Research: Serious Shortcomings Exist in OKX Security Settings
Author: Dilation Effect Link: https://x.com/dilationeffect/status/1800116534133792841 Given the recent security incidents involving OKX users, we were curious about the causes of these attacks. As ordinary users, we decided to spend half an hour conducting a quick analysis of OKX’s user security settings, and the results were quite surprising. Note: The analysis was conducted on June 10, 2024, at 5 PM Singapore Time. 1. Despite users binding Google Authenticator (GA), verification allows switching to lower security methods, bypassing GA verification. Users bind GA considering its higher security level. However, OKX allows switching to lower security verification methods, such as SMS, during sensitive user operations like adding a whitelist address, withdrawals, and various verification changes, effectively bypassing GA verification. 2. Sensitive user operations, such as disabling phone verification, disabling GA verification, and changing the login password, do not trigger a 24-hour withdrawal ban. The withdrawal ban only triggers when logging in on a new device, representing a compromise in the risk control measures for password changes. 3. Whitelist address withdrawals do not employ dynamic verification based on withdrawal amounts. Once an address is added to the whitelist, withdrawals up to the limit can proceed without additional verification. Unlike other exchanges that set a limit requiring re-verification for larger amounts. This quick analysis reveals that OKX’s security settings lack baseline design. Possibly to enhance user experience, OKX has made significant compromises in security. Whether this design is good or bad, users will make their own judgments and choices. Dilation Effect would like to remind users to bind GA to their accounts. Otherwise, they may end up working for hackers, as email and SMS are easily susceptible to attacks. Follow us Wu Blockchain is free today. But if you enjoyed this post, you can tell Wu Blockchain that their writing is valuable by pledging a future subscription. You won't be charged unless they enable payments. |
Older messages
Asia's weekly TOP10 crypto news (Jun 3 to Jun 9)
Sunday, June 9, 2024
1. Hong Kong Regulatory News This Week 1.1 Hong Kong Officials Visit Europe to Promote Web3 link On June 3, Christopher Hui, Secretary for Financial Services and the Treasury of Hong Kong, embarked on
Weekly Project Updates: EigenLayer Achieves Record TVL, Wormhole Launches Governance, StarkWare Backs Bitcoin Scal…
Saturday, June 8, 2024
1. EigenLayer TVL Surpasses $2 Billion, Continues to Achieve Historic Highs link EigenLayer's Total Value Locked (TVL) has surpassed $2 billion, marking a historical high and solidifying its
WuBlockchain Weekly: ECB Lowers Interest Rates, Bybit Unexpectedly Opens Registration for Mainland China Users, Bi…
Friday, June 7, 2024
1. Bitcoin Spot ETF Sees $887 Million Net Inflows on June 4, Sustains 17-Day Inflow Streak link On June 4, Grayscale's GBTC ETF experienced a net inflow of $28.195 million. On the same day, the
Mining News in May:Tether Mega-Investment, Riot Wants to Acquire BitFarms, Canaan's New Models, sponsored by Bitde…
Wednesday, June 5, 2024
Title sponsored by Bitdeer, a NASDAQ-listed mining company. 1. Bitdeer announces up to $150 million in private placement funding. Tether regard Bitdeer as one of the strongest vertically integrated
In-depth Analysis: Why was the Binance Account Stolen after Using the Malicious Plug-in?
Tuesday, June 4, 2024
By:@SlowMist_Team Source:https://web3caff.com/zh/archives/94779 https://foresightnews.pro/article/detail/61654 On March 1, 2024, according to Twitter user @doomxbt, there was an abnormal situation with
You Might Also Like
DOO, DAO, or DOC? | BanklessDAO Weekly Rollup
Saturday, September 28, 2024
Catch Up With What Happened This Week in BanklessDAO ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏
Senator Lummis predicts SEC Chair Gensler will step down next year if Trump is elected
Saturday, September 28, 2024
The SEC Chair will "certainly" not maintain his role under a Trump government, but a Harris presidency might also end his term. ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏
🥛 How to check your portfolio’s pulse 🫀
Saturday, September 28, 2024
Key metrics we're using to track the health of our investments... 🔑
P2P Off-Chain Payments: An Indispensable Map for the Future of Crypto Payments
Saturday, September 28, 2024
Recently, the first fully Bitcoin-isomorphic Layer2 solution CKB released a prototype of Fiber Network, a next-generation common Lightning Network built on Nervos CKB and off-chain channels. ͏ ͏ ͏ ͏ ͏
Weekly Project Updates: Celestia's OTC Token Sales Spark Community Backlash, EIGEN Set to Launch Trading Next Mond…
Saturday, September 28, 2024
The community has expressed strong criticism of the Celestia Foundation's OTC token sales, accusing them of failing to provide necessary transparency to the public. ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏
🥛 Is crypto’s vibecession over? 🙃
Friday, September 27, 2024
PLUS: $BTC ETFs hit highest net inflows since July 💪
SEC chair Gensler reaffirms Bitcoin’s commodity status, criticizes industry’s disregard of rules
Friday, September 27, 2024
SEC Chair Gary Gensler reaffirms Bitcoin's non-security status while criticizing industry non-compliance amid SEC scrutiny. ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏
WuBlockchain Weekly: China Unveils Massive Stimulus Measures, Harris Integrates Cryptocurrency into Her, etc
Friday, September 27, 2024
On Tuesday, China's central bank announced its largest stimulus measures since the pandemic began, aiming to lift the economy out of deflation and return to government growth targets. ͏ ͏ ͏ ͏ ͏ ͏ ͏
L2 Race Heats up in September: Base Leads the Way | Layer 2 Review
Thursday, September 26, 2024
Quick Reads and Hot Links Covering the People and Projects Who Are Scaling Ethereum ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏
🥛 Is Uniswap the Amazon of crypto? 🤔
Thursday, September 26, 2024
PLUS: Crypto only makes up ~0.1% of global asset value 📊 We're still early!