Ledger CTO warns of a potential mass attack taking place

[Ugali]

Or just a malicious browser that replaces crypto addresses.

Or more simply a browser extension that can access and manipulate any web page.

[Lucius]

And I always wonder if something like that is possible

A couple of years ago, I read about Man In The Middle Attacks by Tor exit nodes. I think they had to remove or replace https-encryption, after which they could replace Bitcoin addresses for their own.

Maybe if they managed to install a remote access trojan on the user's computer, they would gain full access and be able to completely manipulate such things.

Or just a malicious browser that replaces crypto addresses.

I think I've heard that story too, but somehow it seems to me that hackers who know how to do it are still targeting high-value targets, primarily those who publicly talk about their "achievements" in the world of cryptocurrency. For those who keep a low profile and do not use CEXs, I believe they are exposed to much less risk.

I think the only way we can protect ourselves from such a scenario is to use air-gapped wallets and separate computers for cryptocurrencies. If hackers don't have access to our devices, then they can't do anything to us.

If you're depositing to an online service, you still need to get their address. A Letter of Guarantee could work, as long as you have their signing address from a previous visit. But I don't think any CEX (or casino) offers that. For some reason depositing is completely trust-based: if they'd say the address you found on their website isn't yours, you can't prove anything.

In that case, only mixers are the ones that provide such a service, but I think that there are few who check whether the signed address has a valid message, let's be realistic, how many people even know how to sign and verify an address/message?

As for proof of whether the deposit address belongs to a service or not, probably a screen sample or even a video would not be accepted as proof, considering that they can be faked. I don't know what else to say on this topic, something like that has never happened to me, and I hope it never will.

[Pmalek]

By the way, +1 for another fackup on the part of Ledger for compromising the developer's NPM account.

Why are you holding Ledger responsible for qix's (the name of the maintainer of the compromised JavaScript) NPM account getting hacked? They have nothing to do with that. He got tricked with a phishing email from a fake domain. He reset his NPM account password and 2FA and handled over control to the hacker(s). It's qix's fault that it happened.

This attack could have caused a lot of havoc had it been done differently. According to a report I have read, close to 20 different JavaScript packages were compromised. These packages are downloaded over 2 billion times per week. I couldn't believe those numbers.

It was only because of a build error with one of the packages that maintainers of the libraries noticed that something was going on. I wonder how long the malicious code would have remained online had everything worked the way the hackers expected it to!?

Because the packages were only available for about 2 hours and the majority of the affected software didn't pull and use the malicious libraries yet, the loss of funds was minimal. The malware inspects the address victims try to send crypto to and replace it with one that closely resembles it. Neat trick to avoid detection. So if you usually check only a few characters of the destination addresses, this address hijacker can still trick you.

This source reported that there has been another NPM supply chain attack. The '@ctrl/tinycolor' package which is downloaded over 2 million times weekly has been compromised. The compromised library contains an infostealer that searches and steals sensitive data.

[NotATether]

This source reported that there has been another NPM supply chain attack. The '@ctrl/tinycolor' package which is downloaded over 2 million times weekly has been compromised. The compromised library contains an infostealer that searches and steals sensitive data.

The simple solution is to stop developing crypto sites in NodeJS.

PHP is so much better for this purpose and it's very hardened. And you can place simple JS in there if you want.

Desktop software should not use Javascript via Electron Framework either, even things like Python and Rust are safer.