In March 2022, Halborn was contracted to evaluate the Dogecoin open source codebase for any vulnerabilities that could affect the security of the blockchain.During this assessment, several critical and exploitable vulnerabilities were identified by Halborn and have since been fixed by the Dogecoin team. However, after a broader review Halborn determined that the same vulnerabilities affected over 280 other networks including Litecoin and Zcash, putting over $25 billion dollars of digital assets at risk.Halborn has code-named this vulnerability Rab13s.&nbsp;<h2>The Rab13s Vulnerabilities Explained</h2>The Halborn researchers, led by Senior Offensive Security Engineer Hossam Mohamed, found multiple vulnerabilities inside the open-source code for blockchain networks like Dogecoin, Litecoin and many others with similar codebase. The most critical vulnerability discovered is related to the peer-to-peer (p2p) communications, attackers can craft consensus messages and send it to individual nodes and taking them offline.An attacker can crawl the network peers using getaddr message and attack the unpatched nodes.While some of the other issues were known CVEs (Common Vulnerabilities and Exposures) from Bitcoin, another zero-day identified by Halborn was uniquely related to Dogecoin, including an RPC (Remote Procedure Call) Remote code execution vulnerability impacting individual miners.Subsequently, variants of these zero-days were also discovered in similar blockchain networks, including Litecoin and Zcash. Due to codebase differences between the networks not all the vulnerabilities are exploitable on all the networks, but at least one of them may be exploitable on each network. On vulnerable networks, a successful exploitation of the relevant vulnerability could lead to denial of service or remote code execution.A good faith effort has been made to contact the affected networks for a responsible disclosure. However, all affected networks are encouraged to contact Halborn on <a target="_blank" rel="" href="mailto:disclosures@halborn.com">disclosures@halborn.com</a>.<h2>Risks and Consequences</h2>The Rab13s vulnerabilities were found inside the p2p messaging mechanisms in affected networks, which, due to their simplicity, increase the likelihood of attack. With this vulnerability, an attacker can send crafted malicious consensus messages to individual nodes, causing each to shut down and eventually expose the network to risks like <a target="" rel="" href="https://www.halborn.com/blog/post/what-is-a-51-percent-attack">51% attacks</a> and other severe issues.The second vulnerability in the RPC services allowed an attacker to crash the node via RPC requests. However, successful exploitation requires valid credentials, which reduces the likelihood of the entire network being at risk and since some nodes implements the stop command.The third vulnerability allows attackers to execute code in the context of the user running the node through the public interface (RPC). However, the likelihood of this exploit is lower as it requires a valid credential to carry out the attack.<h2>Remediations and Next Steps</h2>Halborn successfully developed an exploit kit for Rab13s that includes a proof of concept with configurable parameters in order to demonstrate the attacks on different networks.All the necessary technical information has been shared with the identified stakeholders to help them remediate the bugs, and to release the necessary patches for the community and miners. Halborn did not share the Exploit-kit code with any party.For projects using a UTXO-based node (eg. Dogecoin), we recommend upgrading all nodes to the latest version (1.14.6).Halborn is not releasing further technical or exploit detail at this time due to the severity of the issues.Keep an eye on our blog and follow us on Twitter (<a target="" rel="" href="https://www.twitter.com/halbornsecurity">@HalbornSecurity</a>) for the latest updates.

Web3 security firm Halborn discovers a massive zero-day impacting Dogecoin and over 280 other networks. 

Halborn Discovers Zero-Day Impacting Dogecoin and 280+ Networks

In October 2022, Halborn appointed its first Chief People Officer: Laura Cooper. Laura will be spearheading all things related to People including Workforce Planning and Strategy, Talent Acquisition, Performance, Development, Culture and Engagement.&nbsp;Based in New Jersey, Laura started her career as an Attorney before transitioning to HR on Wall Street for Salomon Brothers, Samsung and NICE Systems. In 2017 she transitioned from large global corporate to the dynamic VC startup space and continued her trajectory into the world of crypto and Web3.We sat down with Laura for a quick interview on her new role as CPO at Halborn.&nbsp;<ul><li>What does being a Chief People Officer mean to you?&nbsp;</li></ul>So many amazing things, and in terms of the company, it means I have the privilege of working with the executive team to ensure the business moves forward and thrives while creating the best experience for the dedicated employee population who work here. It means that I have the privilege of standing as a champion of our culture, mission and vision.<ul><li>Why did you choose to come work for Halborn?</li></ul>I knew Halborn from my previous CPO role. Halborn helped us protect ourselves and our clients with spectacular work that showed us risks and threats we otherwise wouldn’t know we had. I was so impressed with the company as well as the co-founders Rob Behnke and Steve Walbroehl. The elite nature of the engineers who work here, the invaluable products and services Halborn offers to the market were all significant drivers in the decision.&nbsp;<ul><li>You’ve gone from martech to fintech to Web3. What interests you the most about the world of Web3?&nbsp;</li></ul>Web3 is changing the way we interact in many fundamental ways, but especially in business. I love the freedom that Web3 brings. The Web3 networks are permissionless where users and providers don&#8217;t need centralized controlling organizations. It’s so different from how we used to operate, always with central parties and middle organizations. I love being part of this disruptive and innovative world.<ul><li>What are some of the challenges you think you’ll face when recruiting offensive security engineers?&nbsp;</li></ul>It’s an extremely competitive market and the need for strong offensive security engineers is never going to go away. The risks are always advancing and changing so we have to be just as agile in finding the talent to meet those challenges. My goal is to help Halborn maintain the elite cyber security it provides as well as become the absolute best place to work for offensive security engineers.<ul><li>What’s one of the best kept secrets of HR professionals?&nbsp;</li></ul>So much of what we do is deeply confidential, but HR professionals are always driving the business forward. Most people see only 25% of what we do for an organization because the other 75% is beneath the surface.&nbsp; We do so much more than the organization overtly sees. So, I’m afraid I have to answer that what happens with People has to stay with People!<ul><li>What are some of the talents or skills you look out for when hiring in tech?&nbsp;</li></ul>What I look for is the ideal combination between what people do (their experience) and how people do it (their behavior). Great teammates for Halborn are not only very strong in their experience, they also are wonderful to work with. Friendly, accountable, curious and autonomous are some of the great traits of our team.&nbsp;<ul><li>Have your personal passions ever influenced your approach to work?&nbsp;</li></ul>Yes, I studied philosophy in college and am a huge follower of the principles of Marcus Aurelius, Seneca, and others who wrote extensively on how to live and work in harmony with the people around you and, at the same time, push yourself to your fullest potential. The four Stoicism tenets of Wisdom, Temperance, Courage and Justice are things I practice every day both personally and at work.To connect with Laura Cooper, find her <a href="https://www.linkedin.com/in/lauracoopersphr">on LinkedIn</a>. If you’re interested in working for Halborn, check out our <a href="https://halborn.com/careers/">Careers</a> page.

Laura Cooper sits down to discuss her new role as Chief People Officer at blockchain security firm Halborn.

Introducing Laura Cooper, Halborn’s New Chief People Officer

Halborn is excited to announce the launch of its blockchain and smart contract security VM (Virtual Machine): <a href="https://www.ziion.org/">ZIION</a>.ZIION is a blockchain security VM that is open-source (free to use!), end-to-end, pre-compiled, multi-architecture, and multi-protocol.&nbsp;<div class="wp-block-image"><figure class="aligncenter is-resized"><img decoding="async" loading="lazy" src="https://lh3.googleusercontent.com/YVAj1z64cmZm6JG1wridATdSQEC_JzgVoKbzjnypTQRI9rX2eZs1Y0-mrCC0gpI0-JMNbceNeocyj2gDSG90HhslaVd--Ey0_9Jo6IraMUi-CeE9l_i7vG4aPVf7wTMULis8PrRbaIGj9t5gmgs_AW0" alt="" height="466"/></figure></div>“Kali Linux is a great tool for pen testers and auditors,” says Halborn co-founder Steve Walbroehl, “but it’s not really equipped for the security needs of blockchain development. That’s why our best-in-class blockchain security engineers at<a href="https://twitter.com/halbornsecurity"> </a>Halborn built ZIION, a true turnkey VM with all the tools needed to securely build and develop in Web3.”&nbsp;With a goal to simplify blockchain development and security testing, security engineers can build on top of Bitcoin, Ethereum, Solana, Polygon, and more. ZIION features 100+ tools, utilities, dependences, and packages.&nbsp;ZIION features:<ul><li>Protocol tools</li><li>EVM tools &amp; fuzzers</li><li>Rust tools &amp; fuzzers</li><li>VCCodium extensions</li></ul>Made by blockchain security engineers for blockchain security engineers, ZIION is a security VM that caters exclusively to Web3 developers.&nbsp;Find out more about ZIION at <a href="https://www.ziion.org/">ZIION.org</a> or <a href="https://www.ziion.org/download">download ZIION</a> today.

Cybersecurity firm Halborn announces the launch of its blockchain and smart contract security VM (Virtual Machine): ZIION.

Halborn Launches ZIION, an Open Source Web3 Security Testing and Development VM

On July 19, 2022, Halborn announced via an exclusive <a href="https://www.bloomberg.com/news/articles/2022-07-19/blockchain-security-startup-raises-90-million-despite-crypto-winter">in Bloomberg</a> the completion of a $90 million Series A funding round, the first external funding in our firm’s history.&nbsp;Global growth investor Summit Partners led the Series A round, with participation from Castle Island, Digital Currency Group, Brevan Howard, Third Prime, Sky Vision Capital, and Fenwick.&nbsp;In addition to the Bloomberg exclusive, the funding announcement was featured in Fortune, TechCrunch, WSJ PRO Venture Capital, SiliconANGLE and Miami Inno.&nbsp;Profitable since inception, co-founders Steven Walbroehl and Rob Behnke bootstrapped Halborn into a world-class Web3 security firm. Today, Halborn is growing rapidly, serving over 250 clients focusing on Layer 1 blockchains, infrastructure providers, financial institutions, and application and game developers. Some of Halborn&#8217;s most notable clients include Solana Foundation, Avalanche, and Figment.In a <a href="https://www.globenewswire.com/en/news-release/2022/07/20/2482710/0/en/Blockchain-Security-Firm-Halborn-Raises-90M-Series-A-Led-by-Summit-Partners.html">press release</a> about the funding announcement, co-founder Walbroehl stated: &#8220;With security vulnerabilities dominating the crypto news headlines, and over $1.5 billion in financial losses from DeFi hacks in 2022 to date, the demand for Web3 security is only growing. Funding from this Series A will be used to <a href="https://halborn.com/careers/">expand our global team of offensive security engineers</a> and build our Halborn Labs division, accelerating our robust pipeline of SaaS security products.&#8221;&nbsp;Today, over 100 of the best and brightest security engineers from around the world are part of Halborn’s elite security advisory.&nbsp;<h2>Quotes from some of our investors:&nbsp;</h2><h3>Summit Partners</h3><blockquote class="wp-block-quote">Summit has a long history of partnering with innovative cybersecurity leaders focused on protecting against both monetary and data breaches in a constantly evolving and ever-expanding threat landscape. We believe the stakes and costs are even higher in Web3, given the decentralized development of and the dollars controlled by Web3 applications.In a very short time, Halborn has established itself as a globally recognized brand in blockchain security working across Web3 and Web2 environments. The Halborn team has earned a reputation for tackling complex projects and has an impressive record of identifying high-profile vulnerabilities and breaches. <cite>Matt Hamilton, Managing Director @ Summit Partners</cite></blockquote><h3>SkyVision Capital</h3><blockquote class="wp-block-quote">As the cryptocurrency industry continues to evolve with innovative protocols being built in the Gamefi and DeFi sectors, there needs to be an emphasis of Cybersecurity to protect all stakeholders and most importantly community members. SkyVision Capital (SVC) is excited to support Halborn, an experienced cybersecurity company that focuses on smart contract auditing to mitigate potential exploits and hacks. We look forward to seeing the growth of Halborn as the blockchain sector continues to grow in the bear and bull market.<cite>Patrick Wu, Partner @ SkyVision Capital</cite></blockquote><h3>Castle Island Ventures</h3><blockquote class="wp-block-quote">Cybersecurity is a critical infrastructure category that will unlock greater participation in the public blockchain industry. We are thrilled to invest behind the team at Halborn as they make this market more accessible.Halborn has established a leadership position working with the leading centralized and decentralized groups in the blockchain industry. We are thrilled to be partnering for their next phase of growth.Cybersecurity risk has historically been a great reason to avoid launching products in the blockchain industry. Halborn is changing this risk/reward equation and in doing so expanding the addressable market for public blockchain technology. We are thrilled to partner with Halborn as they expand their product offering.<cite>Matthew Walsh, Founding Partner @ Castle Island</cite></blockquote><h3>Third Prime</h3><blockquote class="wp-block-quote">Third Prime is focused on investing in market leaders in the most important areas of crypto. With Halborn, we&#8217;ve clearly hit the mark. The team, track record and technology are unparalleled and we&#8217;re excited to partner with them as they secure the most important companies in this space.<cite>Wes Barton, Managing Partner @ Third Prime </cite></blockquote>

On July 19, 2022, Halborn announced the completion of a $90 million Series A funding round led by Summit Partners.

Web3 Security Firm Halborn Raises $90M Series A Led by Summit Partners

On August 16 at approximately 9:30 AM EST, a vulnerability in Stader’s NearX smart contract was exploited. The Stader team along with Halborn quickly contained the exploit, protecting most funds.&nbsp;The loss was estimated at ~165k NEAR and was limited to the Dex’s. The ~2.5Mn $NEAR staked on the Stader dapp remained safe with validators. Stader has demonstrated strong leadership and commitment to its users by announcing to fully reimburse users for their losses on the LPs. Please find more details here: <a href="https://twitter.com/stader__near/status/1559992693471604736">https://twitter.com/stader__near/status/1559992693471604736</a>The technical nuances that led to the exploit are as follows:When reading from storage, NEAR creates a snapshot that is loaded to runtime memory.&nbsp;When NEAR attempts to load the same variable into runtime memory it creates a copy.&nbsp;Stader’s smart contract was written with the assumption that the runtime variable would always point to the same object in memory (not a copy).&nbsp;Because of this, when a token transfer was executed with sender and receiver being the same user, it resulted in two variables corresponding to the balances. Both were associated with the sender, however, one’s balance was reduced and the other’s was increased. Then both variables were saved to the storage; however, the increased balance was saved last, overwriting the previously saved decreased balance. The attacker was then able to generate tokens out of thin air.&nbsp;Here is the <a href="https://blog.staderlabs.com/stader-near-incident-report-08-16-2022-afe077ffd549">full incident report from Stader Labs</a>.&nbsp;This was one of the rare occurrences where we worked with a memory storage assumption, and discovered otherwise during the post-mortem and the fix. As soon as the attack was discovered, Halborn and Stader worked together to identify the root cause, halt the contract, and deploy a fix. We have audited this fix and are confident that this exploit cannot happen again.As a cybersecurity firm dedicated to cutting-edge technology in the wild world of web3, we stand behind our record of quality research and capabilities.&nbsp; That said, security is an art and we take full responsibility for not finding this truly impressive exploit.&nbsp; One of Halborn’s core values is Kaizen, a Japanese concept around continual learning and improvement.&nbsp; NEAR is a new, exciting ecosystem and we strive to continue our research and only improve our auditing capabilities within it. For more info on Stader Labs, visit:TG:<a href="https://t.me/staderlabs_near_official"> https://t.me/staderlabs_near_official</a>Twitter:<a href="https://twitter.com/stader__near"> https://twitter.com/stader__near</a>Main Discord:<a href="https://discord.gg/asBqz79Hv9"> https://discord.gg/asBqz79Hv9</a>

On August 16, a vulnerability in Stader’s NearX smart contract was exploited. Cybersecurity firm Halborn provides an update on what happened.

Stader Labs NearX Update

As the crypto industry grows more visible and valuable, it has come to the attention of advanced threat actors.&nbsp; Recently, Halborn has identified an attack campaign against crypto groups that is believed to be performed by an APT (Advanced Persistent Threat) affiliated with China.<h2>Analyzing the Malware</h2>A recent report stated that the author “recently discovered a Remote Access Trojan (RAT) virus posted in a crypto investment public Telegram chat.&nbsp; The company says the purpose of this Trojan was to steal Bitcoin keys.”&nbsp; Based on an investigation of the malicious files attributed to this attack, Halborn has identified the malware as a Gh0stRAT variant likely associated with an unknown Chinese APT.Gh0stRAT is a well-known RAT that provides the attacker with various capabilities, including the ability to remotely control and monitor the target computer.&nbsp; Among other features, this Gh0stRAT variant can capture keystrokes and screenshots, use the microphone and camera, and download files from the infected computer.After being dropped and executed on the computer, this malware copies itself to the SysWoW64 directory with the name Skc2sk.exe.&nbsp; It then adds itself as a startup service to maintain persistence across reboots and deletes the original file using the command prompt.&nbsp; As part of this process, the malware also connects to a command and control (C2) server on a hosting provider commonly used by the suspected Chinese APT behind the attack.Once running on the infected machine, the malware takes various actions, including:<ul><li>Attempting to run with Administrator permissions</li><li>Checking if the computer supports RDP, which would provide the attacker with remote access</li><li>Likely uses mimikatz to dump passwords from Windows as indicated by the string “GetMP privilege:debug sekurlsa::logonpasswords exit” in the malicious process; memory</li><li>Likely scans for active antivirus programs on the system from a list of associated AV names</li></ul>These and other capabilities indicate that the malware is a RAT.&nbsp;&nbsp;Due to the presence of certain strings within the malware and details of the malware’s actions on an infected system, this malware is identified as a Gh0stRAT variant similar to Zerogost.&nbsp; These malware variants and the command and control infrastructure used by this malware are commonly attributed to attacks by an unknown APT affiliated with China.<h2>Protecting Against Malware Attacks</h2>This malware is used to collect various types of sensitive information; however, there is no evidence that it is specifically targeting the private keys of blockchain accounts.&nbsp; However, the malware’s ability to collect keystrokes and login credentials could lead to the compromise of these accounts.This attack campaign used a <a href="https://halborn.com/what-is-phishing-attack-techniques-and-examples/">phishing attack</a> within Telegram channels associated with crypto investing.&nbsp; When on Telegram and other communications platforms, be cautious about downloading and opening any files.&nbsp; If you need to download a file, make sure that it is scanned by a reputable antivirus before opening it.

Halborn uncovers attack campaign against crypto groups believed to be performed by an APT (Advanced Persistent Threat) affiliated with China.

Halborn Identifies APT Campaign Targeting Crypto Groups

Ferran Celades, a security researcher at Halborn, discovered and reported a vulnerability in how the Secure Cadence update to Cadence manages resources, during the Halborn-Dapper Labs audit engagement.&nbsp; In some cases,&nbsp; Cadence, the smart contract programming language of Flow blockchain, inappropriately allowed the access and use of destroyed resources.<h2>Background</h2>Cadence has the concept of resources, which are single-use types that can only exist in a single location at a time.&nbsp; After the resource is declared and created, it must be either moved or destroyed after use.If resources aren’t properly moved or destroyed, they are considered “lost”.&nbsp; If a lost resource exists within a program, then it will not be allowed to execute.&nbsp; Also, attempts to use a destroyed reference will also block the program’s execution.References in Cadence can point to resources and allow access to fields and call functions on that object.&nbsp; If a reference points to a destroyed resource, it will be unwrapped to that resource and the program will not allow execution.<h2>Bypassing Resource Protections with Optionally-Typed References</h2>With the Secure Cadence milestone in June 2022, it is possible to create references to optional variables.&nbsp;These optional variables are checked to see if they hold a value — i.e. are not nil — and then unwrapped to the underlying value.If a value is present, a reference to the value is created; if not, nil is returned.&nbsp;&nbsp;However, when a resource was destroyed, the interpreter did not invalidate references to it, making it possible to access fields and call functions on a destroyed resource.The proof of concept that we submitted to the Cadence team, shown below, demonstrates this issue: It retrieves an item from a dictionary, creates an optional reference, and, in this case, the reference r1 is a key to the dictionary.&nbsp; The variable ref still holds a valid reference to the resource even after the resource and dictionary have been destroyed, allowing access to the resource that should no longer exist.<img decoding="async" loading="lazy" src="https://lh5.googleusercontent.com/hZObUDxtJmKpiPTXPKFoDwdeVQr_ZvElXjRT1oMpmACSh7nw9yS0A1RyQ5GTvnq6TiNxX4ls6RGSm9YSgxfgCwr0u7rMRkVvC67pSBtZVS-SHvgrLIWui3nMKSCppggy1drJYwL3YPV8gsRdY9g" height="941"><h1>Patching the Vulnerability</h1>The Cadence interpreter has been updated so that when a reference to an optional is created, the type of the inner value is checked. If it is a resource, it is tracked throughout its lifetime. Once the referenced resource is destroyed, also all references to it are invalidated,&nbsp;so they cannot be accessed anymore.

A security researcher at Halborn has discovered and reported a vulnerability in how the Secure Cadence update to Cadence manages resources.

Halborn Discovers High-Impact Vulnerability in Cadence (Flow)

We’re excited to announce the appointment of <a href="https://www.linkedin.com/in/davidschwed">David L. Schwed</a> as Chief Operating Officer at Halborn.Schwed most recently served as the Global Head of Digital Assets Technology for BNY Mellon, the world&#8217;s largest custodian bank, where he was responsible for integrating the IT strategy for BNY Mellon’s digital asset offerings across the enterprise.&nbsp;Schwed has more than 21 years of information technology, information security, and risk management experience. He has worked in the financial services sector at a senior level for BNY Mellon, Merrill Lynch, Salomon Smith Barney, Citigroup, and Galaxy Digital. He also holds various industry leading certifications in cryptocurrency, cybersecurity, and IT audit. He was also the founding director and professor of the cybersecurity Master&#8217;s program for the Katz School of Science and Health at Yeshiva University where he is currently their practitioner-in-residence.&nbsp;&nbsp;Schwed is a member of the New York Bar and graduated Magna Cum Laude from Hofstra University School of Law where he was an associate editor of the Hofstra Law Review.On why he chose to join Halborn as the blockchain security firm’s new COO:<blockquote class="wp-block-quote">&#8220;Security is integral to the success of the Blockchain ecosystem and there is no better organization than Halborn when it comes to Web 3 security.I’ve known the Halborn team for many years and, as a former client of Halborn, I know first hand how amazing our engineers are. It was a no-brainer when the opportunity presented itself to join as their COO.&#8221;<cite>David L. Schwed</cite></blockquote>

Blockchain security firm Halborn announces the appointment of David L. Schwed as its new Chief Operating Officer.

Halborn Appoints New COO David L. Schwed

We’re excited to announce the appointment of <a href="https://www.linkedin.com/in/david-chaskin-931223/">David Chaskin</a> as Chief Financial Officer at Halborn.Chaskin is a highly accomplished accounting and financial management executive with more than 25 years of experience in finance and operations management within startups and global, multi-billion dollar organizations.&nbsp;On what attracted him to Halborn, Chaskin says:<blockquote class="wp-block-quote">I have always been a big believer in blockchain technology and feel we are only at the beginning of what it can become. While I was in the interview process, co-founder Rob Behnke asked for a couple of recommendations. One was my old CEO at Element, who now is a Managing Partner at a VC firm that invests in digital asset ecosystem companies. When I told him about Halborn, the first thing he said was “Can you introduce me to them?” That, combined with the exceptional talent at Halborn, was all I needed to hear to know that Halborn was the place for me. </blockquote> Halborn continues to be one of the fastest growing companies in the Web3 security space, with over 250 clients and over 100 of the best and brightest security engineers in its fully remote workforce. If you’re a security expert looking to join our team, visit our <a href="https://halborn.com/careers/">Careers</a> page or our <a href="https://www.linkedin.com/company/halborn">LinkedIn</a> and get in touch!

Elite blockchain security firm Halborn announces the appointment of David Chaskin as Chief Financial Officer.

Halborn Appoints New CFO David Chaskin&nbsp;

The Security Research Team at Halborn has discovered a critical vulnerability affecting many major cryptocurrency wallets. Wallets that were affected include MetaMask, Brave, Phantom, and xDefi, who have remediated the issue.&nbsp;Under the right conditions, the vulnerability &#8211; which we code-named “Demonic” &#8211; can expose a crypto wallet user’s secret recovery phrase which can in turn be used to reconstruct their private key, allowing attackers to access billions of dollars worth of cryptocurrencies and NFTs held in browser extension wallets.You can view the full technical details and remediation recommendations on the <a href="https://halborn.com/disclosures/demonic-vulnerability">Demonic Vulnerability announcement page</a>. Refer to the <a href="https://medium.com/@danfinlay/d437d4250863">MetaMask Blog Post</a> and <a href="https://phantom.app/blog/demonic-vulnerability">Phantom Blog Post</a> for more useful information from their teams.Due to the severity of the vulnerability and the number of impacted users, technical details were kept confidential until a good faith effort could be made to contact affected wallet providers.&nbsp;&nbsp;Now that the wallet providers have had the opportunity to remediate the issue and migrate their users to secure recovery phrases, Halborn is providing in-depth details to raise awareness of the vulnerability and help prevent similar ones in the future.<h2>How does it work?</h2>Browser extension cryptocurrency wallets that use an input field for a <a href="https://en.bitcoin.it/wiki/Seed_phrase">BIP39 mnemonic</a> can cause the secret recovery phrase to be stored on-disk in plain text where an attacker that has physical or logical access to the device can retrieve it and gain access to the wallet.<h2>Who is affected? What should they do?</h2>Users: Users who have imported their browser based crypto wallet using a secret recovery phrase may be impacted.&nbsp;The risk is present if all of the following conditions were met:<ul><li>The hard drive was unencrypted</li><li>The Secret Recovery Phrase was imported into a browser extension wallet using a device that is no longer in the user’s possession or is logically compromised</li><li>The user used the “Show Secret Recovery Phrase” checkbox to view the seed phrase on-screen during import</li></ul><figure class="wp-block-image"><img decoding="async" src="https://lh5.googleusercontent.com/rkLgf6cWm-fAI8Z-AbIFWooSuKBriVeawJ2B5HCovo1kklDXndADA7E4QogOM4siHty-TiFalokZ-n6909FFpb18J-pKyhGEWwjuijN7eZ6BCXwNeb3MKPrZdmP1wTvgs1Z-mqUW72nJle7o8g" alt=""/></figure>It is recommended that users who believe they may be affected migrate to a new set of accounts. MetaMask has prepared <a href="https://metamask.zendesk.com/hc/en-us/articles/4867408571803">instructions on how to migrate</a> for their users.&nbsp;Rotating passwords/keys and the use of a hardware wallet in conjunction with the browser based wallet can also provide increased security for users. Enabling local disk encryption is another best practice which mitigates this issue.Desktop application cryptocurrency wallets and web based wallets may be prone to similar issues but due to the disparity of offerings we have not investigated that in depth.Wallet Providers: Wallet Providers who believe they may still be susceptible to the vulnerability are strongly encouraged to follow the mitigation suggestions outlined on the Demonic Vulnerability Disclosure page.Have concerns, want to learn more, or have a bug you’d like to disclose? Please reach out to us at <a href="mailto:disclosures@halborn.com">disclosures@halborn.com</a>.Halborn is hiring! If you’re someone who can help make our products and this industry more secure, consider <a href="https://www.linkedin.com/company/halborn/jobs/">joining our team</a>.

On June 15 2022 Halborn revealed the discovery of a critical vulnerability affecting crypto wallets MetaMask, Brave, Phantom, and xDefi.

Halborn Discovers Critical Vulnerability Affecting Crypto Wallet Browser Extensions

Halborn is thrilled to announce the appointment of Paul Merugu as the new Field CISO to spearhead our ambitious scaling and product development plans following our recent acquisition of <a href="https://www.globenewswire.com/news-release/2022/01/27/2374424/0/en/Blockchain-Cybersecurity-Firm-Halborn-Acquires-Web3-Automation-Startup.html">Web3 automation startup Abyss Consulting</a> and the launch of our new Research and Development division, Halborn Labs.Paul Merugu is a cybersecurity industry expert with over 15 years of experience working across multiple industries including banking, financial services, healthcare, insurance, hospitality, retail and technology. He has held senior positions at Ernst &amp; Young Consulting and CA Technologies where he worked as a trusted security adviser to various Fortune 500 companies and successfully delivered several large security programs. He has a background in computer science and specialized in security architecture. He’s an engineer at heart who loves to dig into complex cyber security problems and solve them with modern technology.&nbsp;&nbsp;“Halborn is one of the best blockchain and DeFi security companies in the world,” said Merugu. “I am incredibly excited to work with the impressive roster of security talent at Halborn to develop a full stack offering of security services and products for DeFi, Web3, NFTs and smart contract platforms.”&nbsp;Halborn Co-Founder and CISO Steven Walbroehl echoes Merugu’s excitement: “Paul’s appointment as the Field CISO takes the Halborn’s cybersecurity growth trajectory to a new horizon. His undoubtable tech, management and people skills will be a strong asset to scale and expand Halborn’s security services and products in the near future.”Halborn has been one of the fastest growing companies in the Web3 space, with over 150 blockchain companies as clients and a staggering 1,150% YoY growth rate. If you’re a security expert looking to join our team, visit our <a href="https://halborn.com/careers/">Careers</a> page and get in touch!

Blockchain cybersecurity firm Halborn announces the appointment of security expert Paul Merugu as new Field CISO.

Halborn Appoints New Field CISO Paul Merugu

In a <a href="https://www.globenewswire.com/news-release/2022/01/27/2374424/0/en/Blockchain-Cybersecurity-Firm-Halborn-Acquires-Web3-Automation-Startup.html">press release</a> distributed yesterday, Halborn announced their first acquisition: Web3 automation startup <a href="https://www.abyss.io/">Abyss Consulting</a>. The acquisition of Abyss, a former collaboration partner of ours, has accelerated the launch of our new Research &amp; Development division called Halborn Labs.&nbsp;By combining our end-to-end cybersecurity services with Abyss Consulting&#8217;s rapid prototyping, Halborn can now turn its portfolio of security product concepts into fully realized and market-ready tools that make the world of Web3 safer.With our first acquisition, our elite blockchain security team now benefits from the added expertise of Abyss Consulting&#8217;s custom automation services, including automated testing, custom workflows, and proprietary systems designed to reduce company overhead.&nbsp;Abyss Consulting Co-Founders Everett Carney and Sean O´Leary will be leading Halborn Lab’s product development and rapid prototyping units.For more information on the acquisition, read our <a href="https://www.globenewswire.com/news-release/2022/01/27/2374424/0/en/Blockchain-Cybersecurity-Firm-Halborn-Acquires-Web3-Automation-Startup.html">press release</a>.&nbsp;

Blockchain cybersecurity firm Halborn announces their first acquisition: Web3 automation startup Abyss Consulting.

// Blog

Company News

Articles