Coinbase 2FA error fixed after many believed their account was hacked

1 month ago 205

(Image credit: Coinbase) (Image credit: Coinbase)

Coinbase users spotted a flaw in their Account Activity logs
The logs were showing failed login attempts as failed 2FA codes
The bug was apparently used in social engineering, but there is no evidence

The two-factor authentication (2FA) error on Coinbase, one of the biggest cryptocurrency trading platforms in the world, was finally fixed.

In early April, Coinbase customers started noticing that their Account Activity logs showed “2-step verification failed” entries. These would suggest that someone tried to log in using valid credentials but was only stopped after entering the wrong 2FA code.

Coinbase (and a few media, including BleepingComputer) was soon notified about the messages, and launched an investigation. Apparently, the log was showing when someone tried to log in using the wrong credentials, but erroneously listed it as “2-step verification failed”. In some instances, the log would also show the “second_factor_failure” message, which basically meant the same thing.

Second increase

The platform has since addressed the issue and updated the log so that it displays a “Password attempt failed” message instead.

Although it might sound trivial, BleepingComputer says fixing errors like this is “essential”, not to cause unnecessary panic. Apparently, some users reached out to say that they were resetting their passwords and “spent hours” trying to figure out if their accounts were hacked or not.

Furthermore, the publication argues that wrong labels could be abused in social engineering attacks, with crooks convincing victims that their accounts were compromised and tricking them into making wrong decisions.

Being one of the largest cryptocurrency trading platforms out there, Coinbase is often the target of different scams. Crypto is a hotbed for cybercriminals, since it still mostly operates in the grey zone and since funds, once transferred, are impossible to retrieve. Furthermore some tokens, such as Monero, grant their users high levels of anonymity and privacy, making it almost impossible to determine the identity of scammers and cybercriminals.

Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed!

Via BleepingComputer

US government warns this popular CMS software has a worrying security flaw
Take a look at our guide to the best authenticator app
We've rounded up the best password managers

Sead is a seasoned freelance journalist based in Sarajevo, Bosnia and Herzegovina. He writes about IT (cloud, IoT, 5G, VPN) and cybersecurity (ransomware, data breaches, laws and regulations). In his career, spanning more than a decade, he’s written for numerous media outlets, including Al Jazeera Balkans. He’s also held several modules on content writing for Represent Communications.

Read Entire Article