InfectedCrypto (@InfectedCrypto)

Always important to remember

Adevar Labs - Security Audits Verified account @AdevarLabs 2d

In London for Solana Breakpoint? Here's your IRL security checklist. 🇬🇧

🟢 Phone stays in your pocket on the street along with your hands. Try your best to only unlock it indoors.

🟢 Before you fly: turn on Stolen Device Protection (iPhone) or theft protection (Android), set a long alphanumeric passcode, add a PIN to your carrier account, and use an authenticator app instead of SMS.

🟢 Hardware wallet stays home. Badge off once you leave Olympia.

🟢 Never say what you hold or where you keep it. Bars are loud, and the table next to you still hears.

🟢 Post after you leave. Live location, hotel views and badge photos tell people where you are and what you carry.

🟢 Bring your own charger and battery. Skip hotel and public USB ports. Malware can be hidden in something as basic as a USB cable.

🟢 Schedules should come from the official site only. No PDFs by DM, no random QR codes, and no RSVP that asks for a wallet signature.

Send this to the friend who clicks everything 🫡

View quoted post on X

InfectedCrypto @InfectedCrypto Nov 5

Nice backdoor

But also more seriously, if you're running alpine linux update your system asap

International Cyber Digest Verified account @IntCyberDigest Nov 5

The bug is like a joke.

On Alpine Linux, type 257 to 1024 characters of anything and you get root. 💀

View quoted post on X

InfectedCrypto @InfectedCrypto Oct 22

Simple invariant + powerful fuzzer → cool finding
(1) While the hard part we all know is to come up with nice invariants
(2) The other hard part is to set up an efficient fuzzing env (otherwise this might take too long to hit a violation)
Crucible does (2) for you

Adevar Labs - Security Audits Verified account @AdevarLabs Oct 21

Pricing vault shares in more than one place?

Our latest blog post by @arsen_bt is worth the read. 👇

🟢 A swap that priced fee shares against the wrong supply, so the fee recipient got 21 shares when about 32 were due
🟢 The one fuzz property that caught it, and the fix
🟢 How we scale the same harness to 2,000 cores

Ship Safely. 🚀
adevarlabs.com/blog/fuzzing-a…
View quoted post on X

InfectedCrypto @InfectedCrypto Oct 12

Durable nonce will be deprecated soon and replaced by onchain signature verification
I guess the Drift hack accelerated this decision

Jonas Hahn Verified account @SolPlay_jonas Oct 12

Durable Nonces will be deprecated next year!

It will move out of the protocol and into onchain programs.

Now is the time to try out the new solutions and give feedback to make the tooling around it great for the migration period.

Everything you need to know in the deprecation guide:
solana.com/upgrades/durab…
View quoted post on X

InfectedCrypto @InfectedCrypto Oct 10

Regarding the recent Ledger incident.
Attackers worked around the secure element by reading the screen data directly, which shows the seed phrase when setting the ledger, and sending it over LTE later on.
The hardest part here is obviously the supply chain attack, but still.

Mark Karpelès Verified account @MagicalTux Oct 9

@zherbert @forwardsecrecy The implant is just listening to whatever is on the screen. It doesn't touch anything else, so the secure element has no idea it's showing your new seed not only to you but to some extra piece of hardware which is just waiting for that before transmitting it over LTE.
View quoted post on X

InfectedCrypto

Latest posts 5