Blockfolio Quietly Patches Years-Old Security Hole That Exposed Source Code (#GotBitcoin?)

A “white hat,” or ethical, hacker found a gaping hole in Blockfolio, the popular mobile cryptocurrency portfolio tracking and management app. Blockfolio Quietly Patches Years-Old Security Hole That Exposed Source Code (#GotBitcoin?)

The security vulnerability, which appeared in older versions of the application, could have allowed a bad actor to steal closed source code and possibly inject their own code into Blockfolio’s GitHub repository and, from there, into the app itself.

A security researcher at cybersecurity firm Intezer, Paul Litvak, made the discovery last week when he decided to review the security of the cryptocurrency-related tools he was using. Litvak has been involved in cryptocurrencies since 2017 when he used to build bots for trading, and Blockfolio is an Android app he used for managing his portfolio.

“After some time reviewing their [new] app to no avail, I took a look at older versions of the app to see if I could find any long-forgotten secret or hidden web endpoints,” said Litvak. “Soon I found this version from 2017 accessing GitHub’s API.”

This code connects to the company’s Github repository using a set of constants that included a filename and, most importantly, the key Github uses to allow access to repositories. It appears below as the variable “d.”

The app queried Blockfolio’s private GitHub repositories, and that function quite simply downloaded Blockfolio’s frequently asked questions directly from GitHub, saving the company from the effort of having to update it inside its apps.

But the key is dangerous in that it could access and control an entire GitHub repository. Since the app was three years old, Litvak was curious as to whether it was still a threat.

“This is severe, but I thought maybe it’s just some old token not in use anymore, from back when they launched,” said Litvak.

The key, he discovered, was still active.

“And I found that, nope, the token’s still active and has a “repo” OAuth Scope,” he said. An “OAuth Scope” is used to limit an application’s access to a user’s account.

Blockfolio Quietly Patches Years-Old Security Hole That Exposed Source Code (#GotBitcoin?)

A “repo,” according to GitHub, grants full access to private and public repositories, and includes read/write access to code, commit statuses and organization projects, among other functions.

“It was using private credentials to access its private code repository,” said Litvak. “Anyone who was curious enough to reverse-engineer the old Blockfolio app could’ve reproduced it and downloaded all of Blockfolio’s code and even pushed their own malicious code into their code base. You’re not supposed to have private credentials in apps that anyone can download.”

The vulnerability had been public for two years and the hole was still open. Litvak alerted Blockfolio to the issue via social media, given Blockfolio does not have a bug bounty program to root out vulnerabilities.

Blockfolio Co-Founder & CEO Edward Moncada confirmed in an email to CoinDesk that a GitHub access token was mistakenly left in a previous version of the Blockfolio app codebase, and when alerted to the vulnerability, Blockfolio revoked access to the key.

Over the next several days Moncada said Blockfolio did an audit of its systems and confirmed that no changes were made. Given the token provided access to code that was separate from the database where user data is stored, user data was not at risk.

Blockfolio Quietly Patches Years-Old Security Hole That Exposed Source Code (#GotBitcoin?)

The token would allow someone to change source code, but through its internal processes for releasing changes to the system Moncada said there was never a risk malicious code would have been released to users.

“I’d say worst-case scenario, an attacker would update the app’s code and collect data about the users. They also have the feature where you put exchange API keys in the app so that could be stolen as well,” said Litvak. “But they [Blockfolio] claim that’s impossible because of their ‘security reviews.’ I’d say it’s best nobody got to test those security reviews.”

Updated: 8-31-2020

FTX Buying Blockfolio Continues Consolidation Trend In Crypto Industry

Major crypto exchanges are consolidating smaller, niche services to expand their overall market reach.

The past few months have seen a number of major crypto companies facilitate some serious big-money acquisitions. For example, on Aug. 25, blockchain software firm ConsenSys bought out JP Morgan’s enterprise-variant of the Ethereum blockchain Quorum.

Similarly, earlier this year, global cryptocurrency exchange Binance announced that it was acquiring CoinMarketCap, one of the most referenced crypto data websites.

In this regard, crypto derivatives exchange FTX, too, announced on Aug. 26 that it had recently come to an agreement with Blockfolio to take over the digital asset portfolio tracker for a total sum of $150 million.

But a pertinent question that FTX’s latest acquisition raises is: What will happen to all of Blockfolio’s existing user data, and should users be wary of their holdings being disclosed to tax authorities?

Cointelegraph reached out to Ian Balina, the founder and CEO of Token Metrics — an AI-based cryptocurrency ratings and price predictions platform.

In his view, FTX’s purchase of Blockfolio will not result in a mass exodus of users from the platform because most people who have used the service in the past have grown accustomed to its user interface, something that Balina believes will be hard to replace easily. Regarding user data privacy, he stated:

“I think what we can learn from user applications is that people value ease of use over privacy. TikTok and Facebook show us this, so I don’t believe concerns about how an exchange will utilize users’ data will be a concern for the majority of users.”

Finding A Market Edge

Launched in 2019, FTX has witnessed somewhat of a meteoric rise in recent months, which has been exemplified by the company’s decision to shell out a handsome sum for Blockfolio’s 6-million-strong user base, as the crypto exchange looks to rapidly fuel its ongoing growth.

Speaking on how this latest development will spur FTX’s overall market presence, Jared Polites, a partner at LaunchTeam — a marketing agency — believes that the deal will help raise brand equity and hasten FTX’s growth: “Potential benefits include user growth, doubling down on mobile analytics and UX, and liquidity as more exchange services get integrated into Blockfolio.”

Additionally, Blockfolio’s acquisition is going to be a big advantage for FTX when it comes to the liquidity side of things, especially since an established brand is not part of the equation.

On the topic, Sam Bankman-Fried, a co-founder and the CEO of FTX, recently stated: “From the beginning, our goal at FTX has been to build the best quality trading experiences with the deepest liquidity for the widest possible cross-section of traders.”

Lastly, FTX’s deal will also help gear the company’s image toward a more mainstream crypto audience that might include a number of future traders.

In regard to how Blockfolio’s acquisition will allow FTX to increase its market dominance, Balina opined: “Blockfolio is one of the most undervalued applications in the cryptocurrency space, and I think this is a smart move by FTX.”

Investment Season For Big Crypto Companies

Since the start of the year, the digital asset sector has witnessed a number of major deals go through, such as Binance buying CoinMarketCap as well as major Indian exchange WazirX. Similarly, earlier this year, Coinbase, too, announced that it was acquiring Tagomi, a prime brokerage platform meant primarily for institutional investors. In the wake of these deals, there seem to be several reasons for such high profile consolidations in the crypto space.

It’s important to recognize the fact that even though on paper these deals appear to be substantial, the crypto sector as a whole is still in its infancy and has yet to witness any significant merger-and-acquisition-related activity, especially when compared with the traditional finance sector. Expounding his views on the subject, Polites added:

“The deals we have seen have been valued very high, and this is likely due to these novel services having a stronghold on their niche and exchanges realizing replicating these would be very difficult, even with vast resources. I expect to see more of these deals and some consolidation within the Tier 1 exchanges and niche products. This will help exchanges become larger, more diversified businesses.”

Additionally, if and when top tier crypto exchanges reach a stage of “consolidation saturation,” players such as Binance and Coinbase may eventually become as big as various mainstream banks or large media houses that have multiple operational wings and can serve a number of different industrial domains in addition to their existing crypto buy/sell capabilities.

When it comes to big-name firms like FTX acquiring platforms like Blockfolio, the goal of these companies seems to primarily be to expand their existing market reach as well as to onboard new users. For example, Blockfolio currently sits at the top of the crypto user acquisition funnel and is one of the first applications that people tend to use when they start investing in digital assets.

The Crypto Market Will Consolidate Further

As the cryptocurrency market continues to evolve and grow, it would be unsurprising to see more of these deals take place on an increasingly regular basis. Also, it is worth noting that not all of the aforementioned acquisitions have been solely for monetary reasons. Doug Leonard, the CEO of Mainframe — a decentralized lending protocol — told Cointelegraph:

“At this stage of maturity in the cryptocurrency space, it is important for platforms to consolidate services and subsequently improve their user experiences. […] Traders want to maintain their diverse options without having to toggle through multiple tabs, applications and wallets.”

Lastly, Bryan Routledge, an associate professor of economics at Carnegie Mellon University’s Tepper School of Business, also believes that if one were to take evidence stemming from other, more traditional market settings such as equity and commodities, it would only be natural for the crypto industry to also follow suit and start consolidating around a few big exchanges — something that could eventually lead to an increased amount of investor confidence.

Updated: 2-9-2021

Blockfolio Apologizes After Racist Messages Delivered To App Users

‘Teflon’ Sam Bankman-Fried illustrates why the crypto community holds him in high regard, as Blockfolio exploit results in clear communication and a rapid response.

On February 9, Blockfolio’s Signal feed was briefly compromised, resulting in some users receiving racist messages within the company’s app.

Users said that the culprits went so far as to threaten loss of funds if deposits were not removed from the crypto portfolio platform. While the derogatory messages were reportedly scrubbed by Blockfolio’s security team within about 30 minutes, the incident left many wondering how such an attack could have occurred.

Tweeting on Tuesday, SBF offered updates about the incident, alleging that a competing exchange was to blame.

1) We’re really sorry about the messages today on Blockfolio.

We’ve also now figured out what happened. Here’s the story.

— SBF (@SBF_Alameda) February 9, 2021

“We have spent the last four hours investigating every angle and tracking down leads; we’re relieved to say that we’ve figured out what happened,” SBF tweeted, adding:

“This offensive content was produced and published by a competitor exchange of ours who maliciously gained access to someone else’s Blockfolio News/Signal capabilities.”

The FTX CEO condemned the culprit, but did not name the competitor. Access to the Signal feed reportedly did not affect or jeopardize any funds.

According to SBF, Blockfolio has completed their investigation into the matter, and the company has fixed the vulnerability that ignited the situation. The FTX CEO promised to improve the security infrastructure around Blockfolio’s non-trading protocols to prevent similar incidents in the future.

Bankman-Fried was praised by many in the cryptocurrency community for reacting swiftly and transparently to the incident, and as a measure of compensation he apparently added $10 to the trading accounts of affected users. SBF also stated that he has donated to organizations dedicated to fighting racial and societal injustices as a result of the incident.

Great response Sam. You’re an inspiring leader in a world in need of many. Are you able to give users the option to donate the $10 to a common racial justice cause?

— Andy (@Crypto_Dufresne) February 9, 2021

FTX acquired Blockfolio for $150 million back in August 2020. This is not the first security-related issue the company has experienced. In May 2020, a white-hat hacker named Paul Litvak reported a security flaw that exposed the platform’s source code on older app versions to malicious actors.

At the time, Litvak revealed that the vulnerability was over two years old. Fortunately for Blockfolio, no malicious actor was any the wiser about the flaw’s existence, allowing the company to solve the issue and double-down on a commitment to user privacy.

Blockfolio Quietly Patches Years-Old,Blockfolio Quietly Patches Years-Old,Blockfolio Quietly Patches Years-Old,Blockfolio Quietly Patches Years-Old,Blockfolio Quietly Patches Years-Old,Blockfolio Quietly Patches Years-Old

Bitcoin Information & Resources (#GotBitcoin?)

Bitcoin Won As Store of Value In Coronavirus Crisis — Hedge Fund CEO

Decentralized VPN Gaining Steam At 100,000 Users Worldwide (#GotBitcoin?)

Crypto Exchange Offers Credit Lines so Institutions Can Trade Now, Pay Later (#GotBitcoin?)

Zoom Develops A Cryptocurrency Paywall To Reward Creators Video Conferencing Sessions (#GotBitcoin?)

Bitcoin Startup Purse.io And Major Bitcoin Cash Partner To Shut Down After 6-Year Run

Open Interest In CME Bitcoin Futures Rises 70% As Institutions Return To Market

Square’s Users Can Route Stimulus Payments To BTC-Friendly Cash App

$1.1 Billion BTC Transaction For Only $0.68 Demonstrates Bitcoin’s Advantage Over Banks

Bitcoin Could Become Like ‘Prison Cigarettes’ Amid Deepening Financial Crisis

Bitcoin Holds Value As US Debt Reaches An Unfathomable $24 Trillion

How To Get Money (Crypto-currency) To People In An Emergency, Fast