PT-2024-20010 · Binance+1 · Binance Trust Wallet+1

Outoflegend + 1 · Published 2024-02-08 · Updated 2024-02-23 · CVE-2024-23660

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Binance Trust Wallet app for iOS version 0.0.4

Description The Binance Trust Wallet app for iOS misuses the trezor-crypto library, generating mnemonic words that use the device time as the only entropy source. This has led to economic losses, as the issue has been exploited in the wild. An attacker can systematically generate mnemonics for each timestamp within an applicable timeframe and link them to specific wallet addresses to steal funds.

Recommendations For version 0.0.4, consider disabling the use of the trezor-crypto library until a patch is available to prevent the generation of predictable mnemonic words. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Weakness Enumeration

CWE-338

Related Identifiers

CVE-2024-23660

Affected Products

Binance Trust Wallet

Trezor-Crypto

References · 8

• 🔥 https://milksad.info/posts/research-update-5 · Exploit
• 🔥 https://secbit.io/blog/en/2024/01/19/trust-wallets-fomo3d-summer-vuln · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-23660 · Security Note
• https://osv.dev/vulnerability/CVE-2024-23660 · Vendor Advisory
• https://twitter.com/CVEnew/status/1755686715186979284 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1755709903438487721 · Twitter Post
• https://twitter.com/CSSCD_AU/status/1761088537347109180 · Twitter Post
• https://twitter.com/0xSboji/status/1758981551298412799 · Twitter Post