Key takeaways:
Binance's risk control team has implemented rigorous measures to protect user accounts from any compromise attempts, including optimizing the frequency of cookie logouts and adding verification steps in the event of abnormal transactions. These measures could help convey critical warnings and protect user funds.
Our security experts also recommend that users take several proactive measures that can prevent them from falling victim to malicious browser plug-ins. Internet users should avoid installing third-party plug-ins in their browsers, promptly log out of apps and extensions that have access to their funds and financial accounts, and use the official Binance app and website.
Binance also encourages the community to participate in our bug bounty program, which uses crowdsourcing and a rewards system to quickly report potential threats.
Browser plug-ins are frequently used to improve the online browsing experience, streamline workflows, and add functionality to web crawling. Not all of these plug-ins are safe, however: some of them are used as weapons by criminals and pose significant security risks. This article analyzes the potential dangers of malicious browser plug-ins and provides the community with tips to protect themselves against such attacks.
The hidden dangers of browser plug-ins
Also known as extensions or add-ons, web browser plug-ins are programs designed to be integrated into web browsers to provide additional functionality. While many of these are legitimate and useful, others can be malicious, including:
Stealing sensitive information. Some plug-ins are capable of capturing keystrokes, tracking browsing activity, and stealing user login information.
Injecting malicious code. Extensions can inject malicious scripts into web pages in order to launch a phishing attack or install malware.
Hijacking sessions. Malicious add-ons can hijack people's login sessions, allowing attackers to access accounts as if they were the real owners.
Falsifying the address. Malicious extensions can read clipboard contents and replace them, which can alter deposit/withdrawal addresses on Binance or other financial platforms and services, sometimes leading to loss of funds.
Risk control: an eternal chase
Risk control measures are always about finding the right balance between safety and convenience. Measures that are too lax can put user assets at risk, while processes that are too strict can harm their experience. Thus, risk control is a kind of eternal chase that juggles offensive and defensive measures, where security tactics are constantly revised in response to evolving threats. Given the risks posed by malicious browser attacks, Binance's risk control team has taken steps to further protect users. Here they are :
Increased frequency of cookie logout and verification steps: The team adjusts the frequency of cookie logout based on actions taken by users in a specific context, increases the frequency of verification of plugin operations and cookie permissions, and adds necessary security verification steps based on specific situations and user profiles.
Double confirmation for sudden price fluctuations: Double confirmation is implemented using big data-based alerts, and manual verification is requested in case of sudden price fluctuations.
Added 2FA verification to risk control rules: transactions that appear abnormal trigger two-factor authentication before processing.
How to protect yourself from fake apps?
As the crypto industry evolves, scams and hacking techniques are becoming more and more sophisticated. Users must constantly inform themselves about security issues and remain vigilant in the face of security threats that emerge and renew day after day. To avoid dangerous extensions, we advise users to take the following measures:
Limit the use of plug-ins. Install only absolutely necessary and reliable add-ons, because the more you download, the more likely you are to find one that will be harmful to you.
Check plugins. Before installing an extension, find out more about it by reading other users' reviews, learning about the developers, and asking permissions. Do not grant unnecessary access permissions.
Review plugins regularly. Review your plugins regularly and remove those you no longer use to reduce windows of potential attack.
Keep software up to date. Make sure your browser and all its add-ons are up to date: Developers frequently release updates to fix security vulnerabilities.
Use security tools. Use antivirus and anti-malware tools to detect and prevent activities that threaten your security.
Isolate profiles. Create a separate user profile in your browser that will only be used to log into DApps, and do not install any plugins on this profile.
Log out immediately. Remember to log out of any money management apps and websites immediately after use: don't leave cookies active just because you don't want to re-enter your password.
Take advantage of private browsing. Open your websites in private browsing mode and disable all add-ons.
Strengthen confidentiality on financial applications. Use a specific device to carry out your financial transactions.
Adjust application settings. Configure your financial applications to log you out after a few minutes of inactivity. (Many traditional banking apps already do this.)
Binance’s bug bounty program
Binance launched its bug bounty program in March 2019, which uses external participation to detect threats early and rewards its participants. This program has proven to be extremely useful in improving the security systems of the Binance platform, and the analysis of the main causes of the vulnerabilities thus identified helps us to avoid the appearance of similar risks in other existing or developing products. development course. Any incident helps improve Binance’s risk control and security.
Binance’s commitment to user security remains unwavering. Security and risk control measures on platforms are eternal battles, requiring substantial and ongoing investments; As an industry leader, Binance will continue to develop and improve security tools and defense measures to protect users and their assets.
For more information
The Binance Antidote: Protecting Users from Address Poisoning
Crypto Security Insights: Identifying and Avoiding Fake Binance Launchpool Tokens
Compromised X accounts in the crypto sector: implications for individuals, but also for the sector
