- Coinbase users spotted a flaw in their Account Activity logs
- The logs were showing failed login attempts as failed 2FA codes
- The bug was apparently used in social engineering, but there is no evidence
The two-factor authentication (2FA) error on Coinbase, one of the biggest cryptocurrency trading platforms in the world, was finally fixed.
In early April, Coinbase customers started noticing that their Account Activity logs showed “2-step verification failed” entries. These would suggest that someone tried to log in using valid credentials but was only stopped after entering the wrong 2FA code.
Coinbase (and a few media, including BleepingComputer) was soon notified about the messages, and launched an investigation. Apparently, the log was showing when someone tried to log in using the wrong credentials, but erroneously listed it as “2-step verification failed”. In some instances, the log would also show the “second_factor_failure” message, which basically meant the same thing.
Second increase
The platform has since addressed the issue and updated the log so that it displays a “Password attempt failed” message instead.
Although it might sound trivial, BleepingComputer says fixing errors like this is “essential”, not to cause unnecessary panic. Apparently, some users reached out to say that they were resetting their passwords and “spent hours” trying to figure out if their accounts were hacked or not.
Furthermore, the publication argues that wrong labels could be abused in social engineering attacks, with crooks convincing victims that their accounts were compromised and tricking them into making wrong decisions.
Being one of the largest cryptocurrency trading platforms out there, Coinbase is often the target of different scams. Crypto is a hotbed for cybercriminals, since it still mostly operates in the grey zone and since funds, once transferred, are impossible to retrieve. Furthermore some tokens, such as Monero, grant their users high levels of anonymity and privacy, making it almost impossible to determine the identity of scammers and cybercriminals.
Via BleepingComputer
Leave a comment