Liminal blames compromised WazirX devices for hack, claims UI not responsible

Cointelegraph · 2024-07-19T18:10:13.000Z

Multi-party computation (MPC) wallet provider Liminal released a July 19 post-mortem report on the WazirX hack from the previous day, claiming that its UI was not responsible for the attack. According to the report, the hack occurred because three WazirX devices were compromised. Liminal also claimed that its multi-signature wallet was set up to provide a fourth signature if WazirX provided the other three. This meant the attacker only needed to compromise three devices to perform the attack. The wallet was set up this way at the behest of WazirX, the wallet provider claimed. In a July 18 social media post, WazirX claimed that its private keys were secured with hardware wallets. WazirX said the attack “stemmed from a discrepancy between the data displayed on Liminal's interface and the transaction's actual contents.” According to the Liminal report, one of WazirX’s devices initiated a valid transaction involving the Gala Games (GALA) token. In response, Liminal’s server provided a “safeTxHash,” verifying the transaction’s validity. However, the attacker then replaced this transaction hash with an invalid one, causing the transaction to fail. In Liminal’s view, the fact that the attacker was able to change this hash implies that WazirX’s device had already been compromised before the transaction was attempted. The attacker then initiated an additional two transactions; one GALA and one Tether (USDT) transfer. In each of these three transactions, the attacker used a different WazirX admin account, for a total of three accounts used. All three of the transactions failed. Failed WazirX USDT transaction. Source: Liminal, Etherscan After initiating these three failed transactions, the attacker extracted signatures from the transactions and used them to initiate a new, fourth transaction. The fourth transaction “was crafted in such a way that the fields used to verify policies were using legit transaction details” and “used the Nonce from the failed USDT transaction because that was the latest transaction.” Because it used these “legit transaction details,” the Liminal server approved the transaction and provided a fourth signature. As a result, the transaction was confirmed on the Ethereum network, resulting in a transfer of funds from the joint multisig wallet to the attacker’s Ethereum account. Liminal denied that its servers caused incorrect information to be displayed through the Liminal UI. Instead, it claimed that the incorrect information was provided by the attacker, who had compromised WazirX computers. In an answer to the posed question, “How did the UI show a different value from the actual payload within the transaction?” Liminal said: “Based on our logs, given that three devices of the victim’s shared transactions sent out malicious payloads to Liminal’s server, we have reason to believe that the local machines were compromised giving the attacker complete access to modify the payloads and display misleading transaction details on the UI.” Liminal also claimed that its servers were programmed to automatically provide a fourth signature if WazirX admins provided the other three. “Liminal only provides the final signature once the required number of valid signatures are received from the client’s side,” it stated, adding that in this case “the transaction was authorised and signed by three of our client’s employees.” The multisig wallet “was deployed by WazirX as per their configuration well before onboarding with Liminal,” and was “imported” into Liminal “per WazirX’s request.” Related: WazirX breach post-mortem: Dismantling the $230M attack WazirX’s post claimed that it had implemented “robust security features.” For example, it had required that all transactions be confirmed by four out of five keyholders. Four of these keys belonged to WazirX employees and one to the Liminal team. In addition, it required three of the WazirX keyholders to use hardware wallets. All destination addresses were required to be added to a whitelist ahead of time, WazirX stated, which was “earmarked and facilitated on the interface by Liminal.” Despite taking all of these precautions, the attacker “appear[s] to have possibly breached such security features, and the theft occurred.” WazirX called the attack a “a force majeure event beyond [its] control.” Even so, it vowed that it was “leaving no stone unturned to locate and recover the funds.” An estimated $235 million was lost in the WazirX attack. It was the largest centralized exchange hack since the DMM exploit of May 31, which resulted in even greater losses of $305 million. Magazine: WazirX hackers prepped 8 days before attack, swindlers fake fiat for USDT: Asia Express

多方计算 (MPC) 钱包提供商 Liminal 于 7 月 19 日发布了关于前一天 WazirX 黑客攻击的事后分析报告，声称其 UI 对此次攻击不负责任。根据该报告，此次黑客攻击是因为三台 WazirX 设备遭到入侵。
Liminal 还声称，如果 WazirX 提供其他三个签名，其多重签名钱包就会提供第四个签名。这意味着攻击者只需入侵三台设备即可发起攻击。钱包提供商声称，钱包是按照 WazirX 的要求设置的。
WazirX 在 7 月 18 日的社交媒体帖子中声称其私钥由硬件钱包保护。WazirX 表示，此次攻击“源于 Liminal 界面上显示的数据与交易的实际内容之间的差异。”
根据 Liminal 的报告，WazirX 的一台设备发起了一项涉及 Gala Games (GALA) 代币的有效交易。作为响应，Liminal 的服务器提供了一个“safeTxHash”，以验证交易的有效性。然而，攻击者随后用无效的交易哈希替换了此交易哈希，导致交易失败。
在 Liminal 看来，攻击者能够更改此哈希值这一事实意味着 WazirX 的设备在尝试交易之前就已经受到了损害。
随后，攻击者又发起了另外两笔交易：一笔 GALA 转账和一笔 Tether (USDT) 转账。在这三笔交易中，攻击者使用了不同的 WazirX 管理员账户，总共使用了三个账户。三笔交易均失败。
在发起这三笔失败的交易后，攻击者从交易中提取签名，并使用它们发起新的第四笔交易。第四笔交易“经过精心设计，用于验证策略的字段使用了合法的交易详细信息”，并且“使用了失败的 USDT 交易中的 Nonce，因为那是最新的交易。”
由于使用了这些“合法交易详细信息”，Liminal 服务器批准了该交易并提供了第四个签名。因此，该交易在以太坊网络上得到确认，资金从联合多重签名钱包转移到攻击者的以太坊账户。
Liminal 否认其服务器导致 Liminal UI 中显示错误信息。相反，它声称错误信息是由攻击者提供的，攻击者入侵了 WazirX 计算机。在回答提出的问题“UI 中显示的值与交易中的实际有效负载有何不同？”时，Liminal 表示：
“根据我们的日志，鉴于受害者共享交易的三台设备向 Liminal 的服务器发送了恶意负载，我们有理由相信本地机器已被入侵，从而使攻击者可以完全访问并修改负载并在 UI 上显示误导性交易详细信息。”
Liminal 还声称，如果 WazirX 管理员提供了另外三个签名，其服务器就会自动提供第四个签名。该公司表示：“只有在从客户端收到所需数量的有效签名后，Liminal 才会提供最后一个签名。”并补充说，在这种情况下，“交易得到了我们客户三名员工的授权和签名。”
该多重签名钱包“由 WazirX 在与 Liminal 合作之前就根据其配置进行了部署”，并“根据 WazirX 的要求”被“导入”到 Liminal 中。
相关：WazirX 攻击事件后分析：揭秘这起 2.3 亿美元攻击事件
WazirX 的帖子声称它已经实施了“强大的安全功能”。例如，它要求所有交易都由五分之四的密钥持有者确认。其中四个密钥属于 WazirX 员工，一个属于 Liminal 团队。此外，它还要求三个 WazirX 密钥持有者使用硬件钱包。WazirX 表示，所有目的地地址都必须提前添加到白名单中，该白名单“由 Liminal 在界面上指定和提供”。
尽管采取了所有这些预防措施，但攻击者“似乎可能已经突破了这些安全功能，并发生了盗窃事件。” WazirX 称这次攻击是“无法控制的不可抗力事件”。 即便如此，它发誓要“尽一切努力找到并追回资金”。
据估计，WazirX 攻击事件造成 2.35 亿美元的损失。这是自 5 月 31 日 DMM 攻击事件以来最大的中心化交易所黑客攻击事件，DMM 攻击事件造成的损失高达 3.05 亿美元。
杂志：WazirX 黑客在攻击前 8 天做好准备，骗子伪造法定货币换取 USDT：亚洲快报

创作者的更多内容

实时新闻

创作者的更多内容

实时新闻

热门文章