In DeFi, there are many lending and borrowing platforms. Users on these platforms can either lend tokens to receive interest or borrow tokens to conduct other activities. Naturally, the borrowers...
Denial of Service (DoS) are attacks that come from disallowing access to a service. In the context of blockchain applications, this can be completely rejects access to the service to somebody else...
What is cross-tenant risk? How do you spot vulnerabilities? And how can the famous PEACH framework help?
1. EXECUTIVE SUMMARY CVSS v3 10.0 ATTENTION: Exploitable remotely/low attack complexity Vendor: Illumina Equipment: Universal Copy Service (UCS) Vulnerabilities: Binding to an Unrestricted IP...
Authored by Dexter Shin Minecraft is a popular video game that can be played on a desktop or mobile. This... The post HiddenAds Spread via Android Gaming Apps on Google Play appeared first on McAfee Blog.
The fsevents npm package previously pulled certain remote binaries from a public S3 bucket (fsevents-binaries.s3-us-west-2.amazonaws.com). At some point the bucket expired and the domain became...
CISOs of Paramount, Aon and Wiz reveal their secrets for creating a future-proof approach to cloud security.
Group-IB Digital Risk Protection discovers more than 3,200 fake Facebook profiles in ongoing phishing campaign that sees scammers impersonate Meta support staff
It would take hours to cover everything endpoint security can do, but this blog covers it in a few aspects: a high-level overview, a deeper dive and how detection engineers can leverage it.
New alliance to enable organizations to proactively identify, prioritize, remediate, and prevent risks in their cloud.
The Ocean Life token on BSC was hacked. Ocean Life token is a deflationary token. This means that over time the token will disappear. Why? With less supply comes more demand. For more on...
The project being tested was from Alchemist. They developed the Fjord Foundry platform which has an ERC-20 token called MIST, a staking and rewards platform called Aludel and a smart wallet called...
How to investigate phishing campaigns
Platypus Finance is an AMM protocol on the Avalanche blockchain. It has asset liability management and swapping capabilities. In February of 2023, they introduced USP, a new stablecoin....
DyDx is a trading platform perpetuals, leveraged trading and general trades that runs on Ethereum. DyDx had a smart contract for currency conversion that worked by trading all assets to USDC then...
This article goes into the security problems that can occur while using proxies. This website is meant to be all the research to do with proxies in the blockchain space. The first vulnerability...
Authored by Dexter Shin McAfee Mobile Research Team found an Android banking trojan signed with a key used by legitimate... The post Fakecalls Android Malware Abuses Legitimate Signing Key...
On 2023-04-21, a campaign was reported, involving 8220 Gang, gaining initial access via 1-day vulnerability, to achieve Resource hijacking.
Our team is tracking in-the-wild exploitation of zero-day vulnerabilities against PaperCut MF/NG which allow for unauthenticated remote code execution due to an authentication bypass.
In some way, shape or form, the Bug bounty scope needs documented scope. On Immunefi, this typically labels contracts or websites in scope and assets at risk. So, what happens when the company...
The article dives into the different proxy patterns and the security issues that can arise from this. First, there is the simple proxy. This makes a delegateCall to the implementation code. The...
A container escape vulnerability, combined with accidental 'write' permissions to a private registry, opened a backdoor for Wiz Research to access Alibaba Cloud databases and potentially...
Google's Threat Analysis Group shares first quarter cyber updates on the threat landscape from the war in Ukraine.
Report informing readers about the threat to UK industry and society from commercial cyber tools and services.
Yearn Finance is a suite of products to yearn yield on digital assets. This includes staking tokens to earn interest and selling/buying votes. For the yield-bearing assets, users can put positions...
Automated Market Makers are great! Well, until you manipulate the algorithmic part of it. It was audited by WhitehatDAO who cleared missed some things. In Hundred Finance, hTokens are liquidity...
VM2 is a sandbox for NodeJs. The idea is that untrusted code can be executed within this context without anything sensitive being stolen or important items altered. Being able to escape the...
Osmosis Zone is a decentralized exchange built in the Cosmos ecosystem. A reddit user made a comment that a bug in the liquidity pool allowed a gain of 50% for simply adding and removing liquidity...
Escaping input is very important when trying to prevent XSS, code injection and many other classes of vulnerabilities. However, the escaping is context dependent. In some situations, a single...
The author of this post noted a weird issue on Twitter: thieves were wrecking a mans cars to eventually steal it. Why and how? They wanted direct access to the Controller Area Network (CAN) bus....