀
██████████████████
░██████████████
████████████████
░██████████████
████████████
███████████████░██
██████████
CRYPTO CASINO &
SPORTS BETTING
▄▄███████▄▄
▄███████████████▄
███████████████████
█████████████████████
███████████████████████
█████████████████████████
█████████████████████████
█████████████████████████
███████████████████████
█████████████████████
███████████████████
▀███████████████▀
█████████
.
Lucius
Legendary
*
Offline Offline

Activity: 3234
Merit: 5676


Blackjack.fun🎲


View Profile WWW
January 26, 2021, 04:37:03 PM
 #104

So an unknown guy called him, told him he is a Ledger operator, and got probably the seed from him.

Extremely naive and hard to imagine for anyone with at least a little common sense in their head. That user never realized that Ledger doesn't have phone customer support, and that seed is something not shared with strangers. If they had asked him to send them his bank card with a PIN, maybe some jewelry and cash - all of course nicely packaged and with express mail, they might have profited even more Roll Eyes

.
.BLACKJACK ♠ FUN.
█████████
██████████████
████████████
█████████████████
████████████████▄▄
░█████████████▀░▀▀
██████████████████
░██████████████
████████████████
░██████████████
████████████
███████████████░██
██████████
CRYPTO CASINO &
SPORTS BETTING
▄▄███████▄▄
▄███████████████▄
███████████████████
█████████████████████
███████████████████████
█████████████████████████
█████████████████████████
█████████████████████████
███████████████████████
█████████████████████
███████████████████
▀███████████████▀
█████████
.
LoyceV
Legendary
*
Offline Offline

Activity: 3304
Merit: 16638


Thick-Skinned Gang Leader and Golden Feather 2021


View Profile WWW
January 26, 2021, 04:40:03 PM
 #105

So an unknown guy called him, told him he is a Ledger operator, and got probably the seed from him.
He lost $27k but this was totally his fault.
It sounds like they only got his phone number from the Ledger hack. Other than that, it's a "standard" phone scam where the victim gives away access to his money.
Ledger just made it a lot easier by providing a list of Bitcoin users. For "standard" bank phishing calls (or fake tech support calls), most phone numbers can be a potential victim as most people have a bank account or a Windows computer. For crypto that percentage is a lot lower, and multiplied with the percentage of gullible people odds are even worse for the scammer. I can imagine a 1 in 100,000 successful phishing phone call isn't worth the effort, but if Ledger's data breach turned it into 1 in 100(0), it becomes (very) profitable. I'm just speculating on the numbers here of course.

Daltonik
Legendary
*
Offline Offline

Activity: 2520
Merit: 1490


View Profile
April 09, 2021, 08:04:30 AM
Last edit: April 09, 2021, 08:16:45 AM by Daltonik
Merited by ABCbits (1), DdmrDdmr (1)
 #106

A class action lawsuit has been filed against crypto wallet firm Ledger, Shopify for a 2020 customer data breach as reported by the Block   https://www.theblockcrypto.com/post/100860/ledger-shopify-class-action-lawsuit-filed  

According to lawyers, Ledger, as part of its obligations to customers, should have made sure the Shopify service was safe. The companies will have to explain why they delayed in notifying users of the problem. The firm estimates the damages at more than $5 million



LoyceV
Legendary
*
Offline Offline

Activity: 3304
Merit: 16638


Thick-Skinned Gang Leader and Golden Feather 2021


View Profile WWW
April 09, 2021, 08:48:03 AM
 #107

A class action lawsuit has been filed against crypto wallet firm Ledger, Shopify for a 2020 customer data breach as reported by the Block   https://www.theblockcrypto.com/post/100860/ledger-shopify-class-action-lawsuit-filed  
Quote from: the above link
the complaint references only two Ledger users directly, who together lost 4.2 BTC, 11 ETH and 150,000 XLM to phishing attacks. At today's prices, those holdings add up to $340,000
This is a bit far-fetched in my opinion. The only way for phishing to work, is if the user did something very dumb. A targeted $5 wrench attack would make it easier to blame Ledger.

Quote
The firm estimates the damages at more than $5 million
That's less than $20 per user who's data they leaked. Enough to buy their own wrench to defend themselves?

hilariousetc
Legendary
*
Offline Offline

Activity: 2786
Merit: 3030


Join the world-leading crypto sportsbook NOW!


View Profile
April 09, 2021, 11:40:05 AM
Merited by NotATether (2), vapourminer (1)
 #108

A class action lawsuit has been filed against crypto wallet firm Ledger, Shopify for a 2020 customer data breach as reported by the Block   https://www.theblockcrypto.com/post/100860/ledger-shopify-class-action-lawsuit-filed  

According to lawyers, Ledger, as part of its obligations to customers, should have made sure the Shopify service was safe. The companies will have to explain why they delayed in notifying users of the problem. The firm estimates the damages at more than $5 million





I was wondering if anyone was going to start a lawsuit over this. Not sure how successful it will be and it's obviously mostly shopify's fault than ledger's but maybe it'll set a new precedent if it is successful, but one thing I do hope is that it calls for better storage of customers data. If they can't keep this safe then there should be consequences. I already hate giving out scans of stuff signing up to exchanges especially when I know it can end up leaked on the web and can lead to doxing of users here. If these companies cant be trusted to keep things watertight then they should probably lose their licence or companies should withdraw from using them.  I tried signing up to a crypto platform recently and not only did they want scans of my stuff but a selfie with my ID. Fuck that. They don't even ask for that when you open up a bank account here or on some other investment platforms I've used so no idea why this is necessary and I don't fancy a picture of me with my ID potentially floating around the darknet. The irony is once this sort of info gets leaked it can and will likely be used for malicious stuff so it kinda becomes pointless especially when people start committing crimes in your name with your ID and docs. I wonder how they even store this stuff. Once received do they mark or brand it somehow so nobody else could use it if it ever was leaked somehow? It needs to be better encrypted at least. Once it's verified nobody should be able to see it other than maybe law enforcement if they have a warrant. I saw that facebook had a huge breach leaked onto the clearnet recently including Zuckerbergs personal phone number. If companies can't be guaranteed to store this stuff safely then they shouldn't be allowed to hold it in the first place.

█▀▀▀











█▄▄▄
▀▀▀▀▀▀▀▀▀▀▀
e
▄▄▄▄▄▄▄▄▄▄▄
█████████████
████████████▄███
██▐███████▄█████▀
█████████▄████▀
███▐████▄███▀
████▐██████▀
█████▀█████
███████████▄
████████████▄
██▄█████▀█████▄
▄█████████▀█████▀
███████████▀██▀
████▀█████████
▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀
c.h.
▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄
▀▀▀█











▄▄▄█
▄██████▄▄▄
█████████████▄▄
███████████████
███████████████
███████████████
███████████████
███░░█████████
███▌▐█████████
█████████████
███████████▀
██████████▀
████████▀
▀██▀▀
LeGaulois
Copper Member
Legendary
*
Offline Offline

Activity: 2870
Merit: 4095


Top Crypto Casino


View Profile
April 09, 2021, 07:53:17 PM
 #109

Boeing 737 Max crashed several times due to malfunction. Who is to blame? The manufacturer Boeing, or the airlines that used this kind of aircraft.

The company Ledger followed in a timely manner the law regarding a data breach within RGPD. They are in the rules.
Funny to see how people are upset and now pay lawyers, knowing they did nothing when they had the opportunity to ask to Ledger to delete personal information obtained about them.

But now they all are shouting  Roll Eyes

█████████████████████████
████▐██▄█████████████████
████▐██████▄▄▄███████████
████▐████▄█████▄▄████████
████▐█████▀▀▀▀▀███▄██████
████▐███▀████████████████
████▐█████████▄█████▌████
████▐██▌█████▀██████▌████
████▐██████████▀████▌████
█████▀███▄█████▄███▀█████
███████▀█████████▀███████
██████████▀███▀██████████
█████████████████████████
.
BC.GAME
▄▄░░░▄▀▀▄████████
▄▄▄
██████████████
█████░░▄▄▄▄████████
▄▄▄▄▄▄▄▄▄██▄██████▄▄▄▄████
▄███▄█▄▄██████████▄████▄████
███████████████████████████▀███
▀████▄██▄██▄░░░░▄████████████
▀▀▀█████▄▄▄███████████▀██
███████████████████▀██
███████████████████▄██
▄███████████████████▄██
█████████████████████▀██
██████████████████████▄
.
..CASINO....SPORTS....RACING..
█░░░░░░█░░░░░░█
▀███▀░░▀███▀░░▀███▀
▀░▀░░░░▀░▀░░░░▀░▀
░░░░░░░░░░░░
▀██████████
░░░░░███░░░░
░░█░░░███▄█░░░
░░██▌░░███░▀░░██▌
░█░██░░███░░░█░██
░█▀▀▀█▌░███░░█▀▀▀█▌
▄█▄░░░██▄███▄█▄░░▄██▄
▄███▄
░░░░▀██▄▀


▄▄████▄▄
▄███▀▀███▄
██████████
▀███▄░▄██▀
▄▄████▄▄░▀█▀▄██▀▄▄████▄▄
▄███▀▀▀████▄▄██▀▄███▀▀███▄
███████▄▄▀▀████▄▄▀▀███████
▀███▄▄███▀░░░▀▀████▄▄▄███▀
▀▀████▀▀████████▀▀████▀▀
stompix
Legendary
*
Offline Offline

Activity: 2884
Merit: 6317


Blackjack.fun


View Profile
April 09, 2021, 09:40:54 PM
 #110

Forget about wrench, i doubt $20 is enough to change phone number (on some parts of the world) and email address (if you use paid ones).
And talking about physical threat, let's hope the theft doesn't use gun or other more dangerous weapon Tongue

A phone number change is actually free of charge with my carrier, but the troubles of notifying all your contacts, if you used that phone for business changing it will result in far more material damages, same for the email, but at least that is something I'm not concerned of, I've received some phishing emails but things have come to a stop.
The home address is the troublesome part, you never know what stupid ideas might run through some desperate people's brains especially in these times when a lot don't have money and all over the news they keep pushing the narrative on how a few BTC can set you for life.

I tried signing up to a crypto platform recently and not only did they want scans of my stuff but a selfie with my ID. Fuck that. They don't even ask for that when you open up a bank account here or on some other investment platforms I've used so no idea why this is necessary and I don't fancy a picture of me with my ID potentially floating around the darknet.

I think this has got out of hand with this whole verification stuff, I've too opened betting accounts and they never asked for a copy of my id, I've been with Betfair for 7 years and all they've asked was a bank statement when I chose to withdraw money via bank and no to the card with which I deposited. That's was all, and now some shitty exchange wants a picture of my id, a selfie with the id and the new step is to activate your camera and do a video of yourself, looking right and looking left and ...clicking the x button and saying fy and your platform!!

And the most annoying fact is that they don't even care how real those documents are, nobody actually checks them, and even if they would want to most of them have no real legal way of doing so.





.
.BLACKJACK ♠ FUN.
█████████
██████████████
████████████
█████████████████
████████████████▄▄
░█████████████▀░▀▀
██████████████████
░██████████████
████████████████
░██████████████
████████████
███████████████░██
██████████
CRYPTO CASINO &
SPORTS BETTING
▄▄███████▄▄
▄███████████████▄
███████████████████
█████████████████████
███████████████████████
█████████████████████████
█████████████████████████
█████████████████████████
███████████████████████
█████████████████████
███████████████████
▀███████████████▀
█████████
.
dkbit98
Legendary
*
Offline Offline

Activity: 2226
Merit: 7147



View Profile WWW
April 10, 2021, 08:26:14 AM
 #111

Better start preparing your backup phrases to be imported in some hardware wallet from other manufacturers guys,
and make room in your boxes with junk hardware devices and old mp3 players, because if ledger loses this lawsuit it is going to be Au revoir for them.
That is what you get when you don't respect privacy and when you have bad communication with your customers related with multiple leaks, but that is not all
and I am hearing some rumors that new lawsuits may be coming soon from Europe so stay tuned and follow the news.

Look at the bright side of things, we can still use ledger as two factor authentication device with Fido U2F.

.
.HUGE.
▄██████████▄▄
▄█████████████████▄
▄█████████████████████▄
▄███████████████████████▄
▄█████████████████████████▄
███████▌██▌▐██▐██▐████▄███
████▐██▐████▌██▌██▌██▌██
█████▀███▀███▀▐██▐██▐█████

▀█████████████████████████▀

▀███████████████████████▀

▀█████████████████████▀

▀█████████████████▀

▀██████████▀▀
█▀▀▀▀











█▄▄▄▄
▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀
.
CASINSPORTSBOOK
▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄
▀▀▀▀█











▄▄▄▄█
LoyceV
Legendary
*
Offline Offline

Activity: 3304
Merit: 16638


Thick-Skinned Gang Leader and Golden Feather 2021


View Profile WWW
April 10, 2021, 08:40:18 AM
 #112

Look at the bright side of things, we can still use ledger as two factor authentication device with Fido U2F.
You don't need "Ledger the company" to use their hardware (for instance in combination with Electrum).

dkbit98
Legendary
*
Offline Offline

Activity: 2226
Merit: 7147



View Profile WWW
April 10, 2021, 08:43:08 AM
 #113

You don't need "Ledger the company" to use their hardware (for instance in combination with Electrum).

But you do need them to update and fix bugs in their closed source software, and I think you know what happened with ledgerHW1 and ledger blue Smiley

.
.HUGE.
▄██████████▄▄
▄█████████████████▄
▄█████████████████████▄
▄███████████████████████▄
▄█████████████████████████▄
███████▌██▌▐██▐██▐████▄███
████▐██▐████▌██▌██▌██▌██
█████▀███▀███▀▐██▐██▐█████

▀█████████████████████████▀

▀███████████████████████▀

▀█████████████████████▀

▀█████████████████▀

▀██████████▀▀
█▀▀▀▀











█▄▄▄▄
▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀
.
CASINSPORTSBOOK
▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄
▀▀▀▀█











▄▄▄▄█
malevolent
can into space
Legendary
*
Offline Offline

Activity: 3472
Merit: 1721



View Profile
April 11, 2021, 12:39:09 AM
 #114

Funny to see how people are upset and now pay lawyers, knowing they did nothing when they had the opportunity to ask to Ledger to delete personal information obtained about them.

Ledger was the one asking for and needlessly storing/transmitting peoples' info, so it was on them to keep it secure if they didn't want to delete it.

Signature space available for rent.
Pages: « 1 2 3 4 5 [6]  All
  Print  
 
Jump to:  

Powered by MySQL Powered by PHP Powered by SMF 1.1.19 | SMF © 2006-2009, Simple Machines Valid XHTML 1.0! Valid CSS!