与「Attackers」相关的搜索结果

Last night Apple briefly removed Telegram from the AppStore because a user had planted illegal porn in a public chat. Telegram was restored within hours. But I want to explain what happened — to warn other app developers and help protect online communities from similar attacks. Because Telegram quickly removes illegal content from public groups using all kinds of moderation tools, the attacker had to resort to a technical trick. He inserted AI-modified illegal content by editing an old message in an active group chat. As a result the content was effectively hidden from the group’s members, preventing them from seeing/reporting it. The attacker was a takedown extortionist: someone who demands ransom from group owners in exchange for not targeting their communities. These extortionists use automated accounts to plant illegal content in public groups and then report it directly to Apple, attempting to trigger the removal of legitimate communities whose owners refused to pay them. From a practical standpoint, illegal pornographic content in Telegram’s public groups is not a systemic problem. Our moderation is effective. The fact that attackers must resort to backdated, effectively invisible content and other technical tricks proves this. ⚠️ However, there are two important lessons here for app developers and online communities: — Extortionists have found a way to manipulate Apple into overreacting. Apple removed Telegram from the App Store before contacting us. This creates a potential systemic risk for every mobile app that hosts user-generated content. If an app used by more than a billion people can be removed from the App Store without prior warning, any app can be. — The tactics used by takedown extortionists are evolving, putting communities across social platforms at risk. Telegram has extensive experience identifying the tricks used by coordinated reporting gangs and protecting legitimate communities (even when doing so risks our own app being temporarily removed from the App Store). Other platforms may not be equally prepared. Stay vigilant! ☝️

🚨SlowMist TI Alert🚨 💸 @LienFinance Loss: ~542k USD 🔍 Root Cause: The `exchangeEquivalentBonds` function in BondMakerCollateralizedEth lacks proper multiset integrity checks. It only counts total exception occurrences instead of verifying each bondID's appearance per group. By repeating a single exception bondID in the output group, attackers consumed the exception count twice, masking a missing input exception. This allowed minting new non-exception BondTokens without burning the corresponding input bonds, which were then sold for USDC from a pre-approved victim address. 📌 Attacker: 0x0d7d9023531ad1a88414e216ee2715f63561808a 📌 Victim: 0xa961684a3a654fb2cca8f8991226c0cefc514d80 📌 Vulnerable Contract: 0xda6fc5625e617bb92f5359921d43321cebc6bef0, 0x843225cf6e663e4454732d6b551a737ac7b47de0 Attackers exploited the flawed exception-counting logic to mint unbacked bond tokens, swapped them for USDC via three pre-authorized endpoints, and drained 542,144.628604 USDC from the victim. Powered by Tx:

⚠️HACKS GALORE: Three exploits drain $35.5 Million within hours in a brutal day for DeFi. - AFX Trade- $24.15M hack The AFX-operated USDC custody bridge on Arbitrum was exploited, forcing the team to suspend bridge operations. - Verus - $7.55M hack The Verus Ethereum Bridge was exploited after an attacker abused the bridge's import mechanism to trigger unbacked payouts, marking the second exploit using the same failure mode since May. - B² Network $3.86M hack Attackers gained unauthorized access to the $B2 staking contract's upgrade authority, prompting the team to suspend staking while security reviews are completed. The issue has since been contained, with no further impact expected.

You can’t call a product secure without a way to measure it. NEAR AI’s George Zeng on trusting agents that hold credentials and move value: formal verification for what the code does, adversarial benchmarks for how it holds up against attackers that constantly adapt.

🚨SlowMist TI Alert🚨 💸 @42dao_official Loss: ~ 912k USD 🔍 Root Cause: Attackers exploited an abnormally low BTCB oracle price from Median Oracle via Spotter `poke` and Dog `bark`. The spotter lacked price deviation checks, max drawdown limits, and minimum price protections, allowing immediate write of the low spot into Vat. The dog module then used this updated spot without any liquidation delay or oracle price validation, enabling instant liquidation of multiple BTCB vaults. 📌 Attacker: 0x9d8dd9f2d734675e2bfcc142d1c7a45609ca213c 📌 Victim: 0x973a722fd8bcd4b81f4c5c1ac687073e44aa9a0c 📌 Vulnerable Contract: 0x849dc2416cbe54995a1d725afe526c0e38829228 (Spotter) & 0x00101ae4467d72e83ef68df447c41de0c71f634e (Dog) Impact: A single-transaction combo exploited the missing price protection and liquidation delay in Maker-style system, allowing an attacker to liquidate multiple BTCB vaults using an abnormally low oracle price and profit from the arbitrage. Powered by Tx:

🚨 Threat Intelligence | On-Chain Backdoor in a Malicious TRAE Extension Following @Will42W’s warning about TRAE IDE extension supply chain risks, SlowMist investigated the malicious extension juannegro.solidity. Although removed from Open VSX, the extension was still available through the TRAE marketplace as of July 18, 2026. It impersonated a legitimate Solidity plugin and acted as a cross-platform malware dropper. Our analysis found that it: 🔹 Impersonates a legitimate Solidity extension and uses the marketplace as the initial malware delivery channel 🔹 Automatically executes after IDE startup and establishes persistence across platforms 🔹 Uses an Ethereum smart contract to store and retrieve dynamic C2 configurations 🔹 Allows attackers to update C2 endpoints and payload delivery without republishing the extension This incident highlights how extension marketplaces can become initial infection vectors, while blockchain infrastructure can be abused for dynamic C2 management. Users who installed juannegro.solidity should remove the extension and check their systems for potential compromise. Full analysis👇

Previously, we analyzed Grok CLI’s data upload behavior and found that its repository upload mechanism could send git bundles containing sensitive files such as .env files and RSA private keys. Following that analysis, we continued auditing Grok Build CLI’s security model after it was open-sourced. Within 24 hours, we identified two attack chains that can lead to arbitrary code execution without explicit user approval. The root cause is not a single bug, but a fragmented trust model: project-level files can influence AI Agent instructions and permission decisions without sufficient validation. Key findings: 🔹 cargo check was incorrectly classified as a safe command. Combined with malicious AGENTS.md instructions, attackers can trigger execution and achieve code execution. 🔹 .claude/settings.json with bypassPermissions can override permission checks and enable unrestricted tool execution. 🔹 Grok Build CLI inherits Claude Code CLI’s permission configuration model, exposing similar risks. 🔹 .mcp.json introduces additional project-level attack surfaces through MCP configuration. These findings highlight a broader issue: When #AI# coding agents trust project-level files too much, opening a project can become equivalent to granting shell access. 📖 Full technical analysis: 👉 Previous analysis:

This claim by @brian_armstrong misses a few fundamental realities of cybersecurity: The Asymmetry: Defenders must secure 100% of the code, but attackers only need to find one single loophole. AI is Probabilistic: AI isn't a mathematical proof; it can't guarantee zero vulnerabilities. False Negatives: AI might be great at catching known bugs (Type 1 errors), but it will inevitably miss novel or complex exploits (Type 2 errors). Because AI likely will always miss something, the dynamic definitely still favors the attackers.