random

Dark

Bitcoin

Security

Robin

Security researchers recently disclosed a new type of malicious attack that allows hackers to access hardware wallets and user private keys after two signed transactions. The researchers dubbed the attack Dark Skippy that works if a hacker tricks a user into downloading a malicious firmware.
Nick Farrow, Lloyd Fournier, and Robin Linus published the disclosure detailing the information about Dark Skippy. Nick Farrow and Lloyd Fournier are co-founders of the upcoming hardware wallet firm Frostsnap. Robin Linus is involved in the Bitcoin protocols BitVM and ZeroSync.
The report explained how every signing device inserts random values known as nonces for every signed BTC transaction. Weak nonces can allow attackers to decipher private keys from the signatures through ‘nonce grinding.’&nbsp;
Dark Skippy attacks depend on a similar technique. An attacker introduces malicious firmware to the signing device. The malicious firmware generates weak nonces every time the device signs a transaction.&nbsp;
An attacker can use techniques like Pollard’s Kangaroo Algorithm to compute the seed phrase and access a victim’s wallet. Dark Skippy is faster and requires fewer signed transactions compared to older nonce grinding techniques.
<h3 id="span-style-font-weight-400-researchers-suggest-mitigating-measures-for-dark-skippy-span">Researchers suggest mitigating measures for Dark Skippy</h3>
Nick, Robin, and Lloyd offered <a href="https://x.com/utxoclub/status/1820520969779429809" rel="noopener noreferrer nofollow" target="_blank">mitigation measures</a> to deal with Dark Skippy. The researchers explained that most signing devices have hardware security defenses to prevent the loading of malicious firmware. Some include securing device physical access, employing hardware security techniques, buying legit signing devices, and more.
Nick <a href="https://x.com/utxoclub/status/1820520969779429809" rel="noopener noreferrer nofollow" target="_blank">tweeted</a> about suggested protocol-based mitigations used in the past, including anti-exfil and deterministic nonces. The three researchers presented new mitigation measures that could coexist with <a href="https://x.com/primalkey/status/1661375108038942720" rel="noopener noreferrer nofollow" target="_blank">partially signed Bitcoin transactions</a> (PSBT) signing workflows in their report.
The two suggested measures include mandatory adaptor signatures and mandatory nonce proof-of-work. The measures aim to disrupt the Dark Skippy attacks like new PSBT fields.
The Frostsnap co-founder still insisted on <a href="https://darkskippy.com/mitigations.html" rel="noopener noreferrer nofollow" target="_blank">mitigation discussions</a> and implementations to deal with the new threat. The researchers also asked readers and industry experts to provide feedback on the mitigation measures provided in the report.&nbsp;
<h3 id="span-style-font-weight-400-bitrace-warns-about-new-qr-code-scams-span">Bitrace warns about new QR code scams&nbsp;</h3>
<blockquote class="twitter-tweet" data-width="550" data-dnt="true">
 「After scanning a QR code, I was robbed.」
 Bitrace found a new type of scam where theft is carried out through a payment QR code transfer test, essentially deceiving users into authorizing wallets.
 Thread 🧵
 — Bitrace (@Bitrace_team) <a href="https://twitter.com/Bitrace_team/status/1821475890544689633?ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow" target="_blank">August 8, 2024</a>
</blockquote>
<script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script>
Bitrace recently <a href="https://x.com/Bitrace_team/status/1821475890544689633" rel="noopener noreferrer nofollow" target="_blank">tweeted</a> about a new scam that tricks users into authorizing wallets. A recent crypto wallet theft victim contacted the company requesting assistance. The victim explained that their funds were all stolen after testing a transfer of 1 USDT through a QR code. The victim revealed that they couldn’t understand how someone robbed them after only scanning a QR code.
The data analytics company explained that QR code scams were a new scam type involving a QR code transfer test. The scammers first suggest an over-the-counter transaction to unaware victims. The bad actors then offer lower rates than other crypto market services.&nbsp;
The company also revealed that scammers offer TRX as a fee for long-term cooperation and make a USDT payment to gain trust. The scammer then requests a small payment test to access a victim.
<a href="https://x.com/Bitrace_team/status/1821475897524080677" rel="noopener noreferrer nofollow" target="_blank">Bitrace</a> tested the scam using an empty wallet and the QR code the victim provided. The company said the scan led them to a third-party website requesting a repayment amount. Once the victim confirms the transaction, scammers steal the wallet authorization. The cybercriminals then transfer all the funds from the victim’s wallet.

Dark Skippy method can exploit Bitcoin hardware wallets

Table of Contents

Cryptopolitan_News

Other articles published on Aug 9, 2024

SPK Sets New Rules for Cryptocurrency Exchanges

Binance Leads Searches in July

While Bitcoin Forms Death Cross and Shiba Inu’s Comeback Stalls, CYBRO Soars Non-Stop

Thailand introduces sandbox for testing crypto services

Ethereum Rebounds: Will the ETH Price Rise & Reach Above $3000 This Week?

Petition against WazirX forces them to restore user portfolios post hack

Join our free newsletter for daily crypto updates!