Topic: Ledger (Live) - Angebote / Diskussion / Hilfe - page 51. (Read 22241 times)

Eine Million E-Mail-Adressen, dazu hundertrausende Privat-Adressen und andere Kontaktinformationen: Kundendaten des Hardware-Wallet-Herstellers Ledger sind in einem bekannten Hacker-Forum zum kostenlosen Download angeboten worden.

Dear client,

We respect the privacy of your personal information, as well as the trust you had put in our company, which is why we are herein notifying you of a security breach that occurred on December 20th 2020, when a malicious actor gained access to one of the Ledger Live administrative servers and downloaded confidential data belonging to approximately 92,000 users.

You're receiving this email due to the wallet information associated with your email address (#EMAIL#) being contained within the compromised data.

At this moment, it is not yet clear whether user funds are affected by the breach. We advise all affected users to update their Ledger Live client and enable additional security settings for their wallet. As a precautionary measure, we have to assume that your cryptocurrency assets are zK66IYpo immediate risk of theft..

To say that we're terribly sorry for this incident would be a colossal understatement. We want to assure you that we're doing everything we can to mitigate the amount of damage this breach will have caused our customers, as well as track down and prosecute the individual(s) responsible.

If you're receiving this notice, you've been affected by the breach. In order to assure the security of your digital assets, please install the latest version of Ledger Live and follow the instructions to set up a new PIN for your Ledger wallet.

Sincerly,
Ledger

Wie seriös ist die Website? Und ist es sicher, dass nicht auch hier Daten abgegriffen werden?

Have I Been Pwned? was created by security expert Troy Hunt on 4 December 2013. As of June 2019, Have I Been Pwned? averages around one hundred and sixty thousand daily visitors, the site has nearly three million active email subscribers and contains records of almost eight billion accounts.

Quelle

Domain Name: DIDLEDGERFUCK.ME
Registry Domain ID: D425500000335734841-AGRS
Registrar WHOIS Server: whois.namecheap.com
Registrar URL: www.namecheap.com
Updated Date: 2020-12-21T00:21:18Z
Creation Date: 2020-12-20T23:34:03Z
Registry Expiry Date: 2021-12-20T23:34:03Z
Registrar Registration Expiration Date:
Registrar: NameCheap, Inc.

Die ersten Phishing-Versuche laufen schon. Auf Twitter liest man diverse E-Mails und SMS, die die betroffenen Nutzer bekommen haben. Zum Teil findet man auch Drohungen wie im unten angeführten Tweet
-snip-

~

Buy a Ledger Christmas Pack - Secure your crypto with a Ledger Nano X and get the $25 voucher to use when buying crypto on Ledger Live from Coinify.

und wie kommen die zu den Telefonnummern?
 

Mitte des Jahres gab es ein Daten-Leak bei Ledger, bei welchem leider diverse persönliche Daten einzelner Nutzer veröffentlicht wurden. Leider werden diese Nutzer nun seit Monaten mit Scam-Versuchen bombadiert. Gefahr für die Krypto-Guthaben auf den Ledgern der Nutzer besteht jedoch nicht.

und wie kommen die zu den Telefonnummern?
 

On the 14th of July 2020, a researcher participating in our bounty program made us aware of a potential data breach on the Ledger website. We immediately fixed this breach after receiving the researcher’s report and underwent an internal investigation. A week after patching the breach, we discovered It had been further exploited on the 25th of June 2020, by an unauthorized third party who accessed our e-commerce and marketing database – used to send order confirmations and promotional emails – consisting mostly of email addresses, but with a subset including also contact and order details such as first and last name, postal address, email address and phone number. Your payment information and crypto funds are safe.

...

Es gibt einen weiteren Ledger-Phising-Scam: Aktuell werden Nutzer, die vom Datenleck betroffen waren mit SMS bombadiert, dass ihr Ledger aufgrund von angeblichen "KYC-Regulations" eines Updates bedürfe.

Gibt doch (meine ich) auch noch die Möglichkeit den Nano online durch Ledger selbst verifizieren zu lassen oder nicht? Ist so eine dunkle Erinnerung, etwas darüber gelesen zu haben.

The solution: attestation
A better approach for proving authenticity of hardware wallets is to use attestation. This is basically a cryptographic challenge presented to the device each time it is connected to the computer (or smartphone).
Let’s take an example: the Ledger Nano is using attestation as a way of proving to its owner that the product is genuine.