CertiK has discovered a critical bootloader vulnerability in Solana Phone. CertiK's testing experts were able to jailbreak the phone in just one minute and "clean out" all of its assets with just a few steps.
The vulnerability stems from an insecure "bootloader unlock" feature. In addition to stealing user assets, it also exposes all personal data stored on the device. Over 2,100 devices have been at serious risk since early April. Given the complexity of the vulnerability and the need for physical access, CertiK has informed Solana of the vulnerability and publicly released this vulnerability warning to protect Web3 users and encourage them to take effective measures to protect their asset security.
CertiK released a video analyzing the details of the vulnerability on November 15. They emphasized that the vulnerability is not limited to Solana Phone and recommended that relevant projects and developers take immediate action to strengthen bootloader protection.
Welcome Back
Click “Sign in” to agree to Cointime’s Terms of Service and acknowledge that Cointime’s Privacy Policy applies to you.
Join CoinTime
Already have an account?
Click “page.Sign up” to agree to Cointime’s <a class="underline" href="#term-of-service">Terms of Service</a> and acknowledge that Cointime’s a class="underline" href="#privacy-policy">Privacy Policy</a> applies to you.
Sign in with email
Sign up with email
Your email
Check your inbox
Click the link we sent to to sign in.
Click the link we sent to to sign up.
CertiK: Discovered a critical vulnerability in Solana Phone that allows user assets to be stolen within tens of seconds
-
Wechat scan to share
Recommended for you
-
Chillguy creator X's account was briefly stolen and has been restored to control, calling on the community to be vigilant against abnormal content
Phillip Bankss, the creator of Chillguy's image, stated that his X account was stolen. Although he has regained control, hackers may have set up some scheduled tweets, or the account may not be completely safe yet. He called on the community to notify him promptly if they discover any abnormal content for him to handle. -
Odos DAO: Phishing email attacks related to the "ODOS Loyalty Program" have appeared, reminding users to be vigilant
Odos DAO posted on X platform, stating that they have noticed phishing email attacks related to the "ODOS Loyalty Program" in the community and reminded users to be cautious. Odos DAO and ODOS will not send emails to users. All official communication is only conducted through verified Twitter accounts. Do not click on any suspicious links. -
Report: 165 security incidents have occurred in the Web3 field so far in 2024, with losses exceeding US$2.3 billion
According to a report summarizing key security trends in 2024 by Cyvers, Web3 network threats will increase sharply in 2024, resulting in losses of over 2.3 billion US dollars and a total of 165 security incidents. Although the loss amount is 40% higher than in 2023 (1.69 billion US dollars), it is still 1.42 billion US dollars lower than in 2022 (3.78 billion US dollars). It is worth noting that 1.3 billion US dollars of stolen funds were recovered this year. -
Phishing ad links impersonating Virtuals Protocol appear in Google search results
according to Scam Sniffer, there are currently phishing ads impersonating Virtuals Protocol appearing in Google search results. If users click on these links to connect their wallets and sign transactions, these fraudulent ads may steal users' assets. Users should be careful to identify and prevent theft. -
Scam Sniffer: zkPass's X account was hacked and a fake airdrop message was published
Scam Sniffer posted on X platform that zkPass's X account was hacked and false airdrop messages were released, reminding the community to be cautious. -
Australia launches task force to tighten regulation of crypto ATMs
On December 6th, Australia established a special task force to strengthen the management of encrypted ATMs. The task force aims to ensure that digital currency exchanges (DCEs) that provide cryptocurrency ATM services comply with minimum standards. This measure is intended to implement strong measures to prevent these machines from being used for fraud, deception, or criminal transactions. -
Avalon Labs: Coordinated attacks against multiple projects in the Bitcoin ecosystem discovered, legitimate platforms were mistakenly reported as phishing sites
Avalon Labs has discovered a coordinated attack against multiple projects in the Bitcoin ecosystem, where legitimate platforms are being wrongly reported as phishing sites. They have reported this inappropriate behavior to Cloudflare and are actively working with them to address and resolve these malicious claims. -
Russia sentences Hydra market founder to life in prison
Stanislav Moiseev, founder of the online black market and cryptocurrency mixing service Hydra, has been sentenced to life imprisonment by a Russian court. -
Scam Sniffer releases November phishing report: $9,380,000 stolen, 9,208 victims
Scam Sniffer released its November phishing report, which resulted in a total of $9,380,000 stolen and 9,208 victims, including: -
CertiK Chief Security Officer: The number of security incidents as of September 2023 has exceeded the total in 2022
On October 23, at the ETH HK Side Event, a Web3 ecosystem security forum jointly held by CertiK and OKLink in Causeway Bay, Hong Kong, Professor Li Kang, Chief Security Officer of CertiK, shared his views on digital asset security construction. He pointed out that according to CertiK's statistics, the number of security incidents as of September 2023 has exceeded the total number in 2022. Hacking attacks and fraudulent behavior are still important threats, seriously hindering the development of the Web3 industry. Li Kang also mentioned the revolutionary feature of transparency in the Web3 field. The entire ecosystem can reduce security risks through public and transparent measures, such as asset management solutions. At the event, leaders from the Hong Kong Investment Promotion Agency, OKLink, and BlockSec shared their related work and latest developments in Web3 security construction. For example, CertiK and OKLink have received responses from multiple exchanges in asset tracking locking and data labeling. Finally, Li Kang hopes to further strengthen Hong Kong's position as a Web3 innovation gateway in the rapidly growing Asia-Pacific region through this sharing, and jointly promote the safe application and landing of Web3 technology.
Daily Must-Read
-
Uniswap Labs, UNI holders could make $468M a year from new L2: DeFi Report
-
Avalanche Foundation to buy back nearly 2M AVAX sold to Terra in 2022
-
Gold Fever Hits Costco: 77% of Stores Sell Out Amid Soaring Demand for Bullion
-
$500M Bitcoin Buried in Landfill: Man Sues City After Decade-Long Battle for Recovery
-
Former BAYC creative director Jeff Nicholas joins Meta’s Reality Labs
-
Why is Solana's Dogwifhat (WIF) memecoin crashing?
All Comments