296
Views
0 CommentsDogecoin, Zcash and Litecoin have already patched the “critical” vulnerability, but hundreds of others may not have, risking billions’ worth of crypto.
280 or more blockchain networks are estimated to be at risk of “zero-day” exploits that could put at least $25 billion worth of crypto at risk, according to cybersecurity firm Halborn.
In a Mar. 13 blog, Halborn warned of the vulnerability it dubbed “Rab13s” — adding it has already worked with some blockchains, such as Dogecoin, Litecoin and Zcash, to institute a fix for it.
🚨 Halborn discovered massive #ZeroDay impacting Dogecoin and 280+ networks including Litecoin and Zcash, putting over $25 Billion of digital assets at risk!
🧵👇…
— Halborn (@HalbornSecurity) March 13, 2023
Halborn was contracted by Dogecoin in March 2022 to conduct a security review of its codebase and found “several critical and exploitable vulnerabilities.”
It later determined those same vulnerabilities “affected over 280 other networks” that risked billions of dollars worth of cryptocurrencies.
Halborn outlined three vulnerabilities, the “most critical” of which allows an attacker to “send crafted malicious consensus messages to individual nodes, causing each to shut down.”
2/ During the assessment, it was found that the same vulns affected over 280 other networks including #litecoin and #zcash, which have since then been addressed and patched.
— Halborn (@HalbornSecurity) March 13, 2023
It added these messages over time could expose the blockchain to a 51% attack where an attacker controls the majority of the network’s mining hash rate or staked tokens to make a new version of the blockchain or take it offline.
Other zero-day vulnerabilities it found would allow potential attackers to crash blockchain nodes by sending Remote Procedure Call (RPC) requests — a protocol allowing a program to communicate and request services from another.
6/ 🤔 What are the consequences?
👉 Firstly, vulnerabilities were found in the p2p messaging mechanisms. Malicious consensus messages can be sent to each node, causing them to shut down and exposing the network to severe risks like 51% attacks.
— Halborn (@HalbornSecurity) March 13, 2023
It added the likelihood of RPC-related exploits was lower as it requires valid credentials to undertake the attack.
“Due to codebase differences between the networks not all the vulnerabilities are exploitable on all the networks, but at least one of them may be exploitable on each network,” Halborn warned.
The firm said at this time it’s not releasing further technical details of the exploits due to their severity and added it made a “good faith effort” to contact all affected parties to disclose the potential exploits and provide remediation for the vulnerabilities.
Dogecoin, Zcash and Litecoin have already implemented patches for the discovered vulnerabilities, but hundreds could still be exposed according to Halborn.
