15-Year-Old Security Researcher Shares Ledger Wallet Exploit (news.bitcoin.com)

Hardware wallet manufacturer Ledger has published a firmware update to remedy several security flaws. The exploits were independently found by a trio of white hat security researchers, one of whom, Saleem Rashid, is a 15-year-old British boy. The attack vector he discovered is hardware based, and is not limited to Ledger devices, making it difficult to mitigate altogether via software alone.
Also read:

Bitcoin

Peter Todd: “Unlimited responds to the latest DoS exploit by releasing closed source, non-cryptographically-signed binary –> It gets better: they managed to publish the code by accident anyway via Launchpad” [launchpadlibrarian.net/311815049/bitcoinunlimited_1.0.1.1-yakkety_1.0.1.2-yakkety.diff.gz]

Peter Todd: "Unlimited responds to the latest DoS exploit by releasing closed source, non-cryptographically-signed binary --> It gets better: they managed to publish the code by accident anyway via Launchpad" [launchpadlibrarian.net/311815049/bitcoinunlimited_1.0.1.1-yakkety_1.0.1.2-yakkety.diff.gz] submitted by /u/eragmus
[link] [comments]

Bitcoin

Bitcoin Unlimited Remote Exploit Crash

This is essentially a remote crash vunerability in BTU. Most versions of Bitcoin Unlimited(and Classic on a quick check) have this bug. With a crafted XTHIN request, any node running XTHIN can be remotely crashed. If Bitcoin Unlimited was a predominant client, this is a vulnerability that would have left the entire network open to being crashed. Almost all Bitcoin Unlimited nodes live now have this bug.

To be explicitly clear, just by making a request on the peer-to-peer network, this could be used to crash any XTHIN node with this bug. Any business could have been shutdown mid-transaction, an exchange in the middle of a high volume trading period, a miner in the course of operating could be attacked in this manner. The network could have in total been brought down. Major businesses could have been brought grinding to a halt.

How many bugs, screw ups, and irrational arguments do people have to see before they realize how unsafe BTU is? If you run a Bitcoin Unlimited node, shut it down now. If you don't you present a threat to the network.

EDIT: Here is the line in main.cpp requiring asserts be active for a live build. This was incorrectly claimed to only apply to debug builds. This is being added simply to clarify that is not the case. (Please do not flame the person who claimed this, he admitted he was in the wrong. He stated something he believed was correct and did not continue insisting it was so when presented with evidence. Be civil with those who interact with you in a civil way.)

submitted by /u/shinobimonkey
[link] [comments]
Bitcoin