Connect with us

Years-Old Cybersecurity Vulnerably Exposed in Blockfolio

Years-Old Cybersecurity Vulnerably Exposed in Blockfolio

Published

on

Blockfolio, one of the most popular cryptocurrency portfolio tracking applications, could be a highly desirable target for hackers’ attacks.

As of April 22, there are approximately 5,400 cryptocurrencies being traded with a market value of $201 billion United States dollars. The 24-hour daily trading volume has recently been hovering around $100 billion, a key indicator of the sector’s ongoing growth and active investor participation.

It is a well-known fact that cryptocurrencies are among the most fickle assets available, making it virtually impossible to monitor their fluctuations on a continuous basis. Fortunately, we have seen a number of cryptocurrency portfolio trackers being developed and accepted into the market since 2017.

Cryptocurrency portfolios represent any set of investments held by traders across the different types of crypto assets. For instance, if an investor owns 10 tokens or coins, these collectively represent their investment portfolios. The portfolio reflects the style of the trader/investor, their risk tolerance and key elements of their market strategy.

Blockfolio’s rise to prominence

Ian Balina — the blockchain entrepreneur, investor, analyst and CEO of Tokenmetrics who has been very vocal about the economic impact of the COVID-19 pandemic on the cryptocurrency sector — made Blockfolio famous in 2017 when he posted his impressive Blockfolio screenshots on Instagram. Balina is a firm believer in the use of cryptocurrencies in a business context.

The Blockfolio application is among the longest-running tracking platforms and can be part of your personal accounting software tools, most of which today connect your bank accounts via an application programming interface, or API, synchronize your expenses and get you ready for tax time. It allows the user to enter an assortment of cryptocurrencies as well as the ability to add the price that they were originally bought for and/or sold at. The attractive user interface, coupled with its use by a number of leading influencers, made Blockfolio one of the most downloaded cryptocurrency apps in 2017.

Blockfolio has also in the past few months launched a feature called “Blockfolio Signal” — a feature it believes will serve as its main communication platform within the application. This feature offers additional notifications from the teams behind each of the assets that you hold in, or want to add to, your portfolio.

Another feature is its ability to set up multiple portfolios, which can be extremely useful with regard to the categorization of your investments and their individual tracking.

Blockfolio currently supports Binance, Bitfinex, Bittrex, Coinbase and Coinbase Pro, OKEx and Poloniex and has recently given its users the ability to import their existing crypto portfolios into TokenTax’s automated software in order to get ahead of the upcoming tax season. Blockfolio is also completely free to use, but Blockfolio’s founder said in a recent statement that it was planning to monetize the app in the near future around the Blockfolio Signal feature.

The Blockfolio platform has over 5 million active users that utilize it to manage their portfolios. There are more than 400 teams on Blockfolio Signal, which include team members and representatives from Monero (XMR), Dash, NEO, Ether (ETH), NEM, Zcash (ZEC) and the like. Blockfolio furthermore supports over 8,000 crypto assets and continuously collects data from upward of 300 exchanges in order to stay up to date with any price or market updates.

More on the Blockfolio vulnerability

A major security vulnerability was uncovered in Blockfolio’s source code recently. The vulnerability, which showed up in previous versions of the application, would have enabled a hacker to steal closed source code and possibly manipulate the data by introducing their own code in Blockfolio’s GitHub repository and eventually into the app itself.

After evaluating the security of the cryptocurrency platforms he used, Paul Litvak — a security researcher at cybersecurity firm Intezer — uncovered the weakness. Litvak has been interested in cryptocurrencies since 2017 when he developed trading bots, and Blockfolio had been his managing platform of choice until the recent discovery.

With more than 47 million blockchain wallet users out there at the moment, hackers have a vast pool of possible victims to target, which is the reason they are actively targeting cryptocurrency platforms. The code Litvak uncovered linked to the organization’s GitHub repository by using a series of constants including a filename and, most importantly, the GitHub key that allowed access to the repositories.

The app queried Blockfolio’s private GitHub repository, and that query led to an immediate download of Blockfolio’s FAQs directly from GitHub, a step that was probably put in place to save the company the effort of updating its applications every time it made a change.

However, the key Litvak discovered was troublesome, as it could access an entire GitHub repository and exploit it. He was interested to see if this hazard persisted, as the application was already several years old.

Blockfolio's vulnerable source code

According to GitHub, a "repo" provides direct access to both public and private repositories and involves, among other features, the ability to read and write code and commit statuses as well as organization projects.

To make matters worse, the uncovered vulnerability had been public for two years and still remained open. Litvak alerted Blockfolio about the vulnerability via social media, as Blockfolio does not make use of a bug bounty program to remove vulnerabilities.

Edward Moncada, Blockfolio’s co-founder and CEO, confirmed that the GitHub access token was erroneously left in the older versions of the codebase and that they revoked access to that specific key as soon as they were alerted to the vulnerability. Moncada stated that Blockfolio carried out an audit of its systems and that no changes had been made. Since the token provided access to code that was separate from the database where the user data was stored, no user data was at risk.

The token might have been able to allow someone to change the source code, but there are several internal procedures in place that are checked prior to releasing any changes or updates to the system, and as such, malicious code would not have been released to any of its users.

The views, thoughts and opinions expressed here are the author’s alone and do not necessarily reflect or represent the views and opinions of Cointelegraph.

Sam Bocetta is a freelance journalist specializing in United States diplomacy and national security, with an emphasis on technology trends in cyber warfare, cyber defense and cryptography. Previously, Sam was a contractor for the U.S. Department of Defense, working in partnership with architects and developers to mitigate controls for vulnerabilities identified across applications.

Read More

Continue Reading

Uncategorized

Southwest and United Airlines have bad news for passengers

Both airlines are facing the same problem, one that could lead to higher airfares and fewer flight options.

Published

on

Airlines operate in a market that's dictated by supply and demand: If more people want to fly a specific route than there are available seats, then tickets on those flights cost more.

That makes scheduling and predicting demand a huge part of maximizing revenue for airlines. There are, however, numerous factors that go into how airlines decide which flights to put on the schedule.

Related: Major airline faces Chapter 11 bankruptcy concerns

Every airport has only a certain number of gates, flight slots and runway capacity, limiting carriers' flexibility. That's why during times of high demand — like flights to Las Vegas during Super Bowl week — do not usually translate to airlines sending more planes to and from that destination.

Airlines generally do try to add capacity every year. That's become challenging as Boeing has struggled to keep up with demand for new airplanes. If you can't add airplanes, you can't grow your business. That's caused problems for the entire industry. 

Every airline retires planes each year. In general, those get replaced by newer, better models that offer more efficiency and, in most cases, better passenger amenities. 

If an airline can't get the planes it had hoped to add to its fleet in a given year, it can face capacity problems. And it's a problem that both Southwest Airlines (LUV) and United Airlines have addressed in a way that's inevitable but bad for passengers. 

Southwest Airlines has not been able to get the airplanes it had hoped to.

Image source: Kevin Dietsch/Getty Images

Southwest slows down its pilot hiring

In 2023, Southwest made a huge push to hire pilots. The airline lost thousands of pilots to retirement during the covid pandemic and it needed to replace them in order to build back to its 2019 capacity.

The airline successfully did that but will not continue that trend in 2024.

"Southwest plans to hire approximately 350 pilots this year, and no new-hire classes are scheduled after this month," Travel Weekly reported. "Last year, Southwest hired 1,916 pilots, according to pilot recruitment advisory firm Future & Active Pilot Advisors. The airline hired 1,140 pilots in 2022." 

The slowdown in hiring directly relates to the airline expecting to grow capacity only in the low-single-digits percent in 2024.

"Moving into 2024, there is continued uncertainty around the timing of expected Boeing deliveries and the certification of the Max 7 aircraft. Our fleet plans remain nimble and currently differs from our contractual order book with Boeing," Southwest Airlines Chief Financial Officer Tammy Romo said during the airline's fourth-quarter-earnings call

"We are planning for 79 aircraft deliveries this year and expect to retire roughly 45 700 and 4 800, resulting in a net expected increase of 30 aircraft this year."

That's very modest growth, which should not be enough of an increase in capacity to lower prices in any significant way.

United Airlines pauses pilot hiring

Boeing's  (BA)  struggles have had wide impact across the industry. United Airlines has also said it was going to pause hiring new pilots through the end of May.

United  (UAL)  Fight Operations Vice President Marc Champion explained the situation in a memo to the airline's staff.

"As you know, United has hundreds of new planes on order, and while we remain on path to be the fastest-growing airline in the industry, we just won't grow as fast as we thought we would in 2024 due to continued delays at Boeing," he said.

"For example, we had contractual deliveries for 80 Max 10s this year alone, but those aircraft aren't even certified yet, and it's impossible to know when they will arrive." 

That's another blow to consumers hoping that multiple major carriers would grow capacity, putting pressure on fares. Until Boeing can get back on track, it's unlikely that competition between the large airlines will lead to lower fares.  

In fact, it's possible that consumer demand will grow more than airline capacity which could push prices higher.

Related: Veteran fund manager picks favorite stocks for 2024

Read More

Continue Reading

Uncategorized

Simple blood test could predict risk of long-term COVID-19 lung problems

UVA Health researchers have discovered a potential way to predict which patients with severe COVID-19 are likely to recover well and which are likely to…

Published

on

UVA Health researchers have discovered a potential way to predict which patients with severe COVID-19 are likely to recover well and which are likely to suffer “long-haul” lung problems. That finding could help doctors better personalize treatments for individual patients.

Credit: UVA Health

UVA Health researchers have discovered a potential way to predict which patients with severe COVID-19 are likely to recover well and which are likely to suffer “long-haul” lung problems. That finding could help doctors better personalize treatments for individual patients.

UVA’s new research also alleviates concerns that severe COVID-19 could trigger relentless, ongoing lung scarring akin to the chronic lung disease known as idiopathic pulmonary fibrosis, the researchers report. That type of continuing lung damage would mean that patients’ ability to breathe would continue to worsen over time.

“We are excited to find that people with long-haul COVID have an immune system that is totally different from people who have lung scarring that doesn’t stop,” said researcher Catherine A. Bonham, MD, a pulmonary and critical care expert who serves as scientific director of UVA Health’s Interstitial Lung Disease Program. “This offers hope that even patients with the worst COVID do not have progressive scarring of the lung that leads to death.”

Long-Haul COVID-19

Up to 30% of patients hospitalized with severe COVID-19 continue to suffer persistent symptoms months after recovering from the virus. Many of these patients develop lung scarring – some early on in their hospitalization, and others within six months of their initial illness, prior research has found. Bonham and her collaborators wanted to better understand why this scarring occurs, to determine if it is similar to progressive pulmonary fibrosis and to see if there is a way to identify patients at risk.

To do this, the researchers followed 16 UVA Health patients who had survived severe COVID-19. Fourteen had been hospitalized and placed on a ventilator. All continued to have trouble breathing and suffered fatigue and abnormal lung function at their first outpatient checkup.

After six months, the researchers found that the patients could be divided into two groups: One group’s lung health improved, prompting the researchers to label them “early resolvers,” while the other group, dubbed “late resolvers,” continued to suffer lung problems and pulmonary fibrosis. 

Looking at blood samples taken before the patients’ recovery began to diverge, the UVA team found that the late resolvers had significantly fewer immune cells known as monocytes circulating in their blood. These white blood cells play a critical role in our ability to fend off disease, and the cells were abnormally depleted in patients who continued to suffer lung problems compared both to those who recovered and healthy control subjects. 

Further, the decrease in monocytes correlated with the severity of the patients’ ongoing symptoms. That suggests that doctors may be able to use a simple blood test to identify patients likely to become long-haulers — and to improve their care.

“About half of the patients we examined still had lingering, bothersome symptoms and abnormal tests after six months,” Bonham said. “We were able to detect differences in their blood from the first visit, with fewer blood monocytes mapping to lower lung function.”

The researchers also wanted to determine if severe COVID-19 could cause progressive lung scarring as in idiopathic pulmonary fibrosis. They found that the two conditions had very different effects on immune cells, suggesting that even when the symptoms were similar, the underlying causes were very different. This held true even in patients with the most persistent long-haul COVID-19 symptoms. “Idiopathic pulmonary fibrosis is progressive and kills patients within three to five years,” Bonham said. “It was a relief to see that all our COVID patients, even those with long-haul symptoms, were not similar.”

Because of the small numbers of participants in UVA’s study, and because they were mostly male (for easier comparison with IPF, a disease that strikes mostly men), the researchers say larger, multi-center studies are needed to bear out the findings. But they are hopeful that their new discovery will provide doctors a useful tool to identify COVID-19 patients at risk for long-haul lung problems and help guide them to recovery.

“We are only beginning to understand the biology of how the immune system impacts pulmonary fibrosis,” Bonham said. “My team and I were humbled and grateful to work with the outstanding patients who made this study possible.” 

Findings Published

The researchers have published their findings in the scientific journal Frontiers in Immunology. The research team consisted of Grace C. Bingham, Lyndsey M. Muehling, Chaofan Li, Yong Huang, Shwu-Fan Ma, Daniel Abebayehu, Imre Noth, Jie Sun, Judith A. Woodfolk, Thomas H. Barker and Bonham. Noth disclosed that he has received personal fees from Boehringer Ingelheim, Genentech and Confo unrelated to the research project. In addition, he has a patent pending related to idiopathic pulmonary fibrosis. Bonham and all other members of the research team had no financial conflicts to disclose.

The UVA research was supported by the National Institutes of Health, grants R21 AI160334 and U01 AI125056; NIH’s National Heart, Lung and Blood Institute, grants 5K23HL143135-04 and UG3HL145266; UVA’s Engineering in Medicine Seed Fund; the UVA Global Infectious Diseases Institute’s COVID-19 Rapid Response; a UVA Robert R. Wagner Fellowship; and a Sture G. Olsson Fellowship in Engineering.

  

To keep up with the latest medical research news from UVA, subscribe to the Making of Medicine blog at http://makingofmedicine.virginia.edu.


Read More

Continue Reading

Government

Looking Back At COVID’s Authoritarian Regimes

After having moved from Canada to the United States, partly to be wealthier and partly to be freer (those two are connected, by the way), I was shocked,…

Published

on

After having moved from Canada to the United States, partly to be wealthier and partly to be freer (those two are connected, by the way), I was shocked, in March 2020, when President Trump and most US governors imposed heavy restrictions on people’s freedom. The purpose, said Trump and his COVID-19 advisers, was to “flatten the curve”: shut down people’s mobility for two weeks so that hospitals could catch up with the expected demand from COVID patients. In her book Silent Invasion, Dr. Deborah Birx, the coordinator of the White House Coronavirus Task Force, admitted that she was scrambling during those two weeks to come up with a reason to extend the lockdowns for much longer. As she put it, “I didn’t have the numbers in front of me yet to make the case for extending it longer, but I had two weeks to get them.” In short, she chose the goal and then tried to find the data to justify the goal. This, by the way, was from someone who, along with her task force colleague Dr. Anthony Fauci, kept talking about the importance of the scientific method. By the end of April 2020, the term “flatten the curve” had all but disappeared from public discussion.

Now that we are four years past that awful time, it makes sense to look back and see whether those heavy restrictions on the lives of people of all ages made sense. I’ll save you the suspense. They didn’t. The damage to the economy was huge. Remember that “the economy” is not a term used to describe a big machine; it’s a shorthand for the trillions of interactions among hundreds of millions of people. The lockdowns and the subsequent federal spending ballooned the budget deficit and consequent federal debt. The effect on children’s learning, not just in school but outside of school, was huge. These effects will be with us for a long time. It’s not as if there wasn’t another way to go. The people who came up with the idea of lockdowns did so on the basis of abstract models that had not been tested. They ignored a model of human behavior, which I’ll call Hayekian, that is tested every day.

These are the opening two paragraphs of my latest Defining Ideas article, “Looking Back at COVID’s Authoritarian Regimes,” Defining Ideas, March 14, 2024.

Another excerpt:

That wasn’t the only uncertainty. My daughter Karen lived in San Francisco and made her living teaching Pilates. San Francisco mayor London Breed shut down all the gyms, and so there went my daughter’s business. (The good news was that she quickly got online and shifted many of her clients to virtual Pilates. But that’s another story.) We tried to see her every six weeks or so, whether that meant our driving up to San Fran or her driving down to Monterey. But were we allowed to drive to see her? In that first month and a half, we simply didn’t know.

Read the whole thing, which is longer than usual.

(0 COMMENTS)

Read More

Continue Reading

Trending