News 'Critical' Vulnerability in Beam Wallet Could Have Put Funds...

‘Critical’ Vulnerability in Beam Wallet Could Have Put Funds At Risk, Devs Say After Fix

-

- Advertisment -

Developers behind the privacy-focused cryptocurrency Beam have revealed that the “critical” bug discovered and subsequently fixed in their wallet software last week could have put user funds directly at risk.

As stated in a Medium post published today, the vulnerability would have allowed an attacker to create “modified transactions” and subsequently send funds directly into the attacker’s wallet.

In an exclusive interview with CoinDesk, Beam CTO Alex Romanov explained that by leveraging Beam’s Secure Bulletin Board System (SBBS) – a custom-built system to enable offline encrypted messaging between Beam wallets – attackers “currently listening in on active SBBS addresses … would be able to cause these wallets to send money to an attacker.”

Romanov stressed that the issue was application-specific and in no way related to the privacy-enhancing technology mimblewimble, saying:

“The vulnerability is not related to mimblewimble or cryptography or any underlying technology. Basically, it’s a bug in the application itself … It just affected the wallets because it would be possible to create this specific transaction.”

And though the existence of the vulnerability was disclosed to the public the same day it was found by Beam’s internal development team, the exact nature of the threat was not made public until today.

The reason for this according to Romanov was to prevent opening up any “possible attack vectors” for users who had not seen the announcement of the vulnerability last Wednesday.

Elaborating that people are “not online all the time, sometimes there are time differences, people may be asleep,” Romanov told CoinDesk that withholding further details was a way to buy time for users “especially pools and exchanges” to implement the code fix.

Speaking to the issued patch, Romanov explained that the fix was relatively simple.

“We have just prevented this specific scenario in which this custom transaction would have been accepted by a running wallet and that’s it,” said Romanov to CoinDesk.

The next upgrade

Beam officially launched on Thursday, January 3. Since that point, Romanov said that feedback from users is already being worked into a new upgrade for the Beam software currently being tested and set for release “in the next couple days.”

“We have taken into consideration all the issues raised by users, all the requests, all the misunderstanding that in retrospect was pretty obvious because mimblewimble is a very new technology … and we have created an update which will improve the user experience,” said Romanov.

Calling it version 1.0.1, Romanov highlighted that use of Beam systems as a result of mimblewimble has caused “pools and also exchanges to significantly modify the way they operate and the way they handle transactions.”

“There were a lot of learning curves from all sides … [The update] will reduce the amount of potential misunderstandings or problems. Sometimes, even though the system functions properly, it’s not clear for the [user] what is happening,” Romanov told CoinDesk:

Wallet image via Shutterstock

This article and its headline have been updated for clarity.

Source link

LEAVE A REPLY

Please enter your comment!
Please enter your name here

Latest news

GoCrypto presents truly contactless payments with a simple solution for merchants and buyers

7 April 2020 — The recent events have rapidly changed the way we live, including our shopping...

Bitcoin SV has found a new niche in the gaming industry

Gaming companies and online casinos are increasingly paying attention to cryptocurrencies as a possible payment tool. Several...

Why could GLBrain become a great solution to receive support during the crisis?

To support smaller and medium-sized businesses during the ongoing crisis, GLBrain offers services cost-free for all Austrians....

Make Fast and Secure Trades Using Bitengo.io

Bitengo.io is a Cryptocurrency trading platform that allows users to buy and sell their Cryptocurrency in a...
- Advertisement -'Critical' Vulnerability in Beam Wallet Could Have Put Funds At Risk, Devs Say After Fix

Network Security Using Cryptography: Everything you need to know

This article will describe what is Network Security Using Cryptography and everything you need to know before...

Mercuriex Cryptocurrency Exchange Launches New Utility Token, SURF

MercuriEx Cryptocurrency Exchange, originally developed in 2017, came under new ownership in December 2019. Since taking over the exchange,...

Must read

- Advertisement -

You might also likeRELATED
Recommended to you