Leak -- Compromised MEMO key successfully protected

avatar


❗❗❗ 💀💀 ⚠️⚠️
It's a new day and another user leaked one of their private keys into the Steem Blockchain.

They COMPROMISED their...

private MEMO key

HOW: in a transfer operation


The compromised account owner has NOT been notified since it's a Steem-only account.

Compromised account stats:

  • Reputation: 48

  • Followers: 8

  • Account creation: May 2021

  • Last Post: 11 days ago

  • Estimated account value: $ 5.34


Top 5 private ACTIVE keys protected:

1. @nextgen622: ~$ 28,000
2. @cryptoandcoffee: ~$ 8,400
3. @runridefly: ~$ 3,300
4. @globalmerchantio: ~$ 250
5. @j3dy: ~$ 120 (500 HIVE automatically protected for 9 days)
My security disclosures for Hive:
- XSS vulnerabilities in #########.com
- XSS vulnerabilities in hive-db.com
- XSS vulnerabilities in scribe.hivekings.com
- XSS vulnerabilities in hiveblockexplorer.com
- Malicious ads redirecting all Steemit iOS users to a phishing site
- Reverse tabnabbing and clickjacking in steem.chat and steeemit registration page

Other contributions:
- Universal script to prevent phishing in all Hive frontends
- Commands for community reports and ban lists

 Future development:   plan

Keys-Defender features:

- Keys protection [live scan of transfers/posts/comments/other_ops. Warnings (reply and memo), auto-transfers to savings until fully restored, auto-reset of keys, ..] {see automatic posts on leak and monthly reports}
- Phishing protection [live scan of comments and posts to warn users against known phishing campaigns and compromised domains or accounts, scan of memos and auto-replies, anti phishing countermeasures - eg. fake credentials]
- Re-posting detection [mitigates the issue of re-posters]
- Code injections detection [live scan of blocks for malicious code targeting dapps of the Hive ecosystem]
- Anti abuse efforts [counteracts spam from hive haters and milking campaigns]

Discord chat
To support this project..
- Delegations:
10, 50, 100, 200 HP,
500 HP, 1000 HP
- Curation trail
Follow my curation trail on hive.vote to upvote all my posts with a fixed weight.

abuse hacking stem tech neoxian palnet leo
0
0
0.000
7 comments
avatar

Hi, @keys-defender I am reaching to you because I am afraid I might have a security comprimise when using https://3speak.tv and you seem knowledgeable about Hive blockchain security.

The SSL certificate seems to be invalid, I have made a post about it to see if I can get some help, or even to know if it is just me:
https://hive.blog/hive-181335/@igormuba/issue-with-3speak-ssl-ceritificate-careful-with-phishing

I am waiting to use the platform when the issue is solved, but I am reaching out to you to see if you can help me understand what happened, if it is just me, or it is indeed a security compromise, or anything else or in between.

Thank you.

0
0
0.000
Reply
avatar

It was a temporary issue with their certificate, it likely expired. All good now.

0
0
0.000
Reply
avatar

Thank you for your engagement on this post, you have recieved ENGAGE tokens.

0
0
0.000
Reply