101010.pl

Efani🎯 North Korean hackers are now targeting crypto developers with fake coding tests.A new campaign by the threat group Slow Pisces (also known as Jade Sleet or TraderTraitor) is exploiting developers—especially in the crypto space—by disguising Python-based malware as take-home coding assignments.Their tactic? Start a conversation on LinkedIn. Pose as a hiring manager. Then, send a “challenge” hosted on GitHub. What looks like a project to fetch crypto prices? Actually a trojanized package designed to steal sensitive data from macOS machines.Here’s what the malware (RN Loader + RN Stealer) does:- Sends basic system info to a remote server - Downloads a second-stage payload only to validated victims (based on IP, geo, headers) - Harvests iCloud Keychain, AWS/Kubernetes configs, SSH keys, and moreThey’ve even disguised JavaScript challenges the same way—with GitHub repos that trigger arbitrary code execution using embedded templating tools like ejs.render().⚠️ What makes this campaign particularly dangerous:- Payloads are delivered only in memory - Deserialization tricks bypass typical detection (YAML, EJS) - No operational overlap with other NK campaigns, but same playbook: “You’re hired. Just complete this challenge.”This is not a mass phishing campaign. It’s surgical social engineering—aimed at high-value targets in blockchain, security, and cloud tech.🔐 At <a href="https://infosec.exchange/@Efani" class="u-url mention" rel="nofollow noopener" target="_blank">@Efani</a>, we see this as another reminder: Your team’s trust in common tools—GitHub, LinkedIn, code samples—can be turned against them.Cyber vigilance starts with verifying the source.<a href="https://infosec.exchange/tags/Cybersecurity" class="mention hashtag" rel="nofollow noopener" target="_blank">#Cybersecurity</a> <a href="https://infosec.exchange/tags/ThreatIntel" class="mention hashtag" rel="nofollow noopener" target="_blank">#ThreatIntel</a> <a href="https://infosec.exchange/tags/CryptoSecurity" class="mention hashtag" rel="nofollow noopener" target="_blank">#CryptoSecurity</a> <a href="https://infosec.exchange/tags/EfaniSecure" class="mention hashtag" rel="nofollow noopener" target="_blank">#EfaniSecure</a>

Mela News :verified:⚠️ Scoperto SparkCat: malware che usa OCR per rubare dati crypto dalle foto. Si nasconde in app legittime su App Store e Google Play, incluse app di food delivery e chat AI. Prima volta che un malware di questo tipo supera i controlli Apple 📱 <a href="https://mastodon.uno/tags/Cybersecurity" class="mention hashtag" rel="nofollow noopener" target="_blank">#Cybersecurity</a> <a href="https://mastodon.uno/tags/CryptoSecurity" class="mention hashtag" rel="nofollow noopener" target="_blank">#CryptoSecurity</a>

Kolibri**Derivation of paths** (path derivation) is a method by which derived keys are created from one master key (for example, in cryptography or blockchain technologies). In simple words, it is like a tree, where each branch grows from the main trunk, and the process of growing itself is a derivation.<a href="https://bastyon.com/kolibristudio?s=e861a539fbc10608d9b3b981c9a7c97a861e3d4ee94bd48290015583aed7ccd7&ref=PPuoSzXpSnY1Q4w1MLeVdLcbaUpVDCwpBp" rel="nofollow noopener" target="_blank">https://bastyon.com/kolibristudio?s=e861a539fbc10608d9b3b981c9a7c97a861e3d4ee94bd48290015583aed7ccd7&ref=PPuoSzXpSnY1Q4w1MLeVdLcbaUpVDCwpBp</a>**How it works:** **root (primary key)**: You have one master secret key (eg seed phrase or master key).**Formula for branching**: A mathematical formula or algorithm (such as HMAC or hashing) is used to generate new keys based on the master key.**The structure is tree-like**: Each new key can "branch" into even more keys. The result is a hierarchy where each key can be unique, but they are all related to a primary key.**Control and security**:The master key allows you to restore all derived keys. If someone only gets access to the derived key, they won't be able to get to the master.**A simple example in life:** Imagine you have a phone number (master key) and you use it to register on several sites. Each site gets its own unique number (derived key) that is linked to your primary number but not disclosed.**Where it is used:** **Cryptocurrencies**: Wallets like Bitcoin or Ethereum use "hierarchical deterministic derivation" (HD wallets). This allows multiple transaction addresses to be created from a single master key.**Passwords**: Password managers can generate unique passwords for each site based on a single master.**Security**: Path derivation is often used to generate unique encryption keys in secure systems.**The main idea:** Instead of storing many separate keys or passwords, you have one master secret and everything else is generated automatically when needed. It's convenient, safe and effective!Using crypto wallets from different vendors, sites, and apps requires attention to detail to ensure the security of your assets and privacy. Here's what to consider:**1. Choosing the type of wallet** **Hardware wallets**: The most secure option for storing large sums, for example, Ledger, Trezor. **Software wallets**: Installed on a PC or smartphone (eg Exodus, Trust Wallet). **Online wallets (web wallets)**: Used through a web browser, but are more vulnerable to attack. **Paper wallets**: The private key is printed or written down on paper. **Browser wallets**: For example, MetaMask, which work as plugins. 👉 *Choose a wallet depending on your needs: frequency of use, amount of assets and level of security.***2. Reputation of the manufacturer** Check reviews and ratings. Use only open-source wallets to ensure transparency. Avoid unknown or new apps without a proven track record.**3. Security** **Saving the seed phrase**: Write it down on paper and never save it electronically (notes, photos, etc.). **Password**: Use a strong password to access the wallet. **Two-factor authentication (2FA)**: Enable if available. **Renewal**: Update your app or wallet firmware regularly to fix vulnerabilities. **Encryption**: Make sure your wallet encrypts data.**4. Compatibility** Make sure the wallet supports the blockchains and cryptocurrencies you want (for example, not all wallets support NFT or DeFi). Check out the integration with popular decentralized platforms (eg Uniswap, OpenSea).**5. Backup** Back up the seed phrase and private keys. Keep copies in a safe place (such as a safe). Never entrust your keys to a third party, even if it's a support service.**6. Confidentiality** **VPN**: Use a VPN to access your wallet, especially on public networks. **Anonymity**: Choose wallets that do not collect personal data. **Beware of phishing**: Always check the website or app address.**7. Costs and commissions** Check transaction fees. Some wallets automatically set high fees to speed up transactions - check this manually.**8. Technical support** Research whether the wallet has a reliable support service. Avoid apps that don't have a clear way of communicating to solve problems.**9. Verification of counterfeits** Download applications only from official sites or stores (Google Play, App Store). Check that the hardware wallet is properly packaged and has no signs of opening.**10. Work on decentralized platforms** Always use keys only in trusted decentralized applications. Avoid connecting your wallet to sites with a dubious reputation.**Recommendation in practice** Keep the main part of funds in a hardware wallet. Use software or browser wallets for daily transactions. Keep your security knowledge up to date as fraud techniques evolve.The security of cryptocurrency assets depends only on you, so be careful and careful! **The importance of testing software on your own PC or device and third-party services** Testing software, sites and extensions before use is a critical step for security **security**, **stability** and **convenience of work**. It helps to avoid risks that could lead to the loss of data, finances or confidential information.**1. Data security** **Detection of malicious software**: Some software or extensions may contain viruses, trojans or backdoors that open access to your system to attackers. **Avoiding phishing**: Third-party services can copy famous brands to steal your passwords, keys, or other sensitive information. **Recommendations:** Use antivirus programs and utilities to analyze malicious code. Download programs only from official sources.**2. Compatibility** Some software may conflict with pre-installed programs or your operating system. Improper operation can lead to crashes, "blue screen" or freezes. **Recommendations:** Test new software in a secure environment (for example, in a virtual machine or an isolated session). Check the software system requirements before installing.**3. Functionality check** Not all programs or extensions work as promised by the manufacturer. Incorrect work can lead to loss of important data or failure to perform necessary tasks. **Recommendations:** Test key features in test mode. Read user reviews to learn about possible problems.**4. Confidentiality** Some apps may collect your data without your knowledge. This is especially dangerous for crypto wallets, where even a minimal vulnerability can lead to asset theft. **Recommendations:** Analyze what permissions the software requires (for example, access to the camera, microphone or contacts). Use network activity monitoring to detect suspicious connections.**5. Reliability of third-party services (sites, API)** Accessing an untrusted service can end up with your credentials being stolen or your system infected. Sites with a dubious reputation often become a source of attacks, such as mining scripts or resource theft. **Recommendations:** Use it **VPN** to protect your IP address from being tracked. Transfer confidential data only through services with HTTPS.**6. Saving resources and time** Inappropriate software or plugins can use too many system resources, which slows down your device. This also applies to third-party services that may create "extra" requests or cause disruptions in your network. **Recommendations:** Measure resource consumption during testing (CPU, RAM, Internet). Avoid installing a lot of untested software.**7. Ease of recovery in case of failure** New software may corrupt your settings or important data. Third-party services may change the format of your files or their structure. **Recommendations:** Make backup copies before installing or using new software. Create system restore checkpoints.**Practical tips for testing** **Testing environment: ** Use a separate device, virtual machine or sandbox to test new software.**Monitoring:** Analyze application network activity through tools such as Wireshark or GlassWire. Install a program that monitors changes in the registry or system files. **Browser extensions:** Install extensions only from official stores (Chrome Web Store, Mozilla Add-ons). Check the extension regularly for updates and changes to the privacy policy. **Regular checks: ** Use utilities such as Malwarebytes, Norton or Kaspersky to check the system for vulnerabilities.Testing all software and services allows you to avoid most problems and ensures maximum efficiency of your equipment.This is a really important point: not all tools, even those considered "core" (Core tools, nodes or built-in wallets), have the functionality you can expect by default. Here is what should be understood and taken into account:**1. Limitation of the Core toolkit** **Not all features are available out of the box**: For example, Bitcoin Core allows full synchronization with the network, but does not have a convenient interface for integration with other services. **Specific needs**: Core nodes can be focused on narrow tasks (for example, block verification only), without additional features such as multi-signature support or DeFi. **Example**: An Ethereum Geth node may not support functionality that modern dApps require (for example, optimized requests to the blockchain via RPC).**2. Wallets with built-in functionality, but with limitations** **Limited access to assets**: For example, some wallets only support standard tokens (ERC-20, BEP-20) but cannot work with NFT or L2 solutions. **Incomplete integration**: Wallets built into nodes may not have a user-friendly GUI or backup capabilities. **Example**: The Bitcoin Core wallet supports only basic transactions and does not provide convenient means for managing complex functions such as multi-signatures or managing multiple addresses.**3. Lack of automation and convenience** **Manual setting**: Core tools often require manual configuration (eg configuration file, startup options). **Basic UX/UI**: GUIs are usually not a priority for developers of Core solutions, which makes them difficult to use for average users.**4. Lack of integration with other tools** Most Core solutions do not have built-in tools for integration with dApps, analytics services or APIs for third-party applications. Some wallets or nodes do not support modern standards (such as SegWit or Taproot for Bitcoin).**5. High requirements for resources** **Data size**: A full node can require hundreds of gigabytes of disk space (like Bitcoin Core or Ethereum). **System resources**: Node operation may be too heavy for devices with limited power.**How to choose the optimal tool?** **Functional research:** Study the documentation and the tool's capabilities before using it. Understand what features you really need (like L2, token or DeFi support). **Expansion of possibilities:** Use additional tools on top of Core solutions (e.g. Lightning Network for Bitcoin, Infura for Ethereum). Integrate third-party wallets or services to expand functionality. **Automation:** Add scripts or automation to simplify routine tasks. **Compatibility check:** Make sure the tool supports your tasks (tokens, addresses, standards). Update your nodes or wallets regularly to get new features and bug fixes.**Recommendations for users** If you only need basic features, use proven wallets with easy access (eg Exodus, Trust Wallet). For professional blockchain work, choose Core nodes, but be prepared for a more complex setup. For a hybrid approach (partial control and API integration), use services like Alchemy or Infura. Core tools provide fundamental capabilities, but require additional work to meet modern user needs.Here is a link to support the project for donors and philanthropists: 🌍** Support the project:** Kolibri Studio Donate Page 📥** Contact for philanthropists:** Telegram of the editorial team Matrix: Future-Tech Community Your contributions help develop the project, support its initiatives and create new solutions for the community. Thank you for your support! 🌟**List of literature and resources for independent study** **Books:** "Blockchain Basics: A Non-Technical Introduction in 25 Steps" by Daniel Dressler "Mastering Bitcoin" - Andreas M. Antonopoulos "Mastering Ethereum" - Andreas M. Antonopoulos, Gavin Wood "The Internet of Money" - Andreas M. Antonopoulos **Scientific articles and materials:** Nakamoto S. (2008).*Bitcoin: A Peer-to-Peer Electronic Cash System*. Wood G. (2014). *Ethereum: A Secure Decentralised Generalised Transaction Ledger*. Vitalik Buterin (2021). *Ethereum Whitepaper*. **Online resources:** Bitcoin.org — The official Bitcoin resource Ethereum.org — Ethereum documentation CoinMarketCap — Analytics of cryptocurrencies Binance Academy — Educational materials **Forums and communities:** Bitcointalk — Forum about cryptocurrencies Reddit (r/cryptocurrency) — Discussions about the crypto world Ethereum StackExchange — Answers to technical questions **Tools and services:** Etherscan — Ethereum Blockchain Scanner Blockchain.com Explorer — Scanner for Bitcoin and other blockchains MyCrypto — Wallet for Ethereum Fat — Infrastructure for working with blockchains**Hashtags for promotion in social networks** <a href="https://qoto.org/tags/Blockchain" class="mention hashtag" rel="nofollow noopener" target="_blank">#Blockchain</a> <a href="https://qoto.org/tags/Cryptocurrency" class="mention hashtag" rel="nofollow noopener" target="_blank">#Cryptocurrency</a> <a href="https://qoto.org/tags/Bitcoin" class="mention hashtag" rel="nofollow noopener" target="_blank">#Bitcoin</a> <a href="https://qoto.org/tags/Ethereum" class="mention hashtag" rel="nofollow noopener" target="_blank">#Ethereum</a> <a href="https://qoto.org/tags/Decentralisation" class="mention hashtag" rel="nofollow noopener" target="_blank">#Decentralisation</a> <a href="https://qoto.org/tags/CryptoEducation" class="mention hashtag" rel="nofollow noopener" target="_blank">#CryptoEducation</a> <a href="https://qoto.org/tags/BigData" class="mention hashtag" rel="nofollow noopener" target="_blank">#BigData</a> <a href="https://qoto.org/tags/Web3" class="mention hashtag" rel="nofollow noopener" target="_blank">#Web3</a> <a href="https://qoto.org/tags/OpenSource" class="mention hashtag" rel="nofollow noopener" target="_blank">#OpenSource</a> <a href="https://qoto.org/tags/CryptoMining" class="mention hashtag" rel="nofollow noopener" target="_blank">#CryptoMining</a> <a href="https://qoto.org/tags/FutureTech" class="mention hashtag" rel="nofollow noopener" target="_blank">#FutureTech</a> <a href="https://qoto.org/tags/FinTech" class="mention hashtag" rel="nofollow noopener" target="_blank">#FinTech</a> <a href="https://qoto.org/tags/CryptoSecurity" class="mention hashtag" rel="nofollow noopener" target="_blank">#CryptoSecurity</a> <a href="https://qoto.org/tags/SmartContracts" class="mention hashtag" rel="nofollow noopener" target="_blank">#SmartContracts</a> <a href="https://qoto.org/tags/DigitalTransformation" class="mention hashtag" rel="nofollow noopener" target="_blank">#DigitalTransformation</a> This list will help you navigate the topic of blockchains, cryptocurrencies and decentralized technologies.<a href="https://kolibristudiopro.blogspot.com/2025/01/derivation-of-paths-path-derivation-is.html" rel="nofollow noopener" target="_blank">https://kolibristudiopro.blogspot.com/2025/01/derivation-of-paths-path-derivation-is.html</a>Donate Page List Wallet Address <a href="https://kolibristudiopro.blogspot.com/p/donate-page-list-wallet-address.html" rel="nofollow noopener" target="_blank">https://kolibristudiopro.blogspot.com/p/donate-page-list-wallet-address.html</a>Illustration: Біткоїн Ренесанс: Як Layer 2 Біткоїна Можуть Відродити Біткоїн - Bitcoin News <a href="https://news.bitcoin.com/uk/bitkoin-renesans-yak-layer-2-bitkoyina-mozhut-vidroditi-bitkoin/" rel="nofollow noopener" target="_blank">https://news.bitcoin.com/uk/bitkoin-renesans-yak-layer-2-bitkoyina-mozhut-vidroditi-bitkoin/</a>

NWL2024Усиление анонимности при переводах криптоактивов необходимо для защиты конфиденциальности пользователей, особенно в условиях растущего контроля со стороны регуляторов и аналитических сервисов. Вот основные **методы и инструменты** для повышения анонимности при криптовалютных транзакциях: --- ### **1. Использование миксеров (тумблеров)** - **Что это?** Криптовалютные миксеры (coin mixers) смешивают средства различных пользователей, запутывая цепочку блокчейн-транзакций. В результате невозможно отследить отправителя и получателя. - **Примеры сервисов**: - **Wasabi Wallet** (для Bitcoin, с функцией CoinJoin) - **Samourai Wallet** (Bitcoin, поддерживает Whirlpool) - **Tornado Cash** (Ethereum, но после санкций США менее безопасен) --- ### **2. Анонимные криптовалюты** - Такие криптовалюты используют **криптографические методы** для скрытия данных транзакций (отправитель, получатель, сумма). - **Примеры**: - **Monero (XMR)**: Ring Signatures и Confidential Transactions обеспечивают высокий уровень анонимности. - **Zcash (ZEC)**: Использует zk-SNARKs для скрытия информации. - **Dash (DASH)**: Поддерживает PrivateSend для анонимизации. --- ### **3. Использование децентрализованных бирж (DEX)** - Децентрализованные биржи не требуют KYC (знай своего клиента), а значит, пользователи могут обменивать активы анонимно. - **Примеры платформ**: - Uniswap - Bisq - PancakeSwap ⚠️ **Важно**: Для достижения полной анонимности используйте VPN или Tor при доступе к этим сервисам. --- ### **4. Прокси и Tor-сети** - Использование VPN или Tor-сети маскирует ваш IP-адрес, а значит, транзакции не будут привязаны к физическому местоположению. - **Рекомендуется**: Всегда подключаться через **Tor** при взаимодействии с кошельками или сервисами. --- ### **5. Использование одноразовых адресов** - Создание нового адреса для каждой транзакции снижает вероятность отслеживания. - **Как это сделать?** - Аппаратные кошельки (Trezor, Ledger) позволяют генерировать уникальные адреса. - Программные кошельки с поддержкой HD (Hierarchical Deterministic) создают одноразовые ключи. --- ### **6. P2P-платформы для обмена** - P2P-биржи позволяют пользователям обменивать криптовалюту напрямую без посредников. - **Примеры**: - LocalMonero (для XMR) - HodlHodl - LocalBitcoins --- ### **7. Использование Atomic Swaps** - Это технология обмена криптовалют напрямую между двумя пользователями **без посредников** и бирж. - Она делает транзакции анонимными и безопасными. --- ### **8. Маскирование через мультисиг и смарт-контракты** - Смарт-контракты позволяют разбивать транзакции на **части** или отправлять их через третьих участников. Это усложняет анализ. - **Пример**: Использование мультиподписей (multisig wallets). --- ### **Заключение** Для максимальной анонимности **комбинируйте несколько методов**: используйте анонимные криптовалюты, миксеры, VPN/Tor и одноразовые адреса. Такой подход существенно осложнит отслеживание ваших переводов как для аналитиков блокчейна, так и для регуляторов. 🔗 **Полезные ссылки для изучения**: 1. [Wasabi Wallet](<a href="https://wasabiwallet.io" rel="nofollow noopener" target="_blank">https://wasabiwallet.io</a>) 2. [Monero - официальный сайт](<a href="https://getmonero.org" rel="nofollow noopener" target="_blank">https://getmonero.org</a>) 3. [Tor Project](<a href="https://www.torproject.org/" rel="nofollow noopener" target="_blank">https://www.torproject.org/</a>) 4. [Bisq - децентрализованный обмен](<a href="https://bisq.network/" rel="nofollow noopener" target="_blank">https://bisq.network/</a>) <a href="https://qoto.org/tags/%D0%9A%D1%80%D0%B8%D0%BF%D1%82%D0%BE%D0%90%D0%BD%D0%BE%D0%BD%D0%B8%D0%BC%D0%BD%D0%BE%D1%81%D1%82%D1%8C" class="mention hashtag" rel="nofollow noopener" target="_blank">#КриптоАнонимность</a> <a href="https://qoto.org/tags/Monero" class="mention hashtag" rel="nofollow noopener" target="_blank">#Monero</a> <a href="https://qoto.org/tags/Tor" class="mention hashtag" rel="nofollow noopener" target="_blank">#Tor</a> <a href="https://qoto.org/tags/%D0%94%D0%B5%D1%86%D0%B5%D0%BD%D1%82%D1%80%D0%B0%D0%BB%D0%B8%D0%B7%D0%B0%D1%86%D0%B8%D1%8F" class="mention hashtag" rel="nofollow noopener" target="_blank">#Децентрализация</a> <a href="https://qoto.org/tags/Privacy" class="mention hashtag" rel="nofollow noopener" target="_blank">#Privacy</a> <a href="https://qoto.org/tags/Bitcoin" class="mention hashtag" rel="nofollow noopener" target="_blank">#Bitcoin</a> <a href="https://qoto.org/tags/CryptoSecurity" class="mention hashtag" rel="nofollow noopener" target="_blank">#CryptoSecurity</a>

Guardians Of Cyber🔐 Crypto enthusiasts, beware! Multi-vector supply chain attacks are on the rise, targeting trusted platforms through compromised libraries and Trojanized updates. 🛡️ Regular audits and SBOMs can help secure your assets.How do you ensure your digital wallets stay safe from complex threats? Share your insights!🔗 Read more: <a href="https://guardiansofcyber.com/threats-vulnerabilities/multi-vector-attacks-digital-wallets/" rel="nofollow noopener" translate="no" target="_blank">https://guardiansofcyber.com/threats-vulnerabilities/multi-vector-attacks-digital-wallets/</a><a href="https://infosec.exchange/tags/Cybersecurity" class="mention hashtag" rel="nofollow noopener" target="_blank">#Cybersecurity</a> <a href="https://infosec.exchange/tags/GuardiansOfCyber" class="mention hashtag" rel="nofollow noopener" target="_blank">#GuardiansOfCyber</a> <a href="https://infosec.exchange/tags/CryptoSecurity" class="mention hashtag" rel="nofollow noopener" target="_blank">#CryptoSecurity</a> <a href="https://infosec.exchange/tags/SupplyChainSecurity" class="mention hashtag" rel="nofollow noopener" target="_blank">#SupplyChainSecurity</a> <a href="https://infosec.exchange/tags/DataProtection" class="mention hashtag" rel="nofollow noopener" target="_blank">#DataProtection</a> <a href="https://infosec.exchange/tags/DigitalSafety" class="mention hashtag" rel="nofollow noopener" target="_blank">#DigitalSafety</a> <a href="https://infosec.exchange/tags/TechNews" class="mention hashtag" rel="nofollow noopener" target="_blank">#TechNews</a> <a href="https://infosec.exchange/tags/Blockchain" class="mention hashtag" rel="nofollow noopener" target="_blank">#Blockchain</a> <a href="https://infosec.exchange/tags/OpenSource" class="mention hashtag" rel="nofollow noopener" target="_blank">#OpenSource</a>

Danny Lucas🚨 Sushiswap hacked! 🚨 If you've interacted with the contract in the last few weeks, it's important to revoke all approvals immediately to protect your funds. Stay safe and stay vigilant in the world of DeFi. <a href="https://mastodon.online/tags/Sushiswap" class="mention hashtag" rel="nofollow noopener" target="_blank">#Sushiswap</a> <a href="https://mastodon.online/tags/DeFi" class="mention hashtag" rel="nofollow noopener" target="_blank">#DeFi</a> <a href="https://mastodon.online/tags/Hacking" class="mention hashtag" rel="nofollow noopener" target="_blank">#Hacking</a> <a href="https://mastodon.online/tags/CryptoSecurity" class="mention hashtag" rel="nofollow noopener" target="_blank">#CryptoSecurity</a>

Recent searches

Search options

Administered by:

Server stats:

#cryptosecurity