Topic: John McAfee's Unhackable Bitfi Wallet Is Hacked Again (Read 219 times)
Your money works around the clock. Our website
Good for him, hes nothing but a hype artist. He was collecting payment to pump altcoins last year during the acrive phase of the bull market. He was paid by someone which the community assumes is Adam Guerbuez to pump Burst which made it look bad.
Exactly, he is not a type of person that we should take seriously. Initially he was a self proclaimed media/influencer. And then later it was unmasked that he is charging for his "coin of the day" tweet. Exorbitant in the 5 digit figure. I don't know why people are attracted to him and willing to pay him that much money. And to make matters worst, he said that his twitter account was hacked, LMAO.
now he do even advertised that unhackable wallet and look at it now? What happen? It do have multiple instances about vulnerability which is really opposing on what he claims.
I dont know if people would still trust this man because ever since i didnt really tend to listed up on this dude's words.
Good for him, hes nothing but a hype artist. He was collecting payment to pump altcoins last year during the acrive phase of the bull market. He was paid by someone which the community assumes is Adam Guerbuez to pump Burst which made it look bad.
Exactly, he is not a type of person that we should take seriously. Initially he was a self proclaimed media/influencer. And then later it was unmasked that he is charging for his "coin of the day" tweet. Exorbitant in the 5 digit figure. I don't know why people are attracted to him and willing to pay him that much money. And to make matters worst, he said that his twitter account was hacked, LMAO.
Good for him, hes nothing but a hype artist. He was collecting payment to pump altcoins last year during the acrive phase of the bull market. He was paid by someone which the community assumes is Adam Guerbuez to pump Burst which made it look bad.
Its really wrong marketing ploy for John McAfee to promote his wallet as unhackable because in crypto, its a non-existent word. Hackers are always 1 step ahead of us, whether on the software stuff or hardware. So it totally backfired on them, and its better to pull out that stunt and accept the fact that they got hacked again.
They're argument though is that since no money is lost, this can't be considered as hacked.
What a joke, we don't need to wait for that day to happen, they need to get their acts together and make that wallet safe again.
They're argument though is that since no money is lost, this can't be considered as hacked.
What a joke, we don't need to wait for that day to happen, they need to get their acts together and make that wallet safe again.
He wanted this, and he got it.
I will be very glad if he fulfills his promise and will award the guys for work.
I will be very glad if he fulfills his promise and will award the guys for work.
~ snip ~
Saleem Rashid is same person ( just a 15 year old ) who discovered few security flaws not only in Ledger Nano S, but also in Trezor and now in Bitfi wallet. Thanks to him and some other researchers, Ledger and Trezor are make fix for security vulnerabilities and today both wallets are more safe then before - but there is no 100% guarantee that there is still no risk we still do not know.
That kid is something special, just reading how he cracked both wallet is amazing. He is really a genius because hacking them require far more advance knowledge in hardware and software as well. And when all 15 year old are having the time of their lives, Saleem is working behind figuring to bypass and finding the exploits.
https://saleemrashid.com/
For now there is no documented case that any user is lost coins because of successful hacking of hardware wallet, maybe Bitfi can ruin that tradition and be the first? Too bad that they refuse to pay bounty which has been promised, Saleem and others should just release the exploit code and take them down//bad product and people who do not keep their word.
Yes, at least no one has reported so far. I think they are wiling to pay, but Saleem refuse to accept just like when he broke Ledger and Trezor because he needed to sign a Non-Disclosure-Agreement (NDA). He doesn't want to and chooses to write a Technical Report about the vulnerability. And because Eric Larchevêque, Ledger’s CEO, made some comments which is full of garbage and inaccuracies. So he decided everything should be transparent specially us, the users and customers.
This is the funniest thing I will be reading in recent time. Not that I am happy that its happening to him but when the news filtered the community about how boastful he was on the "unhackable" nature of his wallet, I had maintained that nothing is unhackable just that the hackers have not had its time or they are focusing on something else. I am sure he might not have been the target if only he didn't such boastful comments because for him to have come out with such claim means his security layers must have been better than the already existing ones which have even stand the test of time.
I have never taken McAfee words seriously though as I don't see him as adding any real value to the crypto world aside the pump and dump market he specializes in where he predict the next alt coin for his followers to rip off the market while he also make the same thing. I see it as causing more harm than good to the entire crypto market.
I have never taken McAfee words seriously though as I don't see him as adding any real value to the crypto world aside the pump and dump market he specializes in where he predict the next alt coin for his followers to rip off the market while he also make the same thing. I see it as causing more harm than good to the entire crypto market.
This is why i never use McAfee's products for anything. They are just not a good competent company.
However, the Pwnie Award for lamest vendor response is something i had no idea it existed before. Whoever thought of it is brilliant and i would like to meet him/her.
They say that if someone gets the coins, that is partially true until some extent. I wonder, could the researchers do it if given enough time before notifying the flaw? Maybe they should have done it before, but of course that is not the point.
It's better if we just don't use anything coming from McAfee.
However, the Pwnie Award for lamest vendor response is something i had no idea it existed before. Whoever thought of it is brilliant and i would like to meet him/her.
They say that if someone gets the coins, that is partially true until some extent. I wonder, could the researchers do it if given enough time before notifying the flaw? Maybe they should have done it before, but of course that is not the point.
It's better if we just don't use anything coming from McAfee.
Hydrogen: exactly my thoughts every time something like this surfaces. I know nothing's unhackable, but surely a large team of experienced developers who know their code inside and out would have a better idea of the architecture than a 15-yr old who has to reverse engineer everything?
For me, it's deliberate backdoors in these wallets. Not necessarily by the company, but perhaps left in there by one or some of the developers? It's almost expected for codes to leave something like that in, especially with a commercial product.
For me, it's deliberate backdoors in these wallets. Not necessarily by the company, but perhaps left in there by one or some of the developers? It's almost expected for codes to leave something like that in, especially with a commercial product.
I do not think it's intentional oversight in code, unless we include the conspiracy theories in which some secret agencies have its people inside Ledger or Trezor developer team. I am quite convinced that bad coding is just result of low quality developers and their ignorance regarding how to make something better than it already is.
The fact that the 15 year old boy is more intelligent then all developers speaks for itself, and also raises the question why he is not working for any team - it would be great to have such person, instead of repairing flaws they could remove them before they reach to the users.
I definitely wouldn't call McAfee an "experienced developer", and if this disaster has shown anything, it is that he is seriously out of his depth. He should probably just go back to tweeting about pump-and-dump scam coins.
Still, the vulnerabilities found in Trezor and Ledger are quickly rewarded and fixed. Bitfi have instead decided to just cancel their security bounty program altogether. Additionally, this cold-boot attack isn't something that can be patched. They need to recall all the devices and design a new device from scratch. They won't.
Still, the vulnerabilities found in Trezor and Ledger are quickly rewarded and fixed. Bitfi have instead decided to just cancel their security bounty program altogether. Additionally, this cold-boot attack isn't something that can be patched. They need to recall all the devices and design a new device from scratch. They won't.
Hydrogen: exactly my thoughts every time something like this surfaces. I know nothing's unhackable, but surely a large team of experienced developers who know their code inside and out would have a better idea of the architecture than a 15-yr old who has to reverse engineer everything?
For me, it's deliberate backdoors in these wallets. Not necessarily by the company, but perhaps left in there by one or some of the developers? It's almost expected for codes to leave something like that in, especially with a commercial product.
For me, it's deliberate backdoors in these wallets. Not necessarily by the company, but perhaps left in there by one or some of the developers? It's almost expected for codes to leave something like that in, especially with a commercial product.
The title is kinda ironic reverse, unhackable to hacked? As far as i know that a hardware wallet can't be initiated with cracking codes by the hackers if it is not plugged in? Am i right? And johnmcafee is a known person as one of the richest man in the world so He really is prone to hackers. This comment is based only by basic knowledge that i have. So further informations is highly appreciated.
Quote
If the security community could tell you just one thing, it’s that “nothing is unhackable.” Except John McAfee’s cryptocurrency wallet, which was only unhackable until it wasn’t — twice.
Security researchers have now developed a second attack, which they say can obtain all the stored funds from an unmodified Bitfi wallet. The Android-powered $120 wallet relies on a user-generated secret phrase and a “salt” value — like a phone number — to cryptographically scramble the secret phrase. The idea is that the two unique values ensure that your funds remain secure.
But the researchers say that the secret phrase and salt can be extracted, allowing private keys to be generated and the funds stolen.
Using this “cold boot attack,” it’s possible to steal funds even when a Bitfi wallet is switched off. There’s a video below.
The researchers, Saleem Rashid and Ryan Castellucci, uncovered and built the exploits as part of a team of several security researchers calling themselves “THCMKACGASSCO” (after their initials). The two researchers shared them with TechCrunch prior to its release. In the video, Rashid is shown setting a secret phrase and salt, and running a local exploit to extract the keys from the device.
Rashid told TechCrunch that the keys are stored in the memory longer than Bitfi claims, allowing their combined exploits to run code on the hardware without erasing the memory. From there, an attacker can extract the memory and find the keys. The exploit takes less than two minutes to run, Rashid said.
“This attack is both reliable and practical, requiring no specialist hardware,” said Andrew Tierney, a security researcher with Pen Test Partners, who verified the attack.
Tierney was one of the hackers behind the first Bitfi attack. The McAfee-backed company offered a $250,000 bounty for anyone who could carry out what its makers consider a “successful attack.” But Bitfi declined to pay out, arguing that the hack was outside the scope of the bounty, and instead resorted to posting threats on Twitter.
This new attack, Tierney says, “meets the requirements of the bounty in spirit, even if it does not meet the specific terms that Bitfi have set.”
McAfee earlier this month said, “the wallet is hacked when someone gets the coins.”
Bill Powel, vice president of operations at Bitfi, told TechCrunch in an email that the company defines a hack “as anything that would allow an attacker to access funds held by the wallet.”
“Because the device does not store private keys, that is what prompted the unhackable claim,” he said.
When pressed, Powel did not address the specific claims of the cold boot attack. McAfee, who was copied on the email to Bitfi, did not respond.
Within an hour of the researchers posting the video, Bitfi said in a tweeted statement that it has “hired an experienced security manager, who is confirming vulnerabilities that have been identified by researchers.”
“Effective immediately, we are closing the current bounty programs which have caused understandable anger and frustration among researchers,” it added.
The statement also said it will no longer use the “unhackable” claim on its website.
Rashid said he has no immediate plans to release the exploit code so as to prevent the estimated few thousand Bitfi users from being put at risk.
Just last month, Bitfi won the Pwnie Award for Lamest Vendor Response, a traditional award given out at the Black Hat conference for companies that react the worst in response to security issues.
https://techcrunch.com/2018/08/30/john-mcafees-unhackable-bitfi-wallet-got-hacked-again/
Security researchers have now developed a second attack, which they say can obtain all the stored funds from an unmodified Bitfi wallet. The Android-powered $120 wallet relies on a user-generated secret phrase and a “salt” value — like a phone number — to cryptographically scramble the secret phrase. The idea is that the two unique values ensure that your funds remain secure.
But the researchers say that the secret phrase and salt can be extracted, allowing private keys to be generated and the funds stolen.
Using this “cold boot attack,” it’s possible to steal funds even when a Bitfi wallet is switched off. There’s a video below.
The researchers, Saleem Rashid and Ryan Castellucci, uncovered and built the exploits as part of a team of several security researchers calling themselves “THCMKACGASSCO” (after their initials). The two researchers shared them with TechCrunch prior to its release. In the video, Rashid is shown setting a secret phrase and salt, and running a local exploit to extract the keys from the device.
Rashid told TechCrunch that the keys are stored in the memory longer than Bitfi claims, allowing their combined exploits to run code on the hardware without erasing the memory. From there, an attacker can extract the memory and find the keys. The exploit takes less than two minutes to run, Rashid said.
“This attack is both reliable and practical, requiring no specialist hardware,” said Andrew Tierney, a security researcher with Pen Test Partners, who verified the attack.
Tierney was one of the hackers behind the first Bitfi attack. The McAfee-backed company offered a $250,000 bounty for anyone who could carry out what its makers consider a “successful attack.” But Bitfi declined to pay out, arguing that the hack was outside the scope of the bounty, and instead resorted to posting threats on Twitter.
This new attack, Tierney says, “meets the requirements of the bounty in spirit, even if it does not meet the specific terms that Bitfi have set.”
McAfee earlier this month said, “the wallet is hacked when someone gets the coins.”
Bill Powel, vice president of operations at Bitfi, told TechCrunch in an email that the company defines a hack “as anything that would allow an attacker to access funds held by the wallet.”
“Because the device does not store private keys, that is what prompted the unhackable claim,” he said.
When pressed, Powel did not address the specific claims of the cold boot attack. McAfee, who was copied on the email to Bitfi, did not respond.
Within an hour of the researchers posting the video, Bitfi said in a tweeted statement that it has “hired an experienced security manager, who is confirming vulnerabilities that have been identified by researchers.”
“Effective immediately, we are closing the current bounty programs which have caused understandable anger and frustration among researchers,” it added.
The statement also said it will no longer use the “unhackable” claim on its website.
Rashid said he has no immediate plans to release the exploit code so as to prevent the estimated few thousand Bitfi users from being put at risk.
Just last month, Bitfi won the Pwnie Award for Lamest Vendor Response, a traditional award given out at the Black Hat conference for companies that react the worst in response to security issues.
https://techcrunch.com/2018/08/30/john-mcafees-unhackable-bitfi-wallet-got-hacked-again/
....
This isn't necessarily an isolated issue.
There were vulnerabilities for ledger nano devices publicized earlier this year.
For whatever reason, locking down and securing bitcoin hardware wallets appears to be an impossible task. I wonder if these vulnerabilities are deliberately built into the devices as concealed backdoors, rather than legitimate engineering mistakes.
There is a considerable trend towards weakening encryption and security standards for surveillance purposes. The recent intel security bug could also represent this movement. Et al.
Saleem Rashid is same person ( just a 15 year old ) who discovered few security flaws not only in Ledger Nano S, but also in Trezor and now in Bitfi wallet. Thanks to him and some other researchers, Ledger and Trezor are make fix for security vulnerabilities and today both wallets are more safe then before - but there is no 100% guarantee that there is still no risk we still do not know.
For now there is no documented case that any user is lost coins because of successful hacking of hardware wallet, maybe Bitfi can ruin that tradition and be the first? Too bad that they refuse to pay bounty which has been promised, Saleem and others should just release the exploit code and take them down//bad product and people who do not keep their word.
Quote
If the security community could tell you just one thing, it’s that “nothing is unhackable.” Except John McAfee’s cryptocurrency wallet, which was only unhackable until it wasn’t — twice.
Security researchers have now developed a second attack, which they say can obtain all the stored funds from an unmodified Bitfi wallet. The Android-powered $120 wallet relies on a user-generated secret phrase and a “salt” value — like a phone number — to cryptographically scramble the secret phrase. The idea is that the two unique values ensure that your funds remain secure.
But the researchers say that the secret phrase and salt can be extracted, allowing private keys to be generated and the funds stolen.
Using this “cold boot attack,” it’s possible to steal funds even when a Bitfi wallet is switched off. There’s a video below.
The researchers, Saleem Rashid and Ryan Castellucci, uncovered and built the exploits as part of a team of several security researchers calling themselves “THCMKACGASSCO” (after their initials). The two researchers shared them with TechCrunch prior to its release. In the video, Rashid is shown setting a secret phrase and salt, and running a local exploit to extract the keys from the device.
Rashid told TechCrunch that the keys are stored in the memory longer than Bitfi claims, allowing their combined exploits to run code on the hardware without erasing the memory. From there, an attacker can extract the memory and find the keys. The exploit takes less than two minutes to run, Rashid said.
“This attack is both reliable and practical, requiring no specialist hardware,” said Andrew Tierney, a security researcher with Pen Test Partners, who verified the attack.
Tierney was one of the hackers behind the first Bitfi attack. The McAfee-backed company offered a $250,000 bounty for anyone who could carry out what its makers consider a “successful attack.” But Bitfi declined to pay out, arguing that the hack was outside the scope of the bounty, and instead resorted to posting threats on Twitter.
This new attack, Tierney says, “meets the requirements of the bounty in spirit, even if it does not meet the specific terms that Bitfi have set.”
McAfee earlier this month said, “the wallet is hacked when someone gets the coins.”
Bill Powel, vice president of operations at Bitfi, told TechCrunch in an email that the company defines a hack “as anything that would allow an attacker to access funds held by the wallet.”
“Because the device does not store private keys, that is what prompted the unhackable claim,” he said.
When pressed, Powel did not address the specific claims of the cold boot attack. McAfee, who was copied on the email to Bitfi, did not respond.
Within an hour of the researchers posting the video, Bitfi said in a tweeted statement that it has “hired an experienced security manager, who is confirming vulnerabilities that have been identified by researchers.”
“Effective immediately, we are closing the current bounty programs which have caused understandable anger and frustration among researchers,” it added.
The statement also said it will no longer use the “unhackable” claim on its website.
Rashid said he has no immediate plans to release the exploit code so as to prevent the estimated few thousand Bitfi users from being put at risk.
Just last month, Bitfi won the Pwnie Award for Lamest Vendor Response, a traditional award given out at the Black Hat conference for companies that react the worst in response to security issues.
https://techcrunch.com/2018/08/30/john-mcafees-unhackable-bitfi-wallet-got-hacked-again/
Security researchers have now developed a second attack, which they say can obtain all the stored funds from an unmodified Bitfi wallet. The Android-powered $120 wallet relies on a user-generated secret phrase and a “salt” value — like a phone number — to cryptographically scramble the secret phrase. The idea is that the two unique values ensure that your funds remain secure.
But the researchers say that the secret phrase and salt can be extracted, allowing private keys to be generated and the funds stolen.
Using this “cold boot attack,” it’s possible to steal funds even when a Bitfi wallet is switched off. There’s a video below.
The researchers, Saleem Rashid and Ryan Castellucci, uncovered and built the exploits as part of a team of several security researchers calling themselves “THCMKACGASSCO” (after their initials). The two researchers shared them with TechCrunch prior to its release. In the video, Rashid is shown setting a secret phrase and salt, and running a local exploit to extract the keys from the device.
Rashid told TechCrunch that the keys are stored in the memory longer than Bitfi claims, allowing their combined exploits to run code on the hardware without erasing the memory. From there, an attacker can extract the memory and find the keys. The exploit takes less than two minutes to run, Rashid said.
“This attack is both reliable and practical, requiring no specialist hardware,” said Andrew Tierney, a security researcher with Pen Test Partners, who verified the attack.
Tierney was one of the hackers behind the first Bitfi attack. The McAfee-backed company offered a $250,000 bounty for anyone who could carry out what its makers consider a “successful attack.” But Bitfi declined to pay out, arguing that the hack was outside the scope of the bounty, and instead resorted to posting threats on Twitter.
This new attack, Tierney says, “meets the requirements of the bounty in spirit, even if it does not meet the specific terms that Bitfi have set.”
McAfee earlier this month said, “the wallet is hacked when someone gets the coins.”
Bill Powel, vice president of operations at Bitfi, told TechCrunch in an email that the company defines a hack “as anything that would allow an attacker to access funds held by the wallet.”
“Because the device does not store private keys, that is what prompted the unhackable claim,” he said.
When pressed, Powel did not address the specific claims of the cold boot attack. McAfee, who was copied on the email to Bitfi, did not respond.
Within an hour of the researchers posting the video, Bitfi said in a tweeted statement that it has “hired an experienced security manager, who is confirming vulnerabilities that have been identified by researchers.”
“Effective immediately, we are closing the current bounty programs which have caused understandable anger and frustration among researchers,” it added.
The statement also said it will no longer use the “unhackable” claim on its website.
Rashid said he has no immediate plans to release the exploit code so as to prevent the estimated few thousand Bitfi users from being put at risk.
Just last month, Bitfi won the Pwnie Award for Lamest Vendor Response, a traditional award given out at the Black Hat conference for companies that react the worst in response to security issues.
https://techcrunch.com/2018/08/30/john-mcafees-unhackable-bitfi-wallet-got-hacked-again/
....
This isn't necessarily an isolated issue.
There were vulnerabilities for ledger nano devices publicized earlier this year.
For whatever reason, locking down and securing bitcoin hardware wallets appears to be an impossible task. I wonder if these vulnerabilities are deliberately built into the devices as concealed backdoors, rather than legitimate engineering mistakes.
There is a considerable trend towards weakening encryption and security standards for surveillance purposes. The recent intel security bug could also represent this movement. Et al.
Jump to: