PSA - Jaxx Vulnerability (2017) - #CryptoTrading

Published in Cryptocurrency wallets · Labeled as PSA ·

A 2017 version of the Jaxx wallet has a serious vulnerability that is being worked on - but at the moment is there.

NOTE: This is an article from 2017 and is not relevant to the current versions of Jaxx.

2017 Jaxx Vulnerability Report

Sourcevxlabs.com

Even when your Jaxx has a security PIN configured, anyone with 20 seconds of (network) access to your PC can extract your 12 word backup phrase and copy it down. Jaxx does not have to be running for this to happen.

With the 12 word backup phrase, they can later restore your wallet, including all of your private keys, on their own computers, and then proceed to transfer away all of your cryptocurrency.

The main problem is that the Jaxx software encrypts the mnemonic using a hard-coded encryption key, instead of making use of a strong user-supplied password. (As Daira Hopwood points out in the comments, using the PIN would not be sufficient.)

This means we can easily read and decrypt the full recovery phrase from local storage using sqlite3 and some straight-forward code.

I successfully tested this vulnerability on the Jaxx Chrome extension v1.2.17 and the Jaxx Linux desktop app 1.2.13.

If you have BTC, ETH, ETC or other coins in Jaxx get them out now.

If you only ever used the Jaxx mobile apps your coins are apparently safe (not if you use both desktop and and mobile though).

Update: People report stolen ETH, ETC and ZEC

Category: Cryptocurrency wallets · Label: PSA · Author: Karlvonbahnhof (contact author)

 

Last added to Crypto Airdrops, Bounties & Opportunities
Airdropped Token or Opportunity Airdrop Date About the airdrop Link
Phemex $60 Deposit Bonus Reward (+$20 Trading Reward) Open The crypto derivative platform Phemex gives away $60 USD bonus for deposit over specific amounts. The minimum deposit is 0.2 BTC or 2k USDt or 10 ETH or 10k XRP or 500 LINK. Additional bonuses are available for making a trade at spot and contract markets. All bonuses here
Bitfinex KSM Staking Launched 25 Feb Bitfinex opened staking of Kusama tokens with expected staking rewards of ~8% p.a. To start staking KSM, deposit your tokens into your exchange wallet on Bitfinex, or buy the tokens on the exchange. First payout will arrive on 3rd March. sign up with fee discount
DOT and GRT trading fee discount (reliable exchange, easy KYC) Until 9 March Polkadot and The Graph trading has been enabled on the Aussie exchange Independent Reserve in fiat pairs with AUD, NZD, SGP and USD. (International deposits available, KYC individual). The trading fee is 0.1% flat for accounts without premium or volume discount for the first two weeks of trading. info
Pulse Network Reward Competition Until Mid March Pulse network is opening a competition where the most active social media shills get rewarded from a prize pool of 10k+ USD. Top 50 shills get at least 430 USD worth. info
Staking without KYC on WhiteBit New! WhiteBit opened 17 different staking plans with 9 different currencies to choose from. 40% APR, available to the users without KYC. (Be mindful of risks) sign up
PheMex Twitter Bounty Live Phemex is a crypto derivatives platform (new and therefore not to be trusted too much) that is trying to fill the hole after BitMex. They do not require KYC for now, word of caution. PheMex is trying to build up their Twitter account and promise to give away the total of 1x 10k worth of BTC as well as loads of smaller prizes in gift cards and such, if you help them shill their Twitter handle. Phemex account is needed, sign up with code H7QPW to get welcome bonus. sign up with bonus and view the prizes
Blockchain Space Telegram Bounty Until June 2021 Blockchain Space runs a Telegram activity bounty. The most active users will be paid 50 USDT every 15 days. info
Armor Network Early Mining Opportunity For a few weeks now Armor Network is a fast, anonymous and untraceable cryptocurrency integrated into Telegram ecosystem. No ICO, no premine. Genesis block 21 Jan, mining rewards are still high. WARNING: Right now uses a Telegram wallet, so you don't own the private key. info
Opportunity: DeFi Tokens on reputable exchange with lower fees 14 days after listing The Aussie exchange Independent reserve is listing new DeFi tokens these days. For each of the new markets has the fee reduced to 0.1% for the first 2 weeks. Currently those markets are yearn.finance, Aave and Kyber Network Crystal. sign up
Earn YoBit's YoDefi tokens Live YoBit set up their own defi project for liquidity on the exchange. The exchange pays out 777 YoDefi Tokens proportionally for all users every 10 mins. sign up