More than 280 blockchains are at risk of “zero-day” exploits, security firm warns
280 or more blockchain networks are estimated to be at risk of “zero-day” exploits that could put at least $25 billion worth of crypto at risk, according to cybersecurity firm Halborn.
In a March 13 blog, Halborn warned of the vulnerability it dubbed “Rab13s” — adding that it has already worked with some blockchains, such as Dogecoin, Litecoin and Zcash, to find a solution to it.
Halborn discovered massive #ZeroDay affecting Dogecoin and 280+ networks, including Litecoin and Zcash, putting over $25 billion worth of digital assets at risk!
…
— Halborn (@HalbornSecurity) March 13, 2023
Halborn was contracted by Dogecoin in March 2022 to conduct a security review of its codebase and found “several critical and exploitable vulnerabilities.”
It later determined that the same vulnerabilities “affected over 280 other networks” that risked billions of dollars worth of cryptocurrencies.
Halborn outlined three vulnerabilities, the “most critical” of which allows an attacker to “send malicious consensus messages to individual nodes, causing each to shut down.”
3/ The most critical vulnerability discovered is related to peer-to-peer (p2p) communication where attackers can create consensus messages and send them to individual nodes, taking them offline.
Halborn researchers, led by @safe_buffercodenamed this vulnerability #Rab13p.
— Halborn (@HalbornSecurity) March 13, 2023
It added that these messages over time could expose the blockchain to a 51% attack where an attacker controls the majority of the network’s mining hash rate or staked tokens to create a new version of the blockchain or take it offline.
Other zero-day vulnerabilities it found would allow potential attackers to crash blockchain nodes by sending Remote Procedure Call (RPC) requests – a protocol that allows one program to communicate and request services from another.
7/ Second, attackers can run code through the public interface (RPC) as a normal node user. Since a valid credential is required to perform the attack, the probability of this exploit is lower.
— Halborn (@HalbornSecurity) March 13, 2023
It added that the probability of RPC-related exploits was lower as it requires valid credentials to carry out the attack.
“Due to code base differences between the networks, not all vulnerabilities can be exploited on all networks, but at least one of them can be exploited on each network,” Halborn warned.
Related: Jump Crypto and Oasis.app ‘counter exploits’ Wormhole hack for $225M
The firm said it is not currently releasing further technical details about the exploits due to their severity, adding that it made a “good faith effort” to contact all affected parties to disclose potential exploits and provide remediation for the vulnerabilities.
Dogecoin, Zcash and Litecoin have already implemented patches for the discovered vulnerabilities, but hundreds may still be exposed according to Halborn.
