Thread by @HalbornSecurity

🚨 Halborn discovered massive #ZeroDay impacting Dogecoin and 280+ networks including Litecoin and Zcash, putting over $25 Billion of digital assets at risk!

🧵👇...

1/ In March 2022, Halborn started to evaluate #dogecoin under a contract and found several vulnerabilities which were fixed by the Dogecoin team.

2/ During the assessment, it was found that the same vulns affected over 280 other networks including #litecoin and #zcash, which have since then been addressed and patched.

3/ The most critical vulnerability discovered is related to peer-to-peer (p2p) communications where attackers can craft consensus messages and send it to individual nodes, taking them offline.

Halborn researchers, led by @safe_buffer, have code-named this vulnerability #Rab13s.

4/ Another zero-day identified by Halborn was uniquely related to #Dogecoin, including an RPC vulnerability impacting individual miners.

Subsequently, variants of these 0-days were also discovered in similar blockchain networks potentially leading to DoS or RCE attacks.

5/ A good faith effort has been made to contact the affected networks for a responsible disclosure. However, all affected networks are encouraged to contact Halborn on [e-mail]

6/ 🤔 What are the consequences?

👉 Firstly, vulnerabilities were found in the p2p messaging mechanisms. Malicious consensus messages can be sent to each node, causing them to shut down and exposing the network to severe risks like 51% attacks.

7/ 👉 Secondly, attackers can execute code through the public interface (RPC) as a normal node user. Since a valid credential is required to carry out the attack, the likelihood of this exploit is lower.

8/ Remediation👇
Halborn recommends upgrading all UTXO-based nodes (e.g. Dogecoin) to the latest version (1.14.6).
Considering the severity of the issue, Halborn will not release the technical details or exploit details at this time.

9/ Keep an eye on our blog and follow us on Twitter (@HalbornSecurity) for the latest updates.
halborn.com/blog/post/halb…