Server – Earlybirds Invest https://earlybirdsinvest.com Latest Crypto News Sat, 13 Sep 2025 17:00:38 +0000 en-US hourly 1 https://wordpress.org/?v=6.9.7 https://i0.wp.com/earlybirdsinvest.com/wp-content/uploads/2024/12/cropped-New-Project-2024-12-17T235703.455.png?fit=32%2C32&ssl=1 Server – Earlybirds Invest https://earlybirdsinvest.com 32 32 240146708 How to build server less applications for Mist https://earlybirdsinvest.com/how-to-build-server-less-applications-for-mist/ https://earlybirdsinvest.com/how-to-build-server-less-applications-for-mist/#respond Sat, 13 Sep 2025 17:00:37 +0000 https://earlybirdsinvest.com/how-to-build-server-less-applications-for-mist/ How to build server less applications for Mist | Ethereum Foundation Blog

ETH top background starting image
ETH bottom background ending image

Posted by Alex Van de Sande on July 12, 2016

How to build server less applications for Mist

Ethereum is not meant to be a platform to build esoteric smart contract applications that require a STEM degree to understand, but it aims to be one pillar of a different architecture for applications on the world wide web. With this post we will try to elucidate how this can be done and give some basic examples on how to start building a decentralized app.

Who is this for?

This text is intended at those who have a basic understanding of web technology and how to build a simple javascript and html app, and want to convert these skills into building apps for the Ethereum ecosystem.

How can apps run without servers?

Currently servers in web apps do much more than what they were originally intended to. Besides serving static web pages, they also keep private information, handle user authentication and deal with all the complicated ways in which data is analyzed and saved. All the user computer does – a device which would be considered a super computer when the web was invented – is to load and display that information to the user.

Current server models Current server models

Instead, a more decentralized architecture would allow a much more modular approach, in which different machines and different protocols would handle specific tasks, some on the user’s side and some in specialized machines deployed on a peer to peer network. Therefore all the Data logic (what gets saved, who saves it, how to solve conflicts etc) is handled by smart contracts on the blockchain, static files are served via Swarm and realtime communication over Whisper. The user device keeps the user authentication and runs the application interface.

Doing this would remove the danger of data breach and attacks as there are less single nodes keeping tons of unencrypted data, while also removing the load and cost of serving apps by distributing it across the network. Since all those protocols are decentralized, anyone can connect to the network and start providing a specialized service: if the user is browsing from a powerful laptop, for instance, they can also serve static files to network neighbors.

 

Decentralised Server models Decentralised Server models

A decentralized architecture also encourages innovation: since the interface is detached from the data, anyone can come up with a new interface to the same app, creating a more vibrant and competing ecosystem. Arguably, one of the most interesting and innovative periods in Twitter history was when it served mostly as a central data hub and anyone could build their  Twitter Application.

See it working

If you want to experiment with the app before learning it, we recommend you download Mist and read our introductory tutorial to how to install the app and run it. If you just want to see the whole app instead, you can download it directly from the Stake Voice Github repository.

 

Stake Voice running on the Mist Browser Stake Voice running on the Mist Browser

Let’s get to it

We are going to build a very simple application called “Stake Voice”. The idea is to allow ether stakers to vote on anything they want, and the app will tally the total ether balance of all those who agree or disagree with the statement.

The app underlying contract is written in Solidity, a javascript-like language and is very simple:

contract EtherVote {
    event LogVote(bytes32 indexed proposalHash, bool pro, address addr);
    function vote(bytes32 proposalHash, bool pro) {
        if (msg.value > 0) throw;
        LogVote(proposalHash, pro, msg.sender);
    }
    function () { throw; }
}

The first line sets up the contract name and the second creates an event called “LogVote”, which will output in the log the following:

  • a hash of the proposal being voted on
  • if the voter agrees or disagrees with it
  • the address of the voter

The function “vote” will then fire the log, which the application later will count. It also has a check that no ether can be sent accidentally. The “anonymous”  function is executed when any ether is deposited on the smart contract and will then automatically reject it.

If you want to learn more about coding in Solidity we recommend you start on the ethereum solidity tutorials, read the  official documentation page and try it on your browser using the online compiler.

That’s essentially it: you choose a hash, choose a side and execute Vote(). So how does this translates into a polling app?

Serverless Architecture

Following the principle of KISS, we are doing the minimum product possible that is still usable, meaning we won’t be using databases for storing proposals or using any feature that requires anything other than vanilla javascript and pure html.

So we will use the URL of the app itself to keep the proposal text, and we will use that to display it to the user and generate a hash that can then be used to check the votes. The users can use social media to share which proposals they want to debate or simply use direct links.

// On the initial startup function:
proposal = decodeURI(getParameterByName('proposal'));

// 

Start with basics

So grab your favorite html framework and get a basic website on your local machine and open it on Mist. All pages in Mist have access to a javascript object called web3 which will where you will be working the most.  First thing we need to do is check if web3 is present or not:

Function init() {
...
if(typeof web3 == 'undefined') {
    // Alert the user they are not in a web3 compatible browser
    return;    
 }
 

Some application developers might want to load their own web3 object, to guarantee forward compatibility. To do that, just add just before

tag:


And then add this on your initial function to load your own custom web3 provider:

// Checks Web3 support
if(typeof web3 !== 'undefined' && typeof Web3 !== 'undefined') {
    // If there's a web3 library loaded, then make your own web3
    web3 = new Web3(web3.currentProvider);
} else if (typeof Web3 !== 'undefined') {
    // If there isn't then set a provider
    web3 = new Web3(new Web3.providers.HttpProvider("http://localhost:8545"));
} else if(typeof web3 == 'undefined') {
    // Alert the user he is not in a web3 compatible browser
    return;  
}

Load information from the blockchain

You checked you are connected to a blockchain, but which one? Is it the main ethereum network? Maybe a testnet or a private network? Maybe it’s a fork in the future and your chain is a brand new one. The best way to check this is to see if the contract address you want to load has any code on it.

Furthermore, to execute a contract you need to know two basic things: it’s address and the ABI, which will be a json encoded file containing interface information.

var contractAddress = '0x1e9d5e4ed8ef31cfece10b4c92c9057f991f36bc';
var contractABI = [{"constant":false,"inputs":[{"name":"proposalHash","type":"bytes32"},{"name":"pro","type":"bool"}],"name":"vote","outputs":[],"type":"function"},{"anonymous":false,"inputs":[{"indexed":true,"name":"proposalHash","type":"bytes32"},{"indexed":false,"name":"pro","type":"bool"},{"indexed":false,"name":"addr","type":"address"}],"name":"LogVote","type":"event"}];

Now that you have those, you can check if the contract exist on the startup function:

// Load the contract
web3.eth.getCode(contractAddress, function(e, r) {
    if (!e && r.length > 3)
        loadContract();
 })
 

You can even run this command recursively, to try connecting to it again using another address (in case you are actually on the testnet). Once you have found your contract you can load it up here:


Function   loadContract() {
// load the contract to javascript
      ethervoteContract = web3.eth.contract(contractABI);
      ethervote = ethervoteContract.at(contractAddress);
}

You are using the web3 object to create a new a javascript object that will be able to execute all the ethereum commands directly from the browser. If you want to load only a single instance of the contract, then you can even do it in one line:

    
ethervote = web3.eth.contract(contractABI).at(contractAddress);

Identify the user

Knowing the user’s account reveals a lot of information about the user: how much ether and any other tokens it has on its balance, and their transaction history. So having all apps know this by default would create a super cookie and would be an unacceptable invasion of privacy. On the other hand, requiring the user to create an user account with login information for each site is not only a pain for the user, but also puts your private information in control of third parties, which creates giant honey pots that can be breached by hackers.

As a result of this dilemma most users have most of their personal information and authentication information handled by a half dozen billion dollar corporation. Privacy should not be a compromise we accept in exchange of practicality: users should be able to easily authenticate into any app while being in control of their own personal information.

Using Mist, apps have no information about the user, until the user decides to reveal itself to the app. When you want to query what you know about the accounts, you should call the getAccounts function:

web3.eth.getAccounts(function(e,accounts){
    if (!e) {
        // do something with the accounts
   }
});

Currently, the returning object is an array that holds simple accounts that the user has local access to, but in the future it will also hold smart contract accounts the user uses to identify themselves. This will allow the user to have access to features currently available only to centralized authenticators, like two factor authentication or cloud backup, and to future improvements only available to smart contracts, like allowing a few trusted friends to give you access to an account for which you lost keys or having automatic inheritance of inactive accounts.

Each future Ethereum browser will handle how users identify themselves to the App. In Mist we have two ways: either the user can initiate it by clicking the “connect” button (currently it’s just called a “no accounts” button) or the App can request the authentication by calling the “requestAccount” api.

Attention: the accounts on this list are just one which the user claims to hold the key to, but the user has provided no proof of doing, therefore you can show a different UI, but don’t send the user any secret information intended only to that account. If you require the user to prove their identity you need them to sign a message, while Mist will also support that in the future, keep it in mind that it would force the user to add an extra step and type their password, so you should only use that when absolutely necessary.

 

Voting

Once you have the contract as an object, voting is a matter of calling it from javascript. This will pop up a Mist transaction pane, where the user will be able to check the transaction and then type their password. So first we will create two clickable objects that calls a vote function:

    
document.getElementById('vote-support').addEventListener('click', function(){ vote(true);}, false);
document.getElementById('vote-against').addEventListener('click', function(){ vote(false);}, false);

Notice that one calls the function with a true parameter and the other false. The function vote could be as simple as:

Function vote() {
    ethervote.vote(proposalHash, support, {from: web3.eth.accounts[0]});
}

“Ethervote” is the object we created before, and “vote” is one of its functions, which correspond to one of the contract functions:

function vote(bytes32 proposalHash, bool pro) {}

We pass the two parameters demanded by the function and then add a third object containing transaction informations, like who is it being sent from and optionally, how much gas to include or how much to pay for the gas.

Consequently this would generate a panel asking the user to confirm the transaction – but most likely it will return an error because currently the web3.eth.accounts object is an empty array by default, so you have to check for that and if empty, request the accounts to the user:

function vote(support) {

     web3.eth.getAccounts(function(e,accounts){
        // Check if there are accounts available
        if (!e && accounts && accounts.length > 0) {
            // Create a dialog requesting the transaction
            ethervote.vote(proposalHash, support, {from: accounts[0]})

          } else {
            mist.requestAccount(function(e, account) {
                if(!e) {
                    // Create a dialog requesting the transaction
                    ethervote.vote(proposalHash, support, {from: account.toLowerCase()})
                }
            });
        }
    });
}

You should only request an account once the user initiated an action: pinging a transaction out of nowhere will deservedly irritate the user and probably make him close your app. If we observe abuses from apps using this feature, we might add more strict requirements to when an alert will show up.

Watch the contract

Finally, to count up all the votes we need to watch the contract events and see what votes were cast. To do that, we have to run this function once to start watching the events, after we instantiated “ethervote”:

ethervote = web3.eth.contract(contractABI).at(contractAddress);
var logVotes = ethervote.LogVote({proposalHash: proposalHash}, {fromBlock: 1800000});
// Wait for the events to be loaded
logVotes.watch(function(error, result){
    if (!error) {            
        // Do something whenever the event happens
      receivedEvent(result);
    }
})

The above code will start reading all blocks from number 1.8M (when the contract was uploaded) onwards and then execute the receivedEvent() function once for each event. Whenever a new block arrives with an event this function will be triggered again so you won’t need to call continuously. So what would this function do?

Var voteMap = {};
Function receivedEvent(event) {
    // Get the current balance of a voter             
    var bal = Number(web3.fromWei(web3.eth.getBalance(event.args.addr), "finney"));
    voteMap[res.args.addr] = {balance: bal, support: event.args.pro};
}

From the original solidity contract, you can see that the LogVote event comes with three argumenst, proposalHash, Pro and Addr:

event LogVote(bytes32 indexed proposalHash, bool pro, address addr);

So what this function does is that it will use the function web3.eth.getBalance to check the current ether balance of the address that voted. All balances always return numbers in wei, which is a 1/1000000000000000000 of an ether and is not very useful for this particular application, so we also use another included web3 function which converts that to any ether unit we want. In this case we will be using the finney, which is a thousandth of an ether.

Then the function will save the balance, along with the position of the voter to a map based on the address. One advantage of using a map instead of an array is that this will automatically overwrite any previous information about that same address, so if someone votes twice, only their last opinion will be kept.

Another thing we could do is identify the user and show them if they voted or not.

// Check if the current owner has already voted and show that on the interface
web3.eth.getAccounts(function(e,accounts){
    if (!e && accounts && accounts[0] == res.args.addr) {
        if (res.args.pro) {
            // User has voted yes!
        } else {
            // User has voted against!
        }
    }
 });

Tally up the votes

Finally, we should add a separate function to calculate the sums of the votes:


Why do we want to tally up the votes on a separate function? Because since the vote weight is based on the current balance of each account, we should recalculate the balances at every new block, event if we received no new event. To do this you can add this function that will execute automatically everytime a new block arrives:

web3.eth.filter('latest').watch(function(e, result){
    if(!e) {
        calculateVotes();
    }
}); 

Finally, up to calculating the final tally. We have previously used eth.getBalance in synchronous mode, where the app would wait for the result of the previous action to proceed. Here, since we can be calling a lot of actions every block, we will use it in asynchronous mode: you call the node and execute the action whenever it replies without freezing the interface.

var totalPro, totalAgainst, totalVotes;
function calculateVotes() {
    totalPro = 0;
    totalAgainst = 0;
    totalVotes = 0;
    Object.keys(voteMap).map(function(a) {
        // call the function asynchronously
        web3.eth.getBalance(a, function(e,r) {
            voteMap[a].balance = Number(web3.fromWei(r, 'finney'));
            if (voteMap[a].support)
                totalPro += parseFloat(voteMap[a].balance);
            else
                totalAgainst += parseFloat(voteMap[a].balance);
            // do something cool with the results!            
        });            
    });
}

As you can follow on the code, what the app is doing is looping in each of the voting addresses and getting their balance, and as soon as it returns, it will either add it to the pro or against camp and sum the totals.


A few extra caveats: when there are no events, nothing will be returned and votes won’t be calculated so you should add a timeout function on all functions that rely on events from the blockchain.

setTimeout(function(){
        // If the app doesn't respond after a timeout it probably has no votes
    }, 3000);

Now you can feel free to use all your current webdeveloper foo to work whatever magic you want. Use the numbers to build a nice visualization in 3D or connect to your favorite social media to share the best questions.

Mist also tries to simplify your code by providing some basic navigation and UI methods. If you want your app to be header less and occupy the full height of the mist app, just add this to your

tag:

 <meta name="ethereum-dapp-url-bar-style" content="transparent">

And if you want to use Mist itself to navigate on your app, you can use the Mist.menu object:

for (item of propHistory) {
    if (item.length > 0 && item != 'null') {
        mist.menu.add( item ,{
        name: item,
        position: n++,
        selected: item == proposal
        }, function(){
            window.location.search = '?proposal=' + encodeURI(this.name);
        });
    }
 }

One great thing about ethereum is that you can expand on this simple contract functionality without needing permission: you can add all extra functionality on separate contracts, keeping every single one of them simple and easier to debug. It also means other people can use the contracts you created to their own apps and give new functionality. Meanwhile, all the apps use the same data and backend.

You can play with this app live hosted on github pages, but this isn’t the canonical source of truth, just one of the many possible interfaces to it. The same app will also work as a local html file on your computer or on an IPFS network and in the future it will be downloaded directly via Mist using Swarm.

Some ideas on how you can try:

  • Create a listing of currently available statements. Anyone can check them by seeing the sha3 of the proposal text, so you don’t need permission.
  • Create threaded comments where users can reply to statements and then upvote or downvote them, sort of like a decentralized stake based Reddit
  • Instead of (or in addition to) using ether balance, you can use some other ethereum token, like The DAO or Digix Gold to weight your questions differently. Since all that the original contract stores is the sender, you can check all balances. Or maybe you can create your own currency that is based on reputation, karma or some other way.


]]>
https://earlybirdsinvest.com/how-to-build-server-less-applications-for-mist/feed/ 0 58263
How to completely uninstall Bitcoin core in Macm2, and you need to run a server and external HD https://earlybirdsinvest.com/how-to-completely-uninstall-bitcoin-core-in-macm2-and-you-need-to-run-a-server-and-external-hd/ https://earlybirdsinvest.com/how-to-completely-uninstall-bitcoin-core-in-macm2-and-you-need-to-run-a-server-and-external-hd/#respond Wed, 23 Jul 2025 17:02:43 +0000 https://earlybirdsinvest.com/how-to-completely-uninstall-bitcoin-core-in-macm2-and-you-need-to-run-a-server-and-external-hd/

Don’t forget to always back up your wallet and important data.

Blockchain data is stored in the data directory. By default, it is in ~/Library/Application Support/Bitcoin/. Delete this directory and remove all blockchain data. You can do this via a terminal or viewfinder.

rm -rf ~/Library/Application\ Support/Bitcoin/

Delete configuration file: Delete remaining Bitcoin configuration files. These are usually found in your home directory and can be hidden. Remove it using the following command in your terminal:

rm -rf ~/.bitcoin/

After performing these steps, empty the garbage and permanently delete the application and related files.

]]>
https://earlybirdsinvest.com/how-to-completely-uninstall-bitcoin-core-in-macm2-and-you-need-to-run-a-server-and-external-hd/feed/ 0 49247
Hackers are exploiting critical RCE flaw in Wing FTP Server https://earlybirdsinvest.com/hackers-are-exploiting-critical-rce-flaw-in-wing-ftp-server/ https://earlybirdsinvest.com/hackers-are-exploiting-critical-rce-flaw-in-wing-ftp-server/#respond Sun, 13 Jul 2025 05:40:54 +0000 https://earlybirdsinvest.com/hackers-are-exploiting-critical-rce-flaw-in-wing-ftp-server/

Hackers are exploiting critical RCE flaw in Wing FTP Server

Hackers have started to exploit a critical remote code execution vulnerability in Wing FTP Server just one day after technical details on the flaw became public.

The observed attack ran multiple enumeration and reconnaissance commands followed by establishing persistence by creating new users.

The exploited Wing FTP Server vulnerability is tracked as CVE-2025-47812 and received the highest severity score. It is a combination of a null byte and Lua code injection that allows remote a unauthenticated attacker to execute code with the highest privileges on the system (root/SYSTEM).

Wing FTP Server is a powerful solution for managing secure file transfers that can execute Lua scripts, which is widely used in enterprise and SMB environments.

On June 30, security researcher Julien Ahrens published a technical write-up for CVE-2025-47812, explaining that the flaw stems from unsafe handling of null-terminated strings in C++ and improper input sanitization in Lua.

The researcher demonstrated how a null byte in the username field could bypass authentication checks and enable Lua code injection into session files.

When those files are subsequently executed by the server, it is possible to achieve arbitrary code execution as root/SYSTEM.

Along with CVE-2025-47812, the researcher presented another three flaws in Wing FTP:

  • CVE-2025-27889 – allows exfiltrating user passwords via a crafted URL if the user submits a login form, due to unsafe inclusion of the password in a JavaScript variable (location)
  • CVE-2025-47811 – Wing FTP runs as root/SYSTEM by default, with no sandboxing or privilege drop, making RCEs far more dangerous
  • CVE-2025-47813 – supplying an overlong UID cookie reveals file system paths

All the flaws impact Wing FTP versions 7.4.3 and earlier. The vendor fixed the issues by releasing version 7.4.4 on May 14, 2025, except for CVE-2025-47811, which was deemed unimportant.

Threat researchers at managed cybersecurity platform Huntress created a proof-of-concept exploit for CVE-2025-47812 and show in the video below how hackers could leverage it in attacks:

Huntress researchers found that on July 1st, a day after technical details for CVE-2025-47812 appeared, at least one attacker exploited the vulnerability at one of their customers.

The attacker sent malformed login requests with null-byte-injected usernames, targeting ‘loginok.html.’ These inputs created malicious session .lua files that injected Lua code into the server.

The injected code was designed to hex-decode a payload and execute it via cmd.exe, using certutil to download malware from a remote location and execute it.

Huntress says that the same Wing FTP instance was targeted by five distinct IP addresses within a short time frame, potentially indicating mass-scanning and exploitation attempts by several threat actors.

The commands observed in these attempts were for reconnaissance, obtaining persistence in the environment, and data exfiltration using the cURL tool and webhook endpoint.

The hacker failed the attack “maybe due to their unfamiliarity with them, or because Microsoft Defender stopped part of their attack,” Huntress says. Nevertheless, the researchers observed clear exploitation of the critical Wing FTP Server vulnerability.

Even if Huntress observed failed attacks at their customers, hackers are likely to scan for reachable Wing FTP instances and try to take advantage of vulnerable servers.

Companies are strongly advised to upgrade to version 7.4.4 of the product as soon as possible.

If switching to a newer, secure version is not possible, the researchers’ recommendation is to disable or restrict HTTP/HTTPs access to the Wing FTP web portal, disable anonymous logins, and monitor the session directory for suspicious additions.

Tines Needle

While cloud attacks may be growing more sophisticated, attackers still succeed with surprisingly simple techniques.

Drawing from Wiz’s detections across thousands of organizations, this report reveals 8 key techniques used by cloud-fluent threat actors.

]]>
https://earlybirdsinvest.com/hackers-are-exploiting-critical-rce-flaw-in-wing-ftp-server/feed/ 0 47346
Russian Investigators ‘Seized $8.2M Worth of Crypto from Hydra Darknet Server Chief’ https://earlybirdsinvest.com/russian-investigators-seized-8-2m-worth-of-crypto-from-hydra-darknet-server-chief/ https://earlybirdsinvest.com/russian-investigators-seized-8-2m-worth-of-crypto-from-hydra-darknet-server-chief/#respond Tue, 03 Jun 2025 00:19:03 +0000 https://earlybirdsinvest.com/russian-investigators-seized-8-2m-worth-of-crypto-from-hydra-darknet-server-chief/

Author

Tim Alper

Author

Tim Alper

About Author

Tim Alper is a British journalist and features writer who has worked at Cryptonews.com since 2018. He has written for media outlets such as the BBC, the Guardian, and Chosun Ilbo. He has also worked…

Last updated: 


Why Trust Cryptonews

Cryptonews has covered the cryptocurrency industry topics since 2017, aiming to provide informative insights to our readers. Our journalists and analysts have extensive experience in market analysis and blockchain technologies. We strive to maintain high editorial standards, focusing on factual accuracy and balanced reporting across all areas – from cryptocurrencies and blockchain projects to industry events, products, and technological developments. Our ongoing presence in the industry reflects our commitment to delivering relevant information in the evolving world of digital assets. Read more about Cryptonews

Russian investigators confiscated crypto worth around 649 million rubles ($8.2 million) from the wallets of Dmitry Pavlov, the 35-year-old self-confessed server mastermind behind the Hydra darknet portal.

The Russian newspaper Izvestia reported that documents unveiled in court this month confirmed law enforcement officers have frozen and seized coins from Pavlov’s crypto wallets.

Hydra Darknet Server Operator ‘Was Paid in Crypto’

Pavlov testified that he received the cryptoassets in the form of “a salary and bonuses” in return for maintaining Hydra servers.

A criminal ring paid Pavlov “about 15 million rubles ($189,277) a year” in crypto for his services, prosecution officials explained.

The accused said that he did not sell his coins for cash. Instead, he held on to the crypto, hoping that its price would continue to grow.

Hydra operators also paid Pavlov cash to cover maintenance costs, prosecution officials added. A branch of the Moscow District Court jailed 16 people for orchestrating Hydra in December last year.

The operation’s mastermind Stanislav Moiseev was jailed for life after the court heard that the portal facilitated over $5 billion in crypto transactions.

Prosecutors said that Russian experts agreed with Chainalysis estimates about the size of the firm’s crypto turnover.

‘Couriers Brought Pavlov Bags of Cash’

Moiseev and others handed Pavlov money to rent and maintain servers at the German company Hetzner, prosecutors explained.

These costs alone amounted to 1.5-2 million rubles ($18,928-$25,239) per month. Hydra managers “periodically” sent Pavlov couriers with bagfuls of cash, prosecutors added.

Hydra’s annual turnover at the time of closure was $1.7 billion, a Rosfinmonitoring employee testified at Pavlov’s trial. The staffer estimated that the platform took cuts of 2% to 5% from crypto transactions made on Hydra.

Rosfinmonitoring (officially the Russian Federal Financial Monitoring Service) is the nation’s top anti-money laundering agency.

Another expert testified that that the “net profit of Hydra’s co-founders alone,” taking into account-related services, amounted to “about 100 billion rubles ($1.3 billion) a year.”

Last month, Chainalysis reported that while there was a 15% decline in global crypto sales across darknet markets in 2024, Russian sites bucked the trend. The latter saw a 68% rise in crypto sales, the firm said.


]]>
https://earlybirdsinvest.com/russian-investigators-seized-8-2m-worth-of-crypto-from-hydra-darknet-server-chief/feed/ 0 39792
Compromised Mod Account Hits Ledger Discord Server in Wallet Scam Attempt https://earlybirdsinvest.com/compromised-mod-account-hits-ledger-discord-server-in-wallet-scam-attempt/ https://earlybirdsinvest.com/compromised-mod-account-hits-ledger-discord-server-in-wallet-scam-attempt/#respond Tue, 13 May 2025 05:45:44 +0000 https://earlybirdsinvest.com/compromised-mod-account-hits-ledger-discord-server-in-wallet-scam-attempt/

On May 11, Ledger’s Discord server was briefly compromised after a moderator’s account was taken over, according to Ledger team member Quintin Boatwright.

The attacker used the account to share a fake link and claimed that users were required to confirm their wallet recovery phrases. The message was designed to trick people into handing over access to their crypto wallets.

Screenshots shared on X show that the fake message warned of a “security issue” and urged users to act quickly by clicking a link. Anyone who followed it was asked to connect their wallet and complete several steps, which included sharing sensitive information.

What is a Crypto Wallet? (Explained With Animation)

Did you know?

Want to get smarter & wealthier with crypto?

Subscribe – We publish new crypto explainer videos every week!

Ledger’s team responded by removing the compromised moderator account and deleting the bot used to spread the link. They also took down the website the link pointed to and reviewed all channel permissions to prevent further abuse.

An X user said in a May 11 post on X that they were banned or muted while trying to report the incident, which may have delayed the team’s response.

According to Boatwright, “the issue was quickly contained”, and new steps have been taken to improve Discord security. He also confirmed that this was a one-time incident and that the attack was limited to the Discord channel.

On April 29, scammers targeted Ledger wallet owners by sending fake Ledger letters through the mail. How did the company respond? Read the full story.

Having completed a Master’s degree in Economics, Politics, and Cultures of the East Asia region, Aaron has written scientific papers analyzing the differences between Western and Collective forms of capitalism in the post-World War II era.
With close to a decade of experience in the FinTech industry, Aaron understands all of the biggest issues and struggles that crypto enthusiasts face. He’s a passionate analyst who is concerned with data-driven and fact-based content, as well as that which speaks to both Web3 natives and industry newcomers.
Aaron is the go-to person for everything and anything related to digital currencies. With a huge passion for blockchain & Web3 education, Aaron strives to transform the space as we know it, and make it more approachable to complete beginners.
Aaron has been quoted by multiple established outlets, and is a published author himself. Even during his free time, he enjoys researching the market trends, and looking for the next supernova.


]]>
https://earlybirdsinvest.com/compromised-mod-account-hits-ledger-discord-server-in-wallet-scam-attempt/feed/ 0 35935
April updates cause Windows Server auth issues https://earlybirdsinvest.com/april-updates-cause-windows-server-auth-issues/ https://earlybirdsinvest.com/april-updates-cause-windows-server-auth-issues/#respond Wed, 07 May 2025 11:13:40 +0000 https://earlybirdsinvest.com/april-updates-cause-windows-server-auth-issues/

Windows Server

Microsoft says the April 2025 security updates are causing authentication issues on some Windows Server 2025 domain controllers.

The list of impacted platforms includes Windows Server 2016, Windows Server 2019, Windows Server 2022, and the latest version, Windows Server 2025.

However, as the company further explained, home users are unlikely to be affected by this known issue since domain controllers are typically used for business and enterprise authentication.

“After installing the April Windows monthly security update released April 8, 2025 (KB5055523) or later, Active Directory Domain Controllers (DC) might experience issues when processing Kerberos logons or delegations using certificate-based credentials that rely on key trust via the Active Directory msds-KeyCredentialLink field,” Microsoft said in a Windows release health update.

“This can result in authentication issues in Windows Hello for Business (WHfB) Key Trust environments or environments that have deployed Device Public Key Authentication (also known as Machine PKINIT).”

These problems could also impact software relying on these two features for authentication, including but not limited to third-party single sign-on (SSO) solutions, identity management systems, and smart card authentication products.

Affected auth protocols include Kerberos Public Key Cryptography for Initial Authentication (Kerberos PKINIT) and Certificate-based Service-for-User Delegation (S4U) via Kerberos Resource-Based Constrained Delegation (RBKCD or A2DF Delegation) or Kerberos Constrained Delegation (KCD or A2D2 Delegation).

Auth issues linked to CVE-2025-26647 security patches

According to Microsoft, these issues are linked to security measures designed to mitigate a high-severity vulnerability tracked as CVE-2025-26647 that can let authenticated attackers escalate privileges remotely by exploiting an improper input validation weakness in Windows Kerberos, which superseded NTLM as the new default auth protocol for domain-connected devices on all Windows versions released since Windows 2000.

“An attacker who successfully exploited this vulnerability could be assigned much greater rights by the Key Distribution Center to the certificate than intended,” Redmond explains.

“An authenticated attacker could exploit this vulnerability by obtaining a certificate containing the target Subject Key Identifier (SKI) value from a Certificate Authority (CA). The attacker could then use this certificate to get a Ticket Granting Ticket (TGT) for the target user from the Key Distribution Center (KDC).”

As a workaround, affected customers are advised to switch the AllowNtAuthPolicyBypass registry value in HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Kdc from “2” to “1” as detailed in this support document.

Last month, Microsoft mitigated another known issue causing authentication problems on Windows 11 and Windows Server 2025 devices using the Kerberos PKINIT security protocol when Credential Guard is enabled.

Redmond also released emergency out-of-band (OOB) updates in November 2022 to fix a bug causing Kerberos sign-in failures and other auth problems on domain controllers.

One year earlier, it addressed authentication failures related to Kerberos delegation scenarios on Windows Server and similar Kerberos auth problems impacting domain-connected devices running Windows 2000 and later.

Red Report 2025

Based on an analysis of 14M malicious actions, discover the top 10 MITRE ATT&CK techniques behind 93% of attacks and how to defend against them.

]]>
https://earlybirdsinvest.com/april-updates-cause-windows-server-auth-issues/feed/ 0 34882
Rubrik rotates authentication keys after log server breach https://earlybirdsinvest.com/rubrik-rotates-authentication-keys-after-log-server-breach/ https://earlybirdsinvest.com/rubrik-rotates-authentication-keys-after-log-server-breach/#respond Tue, 04 Mar 2025 01:20:54 +0000 https://earlybirdsinvest.com/rubrik-rotates-authentication-keys-after-log-server-breach/

Rubrik

Rubrik disclosed last month that one of its servers hosting log files was breached, causing the company to rotate potentially leaked authentication keys.

The company has confirmed to BleepingComputer that the breach was not a ransomware incident and that it did not receive any communication from the threat actor.

Rubrik is a cybersecurity company that specializes in data protection, backup, and recovery and has over 3,000 employees in more than 22 global offices. The company has over 6,000 customers worldwide, including high-profile companies like AMD, Adobe, Pepsico, Home Depot, Allstate, Sephora, GSK, Honda, Harvard University, and TrelliX.

In a security advisory published on February 2 and first spotted by Kevin Beaumont, Rubrik says it detected unusual activity on a server hosting their log files.

“The Rubrik Information Security Team recently discovered anomalous activity on a server that contained log files. We promptly took the server offline to mitigate the risk,” reads Rubrik’s security advisory.

“An investigation supported by a third party forensic partner has confirmed that the incident was isolated to this one server and we found no evidence of unauthorized access to any data we secure on behalf of our customers, or our internal code.”

However, Rubrik says that a small number of log files contained access information, causing the company to rotate authentication keys out of an abundance of caution.

The company says that there are no signs that this information was misused.

Furthermore, Rubrik says their investigation has not found evidence that the threat actors gained access to customer data or their internal source code.

Rubrik previously suffered a data breach in 2023 after the company’s data was stolen as part of the wide-scale Fortra GoAnywhere data theft attacks by the Clop ransomware gang.

]]>
https://earlybirdsinvest.com/rubrik-rotates-authentication-keys-after-log-server-breach/feed/ 0 23107
Adin Ross and FaZe Banks to Launch Crypto-Based ‘GTA 6’ Server https://earlybirdsinvest.com/adin-ross-and-faze-banks-to-launch-crypto-based-gta-6-server/ https://earlybirdsinvest.com/adin-ross-and-faze-banks-to-launch-crypto-based-gta-6-server/#respond Fri, 07 Feb 2025 08:09:09 +0000 https://earlybirdsinvest.com/adin-ross-and-faze-banks-to-launch-crypto-based-gta-6-server/

Adin Ross and Richard “FaZe Banks” Bengtson have revealed their plans to create a custom server for Grand Theft Auto 6 (GTA 6) that integrates cryptocurrency into the game’s economy.

The duo, known for their influence in the gaming and streaming communities, intends to launch the server with its own cryptocurrency, providing a new type of in-game economy.

However, despite their ambitious plans, history suggests that Rockstar Games, the developer of the GTA franchise, is unlikely to allow the use of cryptocurrency in the game.

Adin Ross and FaZe Banks to Launch Crypto-Based 'GTA 6' Server
Source: Ryan on X (@scubaryan_)

A Crypto-Powered ‘GTA 6’ Server

In a recent livestream, Adin Ross shared the vision for a new GTA 6 server, stating that it would be entirely focused on cryptocurrency. He and FaZe Banks plan to create a server that would not only incorporate a new digital coin but also promote a crypto-based in-game economy. Ross described the server as potentially the largest of its kind.

FaZe Banks further explained that the server would rely heavily on the new coin for transactions, giving players the opportunity to participate in a decentralised economy.

Both Ross and Banks are planning significant financial investment to ensure the server’s success, positioning the project as a groundbreaking development in the gaming space. However, the plans for this crypto-fueled GTA 6 server could be hampered by Rockstar’s historical stance on cryptocurrency.

Adin Ross and FaZe Banks to Launch Crypto-Based 'GTA 6' Server
Source: Rockstar Games

Rockstar Games’ History with Crypto Bans

In 2022, Rockstar Games published an article clarifying its position on the use of cryptocurrencies and NFTs in GTA Online and Red Dead Online. The company prohibited the integration of these technologies into player-run servers, citing concerns over their impact on the game’s economy and user experience.

This decision led to the closure of several fan-made GTA servers that had introduced crypto and NFT-based assets. Notably, rapper Lil Durk’s The Trenches server, which featured NFTs, was forced to shut down after Rockstar’s parent company, Take-Two Interactive, issued legal notices to those operating the server. The crackdown suggests that if Ross and Banks move forward with their plans, they will likely face legal obstacles from Rockstar, which has consistently maintained a policy of limiting crypto use in its games.

Despite Rockstar’s firm stance, there are ongoing rumors suggesting that GTA 6 might represent a change in the company’s attitude toward cryptocurrency. Speculation has surfaced that the upcoming title could introduce in-game cryptocurrency rewards or allow for crypto payments. However, these rumors remain unconfirmed, and Rockstar has yet to provide any official comment on the matter.

Additionally, Take-Two Interactive, the parent company of Rockstar, has expressed interest in blockchain technology through its acquisition of mobile game publisher Zynga in 2022. Zynga has been involved in the development of NFT-based games, which could suggest that Take-Two is exploring opportunities in the web3 space, though it is unclear whether this will have any impact on the GTA franchise.

Whilst it is uncertain whether Rockstar’s policies will evolve, the launch of GTA 6 will be a key moment in determining whether the company is willing to allow crypto integration. Ross and Banks’ plans may ultimately depend on Rockstar’s stance when the game is released later this year.

]]>
https://earlybirdsinvest.com/adin-ross-and-faze-banks-to-launch-crypto-based-gta-6-server/feed/ 0 17938