security

/security299

Discussion on all things web3 security and auditing

1082
Vinay Vasanji
@vinayvasanji.eth·
Recently I've received multiple calls that show up as Google on Caller ID

The 'person' on the other end sounds like an employee of Google and responds in a believably human way - I almost believed them when they said my Google account had been compromised

BUT thankfully I am 99% always suspicious of any calls on my cell phone except for those from a very select few people

TL;DR: ignore calls from anyone purporting to be Google - more details on how things could go horribly wrong if you don't https://krebsonsecurity.com/2024/12/how-to-lose-a-fortune-with-just-one-bad-click/
/security
312633
barrydyne
@barrydyne·
It’s strange to me that emails are allowed to show one url and direct to a different one (browsers too). I suppose because they need to track clicks. Seems like it should be a solved thing by now.
/security
13969
Peter🎩
@silencedogood.eth·
How has the web3 auditing landscape changed in 2024 in your opinion?
/security
4926
kazani.base.eth 🦂
@kazani.eth·
Android malware (.apk) can be spread through a fake video by manipulating the telegram file extension. 0x6rss (X App) showed how it is done in the video below!

By @officercia

• x.com/officer_cia/status/1811176228918817226
/security
10174
Ray F. 🎩
@cryptowenmoon.eth·
Think twice before clicking (suspicious) links.
/security
312633
barrydyne
@barrydyne·
The “interview” attack is so smart because so many legitimate companies have you install and run sketchy software when interviewing.

Side note - Perhaps a good interview method is to insert something that could be potentially malicious and see if prospective employee picks up on it.
/security
350139
joshisdead.eth
@joshisdead.eth·
Hello, guys!

My wallet just got drained and I don't know what to do anymore. Can someone help me do it step by step? My mind won't work now. I can't process things.
/security
312
Les Greys
@les·
Getting hacked will continue to move in the direction of property crime or home crime. Where security is always the third-rate solution, necessary, yet not sufficient.
/security
740946
alp1n3.eth 🌲
@alp1n3.eth·
Shamelessly stealing memes I completely relate to 😭
/security
740946
alp1n3.eth 🌲
@alp1n3.eth·
Recently from rekt news involving the CertiK x Kraken incident: https://rekt.news/whitehat-grayarea/
/security
740946
alp1n3.eth 🌲
@alp1n3.eth·
(Another) if you missed it post!

@hatsfinance hosted a great space on X about becoming a security researcher.

Find it here: https://x.com/hatsfinance/status/1806284016254902592?s=46

And if it’s down for w/e reason I backed the audio up to TG: https://t.me/exosphere_eth
/security
740946
alp1n3.eth 🌲
@alp1n3.eth·
If you missed it, DeFi Security Summit had a CrowdCast w/ Daniel Von Fange about the @krakenweb3 hack involving CertiK.

Give it a listen here: https://t.co/B7gW1Hy3xU
/security
247959
Advantage Blockchain🔵
@ab1·
⚠️ please practice good cyber security. major organizations use threat modeling to protect their assets. don't neglect your assets
/security
308286
Viraz
@viraz·
auditing from flights is a real thing
/security
16085
Samuel ツ
@samuellhuber.eth·
The more I read microsoft, aws and other big companies webpages the more I am convinced the people making decisions to purchase know nothing.

No technical explainers, no matrix to know if you're compatible. It "just works" but every tech person knows thats false, many vague statements like "this is secure"
sadge :(
/security
922
Max
@segall·
Been dreaming of this day for MONTHS - @privy is SOC 2 compliant!!

One of the many things at Privy that wouldn't have been possible without @jayhinz 👑
/security
13969
Peter🎩
@silencedogood.eth·
PSA: Don’t forget if you successfully participated in audit contests (Cantina, C4 and CodeHawks) before the March 24th snapshot, you may be eligible for ~16k ZK from the Zksync airdrop
/security
14241
Apoorv Lathey
@apoorvlathey·
It just occurred to me, I haven't yet stumbled upon any Security Researcher's post on farcaster

Though they are quite active on Twitter / X
/security
4926
kazani.base.eth 🦂
@kazani.eth·
Security Researcher Alexander Hagenah has developed a proof-of-concept which programmatically extracts data out of Microsoft Recall

Microsoft said it would be safe, but as is tradition, it was beaten with a stick before it was even fully deployed

https://github.com/xaitax/TotalRecall
/security
9833
DRAMA
@drama·
Everyone loves web3 until their assets start being drained off, then immediately requests come in - can we block the transfer? 😅
/security
262539
▫️Onyx 📚🎩
@cipherscript.eth·
DMM Exchange confirms a $300M Bitcoin hack, valuing the loss at 48.2 billion yen.

They promise to cover all user losses, funded by DMM group companies if needed.

Services suspended include new account screenings, cryptocurrency withdrawals, and buying orders for spot trading.
/security