BitBox | Crypto

Trezor confirms an email-provider breach and says its wallets remain safe, while BitBox investigates a likely newsletter-provider compromise. The post Attackers exploit fake STM32 vulnerability alert to target Trezor and BitBox holders appeared first on CryptoSlate.

BitBox said multiple Bitcoin companies appeared to have been targeted through a shared newsletter provider, while Trezor confirmed a breach at its email service. Hardware wallet makers Trezor and BitBox warned users about phishing emails disguised as urgent security notices after suspected compromises involving third-party email services.  On Wednesday, Trezor said its email provider had been breached and warned that a message titled “Critical Security Alert: STM32 Entropy Vulnerability” was fraudulent. The company urged recipients not to click any links. On the same day, Bitbox warned users about a phishing email pretending to come from the company. The company said its preliminary review indicated that its newsletter provider was likely compromised, adding that multiple Bitcoin companies appeared to have been targeted through a shared provider.  Read more

BitBox recommended all users update to firmware version 9.26.5 and said it had received no reports of exploitation or fund losses. Hardware wallet maker BitBox has released a firmware update that fixes two vulnerabilities it described as “severe” that could have enabled the installation of malicious firmware or put user funds at risk.  In a security disclosure on Monday, BitBox said one involved memory corruption affecting Multi editions of BitBox02 and BitBox02 Nova that had not been configured with a wallet. A malicious host could exploit it to execute arbitrary code and potentially install malicious firmware, which could lead to lost funds.  The second affected BitBox’s Silent Payments implementation and could have allowed a malicious host to lock Bitcoin to an unintended address. Direct theft was not possible, but an attacker could potentially demand a ransom to cooperate in recovering the coins, according to BitBox. The company said it had received no reports of either vulnerability being exploited or ca...