Các Ứng Dụng Crypto Bị Tấn Công Bằng Cửa Sổ Bật Lên Độc Hại Sau Khi Thư Viện Hoạt Hình Phổ Biến Bị Hack
Một lỗ hổng trong thư viện hoạt hình Lottie Player được sử dụng rộng rãi đã dẫn đến việc tiêm cửa sổ bật lên rút tiền crypto trên nhiều ứng dụng crypto, hiện đã được giải quyết.
["V\u00e0o ng\u00e0y 30 th\u00e1ng 10, c\u00e1c trang web giao di\u1ec7n ng\u01b0\u1eddi d\u00f9ng c\u1ee7a nhi\u1ec1u \u1ee9ng d\u1ee5ng crypto tr\u1ef1c tuy\u1ebfn \u0111\u00e3 b\u1ecb x\u00e2m nh\u1eadp sau khi c\u00e1c tin t\u1eb7c ti\u00eam m\u00e3 \u0111\u1ed9c v\u00e0o b\u1ea3n c\u1eadp nh\u1eadt c\u1ee7a th\u01b0 vi\u1ec7n ho\u1ea1t h\u00ecnh Lottie Player \u0111\u01b0\u1ee3c s\u1eed d\u1ee5ng r\u1ed9ng r\u00e3i.<\/p>","
C\u00e1c \u1ee9ng d\u1ee5ng t\u00e0i ch\u00ednh phi t\u1eadp trung, bao g\u1ed3m 1inch v\u00e0 TEN Finance, \u0111\u00e3 hi\u1ec3n th\u1ecb c\u00e1c c\u1eeda s\u1ed5 b\u1eadt l\u00ean y\u00eau c\u1ea7u ng\u01b0\u1eddi d\u00f9ng k\u1ebft n\u1ed1i v\u00ed c\u1ee7a h\u1ecd. Nh\u1eefng c\u1eeda s\u1ed5 n\u00e0y \u0111\u01b0\u1ee3c li\u00ean k\u1ebft v\u1edbi ph\u1ea7n m\u1ec1m r\u00fat ti\u1ec1n crypto \u0111\u01b0\u1ee3c bi\u1ebft \u0111\u1ebfn l\u00e0 'Ace Drainer,' theo th\u00f4ng b\u00e1o t\u1eeb n\u1ec1n t\u1ea3ng b\u1ea3o m\u1eadt crypto Blockaid.<\/p>","
Gal Nagli, ng\u01b0\u1eddi \u0111\u1ee9ng \u0111\u1ea7u b\u1ea3o m\u1eadt t\u1ea1i c\u00f4ng ty an ninh m\u1ea1ng Wiz, \u0111\u00e3 m\u00f4 t\u1ea3 s\u1ef1 c\u1ed1 n\u00e0y l\u00e0 m\u1ed9t 'cu\u1ed9c t\u1ea5n c\u00f4ng chu\u1ed7i cung \u1ee9ng l\u1edbn' v\u00e0o th\u01b0 vi\u1ec7n Lottie Player. Th\u01b0 vi\u1ec7n n\u00e0y n\u1ed5i ti\u1ebfng v\u1edbi vi\u1ec7c cung c\u1ea5p ho\u1ea1t h\u00ecnh cho nhi\u1ec1u trang web v\u00e0 \u1ee9ng d\u1ee5ng, v\u1edbi c\u00e1c kh\u00e1ch h\u00e0ng n\u1ed5i b\u1eadt nh\u01b0 Apple, Spotify v\u00e0 Disney.<\/p>"," Ngu\u1ed3n: Blockaid<\/em><\/p><\/figcaption><\/figure>"," Cu\u1ed9c t\u1ea5n c\u00f4ng n\u00e0y l\u00e0 \u0111\u1ed9c \u0111\u00e1o v\u00ec n\u00f3 \u0111\u00e3 gi\u1edbi thi\u1ec7u m\u1ed9t c\u1eeda s\u1ed5 b\u1eadt l\u00ean \u0111\u1ed9c h\u1ea1i v\u00e0o c\u00e1c trang web v\u1ed1n kh\u00f4ng b\u1ecb \u1ea3nh h\u01b0\u1edfng. Th\u00f4ng th\u01b0\u1eddng, c\u00e1c tin t\u1eb7c l\u1ee3i d\u1ee5ng c\u00e1c t\u00e0i kho\u1ea3n m\u1ea1ng x\u00e3 h\u1ed9i ph\u1ed5 bi\u1ebfn \u0111\u1ec3 \u0111\u00e1nh l\u1eeba ng\u01b0\u1eddi theo d\u00f5i nh\u1ea5p v\u00e0o c\u00e1c li\u00ean k\u1ebft l\u1eeba \u0111\u1ea3o tr\u00ean c\u00e1c trang web gi\u1ea3 m\u1ea1o.<\/p>"," Jawish Hameed, ph\u00f3 ch\u1ee7 t\u1ecbch k\u1ef9 thu\u1eadt t\u1ea1i LottieFiles, c\u00f4ng ty \u0111\u1ee9ng sau th\u01b0 vi\u1ec7n ho\u1ea1t h\u00ecnh, \u0111\u00e3 th\u00f4ng b\u00e1o tr\u00ean GitHub r\u1eb1ng c\u00e1c phi\u00ean b\u1ea3n b\u1ecb x\u00e2m nh\u1eadp c\u1ee7a th\u01b0 vi\u1ec7n \u0111\u00e3 \u0111\u01b0\u1ee3c g\u1ee1 b\u1ecf. \u00d4ng k\u00eau g\u1ecdi ng\u01b0\u1eddi d\u00f9ng c\u1eadp nh\u1eadt l\u00ean phi\u00ean b\u1ea3n m\u1edbi nh\u1ea5t.<\/p>"," Hameed c\u00f2n cho bi\u1ebft th\u00eam r\u1eb1ng c\u00e1c tin t\u1eb7c \u0111\u00e3 x\u00e2m nh\u1eadp t\u00e0i kho\u1ea3n GitHub c\u1ee7a m\u1ed9t k\u1ef9 s\u01b0 ph\u1ea7n m\u1ec1m c\u1ea5p cao t\u1ea1i LottieFiles, \u0111\u1ea9y ba b\u1ea3n c\u1eadp nh\u1eadt \u0111\u1ed9c h\u1ea1i trong v\u00f2ng ba gi\u1edd. \u00d4ng x\u00e1c nh\u1eadn r\u1eb1ng quy\u1ec1n truy c\u1eadp v\u00e0o t\u00e0i kho\u1ea3n b\u1ecb x\u00e2m nh\u1eadp \u0111\u00e3 b\u1ecb thu h\u1ed3i.<\/p>"," Gal Nagli t\u1eeb Wiz \u0111\u00e3 b\u00e1o c\u00e1o r\u1eb1ng ng\u01b0\u1eddi d\u00f9ng \u0111ang g\u1eb7p ph\u1ea3i c\u1eeda s\u1ed5 b\u1eadt l\u00ean k\u1ebft n\u1ed1i v\u00ed crypto \u0111\u1ed9c h\u1ea1i tr\u00ean nhi\u1ec1u trang web ph\u1ed5 bi\u1ebfn tr\u00ean internet.<\/p>"," Nagli g\u1ee3i \u00fd r\u1eb1ng m\u1ee5c ti\u00eau ch\u00ednh c\u1ee7a cu\u1ed9c t\u1ea5n c\u00f4ng c\u00f3 l\u1ebd l\u00e0 c\u00e1c trang web crypto l\u1edbn s\u1eed d\u1ee5ng th\u01b0 vi\u1ec7n n\u00e0y.<\/p>"," \u00d4ng c\u0169ng c\u1ea3nh b\u00e1o r\u1eb1ng c\u00e1c trang web v\u1eabn s\u1eed d\u1ee5ng c\u00e1c phi\u00ean b\u1ea3n th\u01b0 vi\u1ec7n b\u1ecb \u1ea3nh h\u01b0\u1edfng c\u00f3 th\u1ec3 v\u1eabn c\u00f2n d\u1ec5 b\u1ecb t\u1ed5n th\u01b0\u01a1ng, khuy\u00ean ng\u01b0\u1eddi d\u00f9ng ki\u1ec3m tra xem c\u00e1c trang web c\u00f3 \u0111ang ch\u1ea1y phi\u00ean b\u1ea3n 2.0.4 ho\u1eb7c phi\u00ean b\u1ea3n m\u1edbi nh\u1ea5t 2.0.8 hay kh\u00f4ng.<\/p>"," LottieFiles kh\u00f4ng tr\u1ea3 l\u1eddi ngay l\u1eadp t\u1ee9c y\u00eau c\u1ea7u b\u00ecnh lu\u1eadn.<\/p>"]
Theo Cointelegraph
Tin khác
