慢雾CISO提醒iOS worse_query沙盒逃逸或危及钱包本地明文数据
PANews报道，慢雾CISO 23pds提醒，iOS worse_query漏洞可在安装并运行未知来源IPA的条件下突破应用隔离，可能读取明文存储的钱包数据。
Loading…
bibibi.ccbibibi.ccLoading…
Connect scattered updates into a story you can understand.
PANews报道，慢雾CISO 23pds提醒，iOS worse_query漏洞可在安装并运行未知来源IPA的条件下突破应用隔离，可能读取明文存储的钱包数据。
慢雾确认，X账号 @cryptotrice 推广的所谓破解版 TradingView Premium Windows样本含窃密木马，可窃取浏览器凭据、加密钱包和 Telegram 数据。macOS链接暂返回404，样本尚未取得。
PANews称，X账号@cryptotrice多次推广所谓TradingView Premium破解版，相关安装包被用户指疑似窃取账户及加密钱包信息，部分用户称已被杀毒软件识别。
GoPlus Security称，10月28日至11月3日期间收到6起iOS自托管钱包用户资产损失报告，金额约12.7万美元，并建议更新iOS及检查恶意应用。
OneKey founder Yishi warned that iPhone 11 and earlier models have BootROM vulnerabilities that cannot be fixed through system updates, and physical access to the device could expose mnemonic phrases.
Stellar said that it has become MetaMask the default network for the mobile app and browser extension, and existing accounts will automatically generate a Stellar address.
Kraken Wallet The browser extension is now live, and users can download and install it through the Chrome Web Store.
NGRAVE said it is responding to a high-level cyber threat and urged users to be alert to impersonation messages, emails, websites, and support accounts. It emphasized that it will not ask for a recovery phrase or Perfect Key。
SlowMist Cos reminds iPhone and iPad users to promptly update their systems and beware of poisoned apps; it says DarkSword can exploit iOS vulnerabilities to steal wallet private keys and other data.
[New M&A] ether.fi Acquires Zeal Wallet Zeal is a non-custodial smart contract wallet designed to bridge on-chain asset management with everyday payments. Built on Safe infrastructure, it allows account recovery via biometrics or Passkeys, eliminating the need for seed phrases. Zeal enables paying network gas fees with stablecoins and offers a virtual Visa debit card to convert crypto into fiat for daily spending. Built-in VPN and transaction preview features aim to enhance privacy and security. Source: https://x.com/ether_fi/status/2113647301046788374
SlowMist stated that the GitHub repository sol-live is disguised as a Solidity interview practice project and contains malicious code capable of stealing browser, wallet extension, and local file data; it also discovered 8 similar projects.
PANews reported that CZ stated that no crypto wallet, software, or technology can achieve absolute security, advising users to follow the latest information and manage risks properly.