Education

Cryptojacking: Deadly Malware or Minor Annoyance?

What-is-cryptojacking|steal-my-food-from-the-fridg

News

Former Twitter CEO Jack Dorsey has revealed plans for a new hardware crypto wallet.



On Wednesday, Dorsey’s Block, formerly known as Square, released photos of a prototype for the new <a href="https://{MIGRATED_DOMAIN}/analysis/best-hardware-wallets/">wallet</a> which look like hexagonal river rocks that you could hide in your garden.



<figure class="wp-block-image aligncenter"><img src="https://pbs.twimg.com/media/FPqv_e0VIAAF2nH?format=jpg&amp;name=4096x4096" alt="Image"/><figcaption class="wp-element-caption"><a href="https://twitter.com/JesseDorogusker/status/1511714178326695939" target="_blank" rel="nofollow noopener">Jesse Dorogusker</a></figcaption></figure>



Block’s hardware lead, Jesse Dorogusker, tweeted a photo of the collection today. The wallets appear to have fingerprint identification features and USB ports.



Though neither Dorogusker nor Dorsey specifically said anything about the images, we can assume they are the hardware wallet that Block announced it was working in June of last year.



As per <a href="https://www.theverge.com/2022/4/6/23013420/jack-dorsey-block-hardware-crypto-wallet-bitcoin-rock-preview" target="_blank" rel="nofollow noopener">The Verge</a>:



<blockquote class="wp-block-quote">
“In a statement emailed to The Verge, Lindsey Grossman, head of product, marketing, and partnerships for Block’s wallet said that the images were ‘some prototypes we are experimenting with for the hardware component of the wallet, which also will include a mobile app and a set of self-serve recovery tools.’ She also mentioned that the company would share ‘future explorations, which doesn’t help us narrow down how close these prototypes are to becoming a real product.”
</blockquote>



In a <a href="https://wallet.build/march-update/" target="_blank" rel="nofollow noopener">blog post</a> last month, Block also said that the new wallet will come with its own mobile applications to help users manage their <a href="https://{MIGRATED_DOMAIN}/analysis/bitcoin-vs-gold-inflation-hedge/">Bitcoin</a>.



“We’re building a combination of hardware and a mobile application that will let you choose how you want to balance the convenience of using the app for transfers and the security of requiring the hardware for authorizing higher stakes money movement,” the company said.



<blockquote class="wp-block-quote">
“This means that the hardware is only one part of the experience - in fact, only a small part. Customers will primarily manage their money by interacting with the mobile application we’re building, and will only need to interact with the hardware in combination with the mobile app to authorize larger, less frequent transactions above an amount of their choosing.”
</blockquote>



<figure class="wp-block-image"><a href="https://guy.coinbureau.com/signup/" target="_blank" rel="nofollow noopener"><img src="https://img.coinbureau.dev/strapi/2021/09/Newsletter_inline.jpg" alt="Newsletter Inline" class="wp-image-25564"/></a></figure>

techmoguljackdorseyunveilsnewhardwarewalletprototy

Tech Mogul Jack Dorsey Unveils New Hardware Wallet Prototype

Another day, another hack. This time, the unfortunate victims are those who have been using the <a href="https://{MIGRATED_DOMAIN}/search/?page=1&amp;search=stellar+lumens">Stellar Lumens</a> (XLM) web-based wallet application, Blackwallet.co.This was a DNS server hack which means that the attackers were able to commandeer the blackwallet DNS servers. This meant that they were able to successfully drive the users to a malicious server which hoovered up their details.The hack occurred on Saturday afternoon January the 13th. According to a <a href="https://twitter.com/GossiTheDog/status/952359336893874176">security researcher</a>, the hackers were able to inject code that took all the funds from Stellar addresses that had over 20 XLM in them.<h2>Familiar MO</h2>The DNS server hack is not a new attack vector. In fact, this happened just last month in the large <a href="https://{MIGRATED_DOMAIN}/news/funds-stolen-etherdelta-suffers-dns-hack/">EtherDelta DNS hack</a>. In that case the hackers was able to infiltrate the domain servers and steal a considerable amount of ETH.You can see exactly how much Stellar the hacker was able to steal by observing his <a href="https://stellarchain.io/address/GBH4TZYZ4IRCPO44CBOLFUHULU2WGALXTAVESQA6432MBJMABBB4GIYI">address</a> on the Stellar Blockchain. According to the research by <a href="https://www.bleepingcomputer.com/news/security/hackers-hijack-dns-server-of-blackwallet-to-steal-400-000/">Bleeping Computer</a> he was able to make away with about 670,000 XLM. Given the current exchange rate, that makes the loot worth $418,013.The moment that the hack occurred, the BlackWallet team and other users tried to spread the word as quickly as possible. They reached out on <a href="https://github.com/orbit84/blackwallet/issues/4">Github</a>, <a href="https://www.reddit.com/r/Stellar/comments/7q72pw/warning_blackwalletco_hacked_check_your_public_key/">Reddit</a> and Twitter among others. Unfortunately, users continued to access blackwallet and hence were redirected to the rouge server.<h2>The "Wash" Commenced</h2>Once the hackers were able to get a hold of the funds, they wasted no time in trying to cover their tracks. They started moving the coins to an account on the <a href="https://{MIGRATED_DOMAIN}/review/bittrex/">Bittrex cryptocurrency exchange</a>.They would most likely have bought another Altcoin such as <a href="https://{MIGRATED_DOMAIN}/education/what-is-monero/">Monero (XMR)</a> or <a href="https://{MIGRATED_DOMAIN}/education/what-is-zcash/">Zcash (ZEC)</a> in order to "clean" the funds and move them away from the exchange without being traced.The developer behind BlackWallet tried to desperately get the attention of staff at the Bittrex exchange. The hope was that they would be able to block funds coming from the wallet before they were sent out. Below is the tweet.<div class="raw-html-embed"><twitter tweetid="‘952368665206427653’/"></twitter></div>It is unlikely that they were able to effectively stop the funds coming through given the speed with which the hacker was able to move. Today the developer behind blackwallet <a href="https://www.reddit.com/r/Stellar/comments/7q9g31/statement_blackwallet_hacks_update/">said</a> that he was in discussions with his hosting provider to see if they could get any digital fingerprints on the hacker.He also stressed that blackwallet was an account viewer site and that they did not store private key information on their server. Hence, you would only have been susceptible if you entered your key on blackwallet during the time the hack was taking place.<h2>Cursory Lessons</h2>This is no doubt another unfortunate tale in the risks that cryptocurrency wallets and exchanges face when they have a central point of failure. In this case, it is the centralised DNS server.There are many that are looking to decentralised name server solutions such as the <a href="https://{MIGRATED_DOMAIN}/news/adoption-increasing-ethereum-name-service/">Ethereum Name Service</a> as the decentralised answer to the existing network architecture.While it can be quite hard to know whether a site's DNS server has been hacked, it no doubt a wise decision to make use of a <a href="https://{MIGRATED_DOMAIN}/services/consider-purchasing-hardware-wallet-best-wallets-buy/">hardware wallet</a> that stores your private keys offline.