Cryptocurrency wallet BitGo has issued a fix for a critical vulnerability impacting its Ethereum TSS wallets, SiliconAngle reports.
Identified by Fireblocks, the flaw, which was dubbed "Zero Proof Vulnerability," involved the exploitation of an incomplete Elliptic Curve Digital Signature Algorithm TSS protocol layer, enabling threat actors to evade security defenses and compromise the Ethereum private keys of BitGo users.
BitGo was noted by Fireblocks to have taken down the service upon its notification in December.
FireBlocks also said that there was "coordinated disclosure" with BitGo, but the cryptocurrency firm noted that the digital asset custody firm was exaggerating the potential impact of the vulnerability as the impacted wallet was only accessible to 20 developers.
"It is unusual for a firm to repeatedly contact reporters, regulators and clients about a known issue in a pre-release product, and we are surprised that Fireblocks decided to take that path after we informed them that this was early release software," said BitGo.
Included in the exposed dataset labeled "PDL" were individuals' full names, email addresses, phone numbers, location data, professional summaries, and skills, as well as education and employment histories.
Attackers could leverage the issue — which impacts Nexus 3000, 7000, and 9000 series switches with vulnerable NX-OS versions with DHCPv6 activated and are in standalone NX-OS mode — to facilitate continuous crashes of the dhcp_snoop process and a denial-of-service condition.
Higher rewards of up to $250,000 will be given by Google for the discovery of memory corruption flaws in the Chrome browser shown to achieve remote code execution using a non-sandboxed process as part of a more robust vulnerability reward program.