Tech Byte™

"MITM logs from MoonRankNFT show the mnemonic being passed to Slope servers over POST requests. Wallet name purely coincidental" The reason for the recent Solana hack through slope.

"The recent Solana "hack" was actually due to an accidental leak from Slope wallet's backend (which was potentially compromised). The Solana blockchain remains unaffected. Slope will put out a statement explaining what happened in greater detail shortly." Fatman

US-China Tension.

"how to block DDoS attacks on your website from 99% of SKID DDoS services who cant code? 1: Most real users dont send X-FORWARDED-FOR header, you can put a JS challenge if they do. 2: Real users dont have 2 IPs in their X-FORWARDED header, if it includes a "," put a captcha. 3: Block or put manual captcha on UA: "Mozilla/5.0 (X11; Linux x86_64; rv:94.0) Gecko/20100101 Firefox/94.0" (This will block all their trash "BROWSER" method and cant bypass JS) 4: Any kind of ratelimit will severely impact their attack, since they try to send 64 RQPS per IP hahaha. Update: to block browser method you can just challenge all UAs containing Gecko/20100101 " Source:Unknown

"The combined market cap of the top 4 stablecoins (USDT, USDC, BUSD, and DAI) flipped Ethereum for the first time in July 2022, a report by Glassnode reveals." What does it mean?

From Coinfessions.

Top Most Exploited Vulnerabilities In 2021 1 Log4Jshell 2 Confluence Server RCE 3 Proxyshell 4 ProxyLogon 5 VMWare RCE - CVE-2021-21972

Which one is your favorite?

"Opensea implemented a new feature and it's being exploited. You can buy an item on behalf of a different wallet address. People are buying on behalf of @garyvee, @pranksy, and other influencers. Wallet trackers show it as them buying the NFT themselves. Then people fomo in. 🤦"

Tip: "A botnet is a number of Internet-connected devices, each of which runs one or more bots.Botnets can be used to perform #DDoS attacks, steal data,send spam,and allow the attacker to access the device and its connection"

You know that Pro-Iran Hacktivists claim to have conducted a major DDOS attack on NASDAQ, the New York City Stock Exchange on may? "This attack is in response to the deaths of Iraqi children caused by U.S. economic sanctions. This attack is for every Iranian family that has been deprived of food as a result of the United States' criminal policies. This attack is for the sake of the Syrian and Yemeni children killed by the United States for oil. This attack is in retaliation for every family in Russia that was unjustly placed under siege. This attack is directed at every nation that believes God is incapable of it." The team

On June 1, 2022, 21-year-old computer science student Sebastian Raul was arrested upon his return from vacation at the Rabat airport in Morocco. According to OBS , Raul is now in custody at the Tiflet 2 prison in Morocco. Raul has been under the gun of the FBI for several months now. He is suspected of being "one of the important members" of the ShinyHunters hacker group , which US authorities describe as "productive cybercriminals". ShinyHunters came to light in the spring of 2020, when the group put up about 200 million stolen data for sale on the dark web after hacking the IT systems of numerous companies around the world. The US is seeking Raul's extradition on charges of "conspiracy to commit electronic fraud", "electronic fraud" and "identity theft". According to the FBI investigation, the crimes could have been committed from French and Moroccan IP addresses that could be linked to Sebastian Raul. American investigators also gained access to forum posts attributed to Raoul in which he shared information about the stolen data. In the US, Sebastian Raul faces 116 years in prison for alleged actions. According to Sebastian's father, Raul denies all allegations and claims that his accounts were used without his knowledge. “Requesting the transfer of a student to the United States is effectively a life sentence, prohibited by Article 3 of the ECHR (European Convention on Human Rights),” said Raul’s lawyer, Philippe Ohayon. According to the lawyer, in France, Raul can get a maximum of 5 years in prison, so Ohayon demanded the student's extradition to France. On July 29, 2022, the prosecutor of the Republic of Épinal (France) received a request from a lawyer and will soon decide on the fate of Sebastian Raoult. source: SecurityLab

A week after the fixes for a critical vulnerability in Confluence that occurs after installing the Questions For Confluence application, hackers began to actively exploit the gap in the wild. This is a vulnerability CVE-2022-26138 associated with a hard-coded password for a user account named disabledsystemuser. As soon as the hard-coded username and password were published on Twitter, the attackers immediately began to try to use them for their own purposes. For experts, this came as no surprise, since Confluence is a tasty morsel for hackers who use its vulnerabilities to carry out ransomware attacks. Experts note that the vulnerability appears only when the Questions for Confluence application is enabled. However, deleting the application does not eliminate the vulnerability, as the hard-coded data account is not removed when the application is uninstalled. Experts recommend that users update Confluence to the latest versions (2.7.38 and 3.0.5) or disable/delete the account as soon as possible. source: SecurityLab. Im playing with this bug? anyone else? comment below.

Unidentified hackers hacked the Nirvana Finance De-Fi platform and withdrew about $3.5 million in USDT, crypto trader and former web developer Andy D reported. He noticed that the hackers funneled the funds into the Ethereum mainnet and then exchanged them for the DAI stablecoin. Nirvana Finance, a yield protocol based on Solana, has been hit by a $3.5 million exploit using instant loans to manipulate and drain its liquidity pools, according to blockchain data. In fact, Nirvana Finance has two tokens: ANA, a reserve-backed, volatile asset with a rising floor, and NIRV, a stablecoin. Over the past few hours, there has been a significant decline in the value of both tokens. Nirvana's stablecoin NIRV has depleted by almost 90%, and ANA by about 85%. In early July, the attacker hacked the Crema Finance protocol on the Solana blockchain in the same way and withdrew $8.7 million worth of cryptocurrency. The scammer used the Solend protocol's quick loans service. After the hack, Crema Finance made a deal with the hacker to get $9 million back. The crypto hacker managed to get 45,455 solans (SOL) as a reward, which is $1.76 million. The remaining $7.3 million in stolen ETH and SOL were returned. Source: https://www.securitylab.ru/news/533015.php

"I made $300,000 from a withdrawal bug on AutoFarm protocol. They never reported it... neither did I." Confessions.

From Coinfessions.

The FBI observed how cybercriminals contacted US investors offering cryptocurrency investment services and persuaded people to download fraudulent applications. Attackers used applications to swindle investors of their cryptocurrency, ” the FBI said in a statement . The campaign resulted in 244 victims and an estimated $42.7 million in losses between October 4, 2021 and May 13, 2022, according to the FBI. Attackers masquerade as the names and logos of legitimate organizations to create phishing apps to lure investors. The FBI noted 3 cases in which scammers posed as one American financial firm and two companies YiBit and Supayos (Supay) to defraud 34 victims of about $10 million. Cybercriminals tricked investors into downloading fake cryptocurrency apps and stole funds deposited into the account users. “Financial institutions should alert their customers to this activity and inform them if the company offers cryptocurrency-related services,” the FBI warned, urging investors to watch out for unsolicited requests to download investment apps from untrustworthy sources. Source: https://www.securitylab.ru/news/532850.php

Just be aware! Move funds from Kucoin so you can be on the safe side!