News linked to both this project and an event.
Odaily News: Cybersecurity firm Check Point Research has discovered that the StopAndProtect ransomware operation has been using nearly 2,000 compromised WordPress websites to spread malware, steal data, monitor victims, and deploy ransomware. The operation was first identified in mid-May.As of July 24, the operation had compromised more than 6,000 unique IP addresses, with 1,852 in the United States, and 630 each in Russia and India. The compromised websites were also used to host malware, relay commands, and store stolen files, screenshots, and activity logs.Attackers lured Windows users into running PowerShell commands through fake CAPTCHA prompts, enabling them to steal credentials and cryptocurrency wallet seed phrases, and spread further across networks and USB devices. Researchers collected more than 31,000 screenshots and over 700 compressed data archives, and believe the attackers may have accidentally infected themselves at some point. (Decrypt)
Coldcard has released the latest firmware 5.6.1 (Mk4/Mk5) and 1.5.1Q (Q). This update is based on a three-week security review following the emergency fix on July 31, addressing security risks brought by the previous mnemonic generation attack. Each newly generated mnemonic must now include at least one source of user entropy, including at least 65 irregular keystrokes, 50 physical dice throws, or 128 physical coin flips, combined with fresh entropy provided by STM32 TRNG, SE1, and SE2. The new firmware also adds instant staged PSBT verification before signing, strengthens USB connection and firmware update boundaries, improves Delta Mode isolation mechanisms, fixes active wallet backup issues, enhances random number generator initialization and fault checking, adjusts SIGHASH default settings, and includes multiple security and correctness improvements. Coldcard stated that this update aims to further reduce the risk of device attacks. The official reminder notes that updating the firmware cannot fix existing mnemonics generated by previously affected firmware. If users' mnemonics fall within the scope of this security advisory, they should first update the device, then generate and verify a completely new mnemonic, and migrate funds to the new wallet. Coldcard recommends that all Mk4, Mk5, and Q users update their devices promptly and verify the signature of the downloaded firmware.
Odaily News: Bitcoin News posted on X platform, stating that even if the mnemonic remains secure because it was generated via dice rolls or imported from an existing mnemonic, multiple Coldcard features may still be vulnerable due to the Yasmarang PRNG flaw. Affected features include paper wallets, device cloning, USB sessions, Secret Teleport, co-signing keys, password generator, and HSM mode. If the mnemonic was imported or generated through a sufficient number of dice rolls, the mnemonic itself remains secure, but using these features may still expose secret information generated by the flawed random number generator.