Blockchain security company CertiK has issued an urgent update to OKX wallet users on iPhone following the discovery of a major security vulnerability in the iOS application.
In a post dated Dec. 19 on X, CertiK urgently advised OKX wallet users on iPhones to upgrade their app to the latest version. The security flaw identified in the OKX iOS application posed a risk of compromising sensitive user data and cryptocurrency assets.
🚨 Attention! We urge users of OKX wallets to update their iOS app to the latest version immediately. Earlier this month, we identified and reported a critical Remote Code Execution (RCE) vulnerability in the OKX iOS App, leading to potential compromise of sensitive data and…
— CertiK (@CertiK) December 19, 2023
Earlier this month, Certik identified and reported a critical Remote Code Execution (RCE) vulnerability in the OKX iOS App, “leading to potential compromise of sensitive data and crypto assets,” the blockchain security firm added.
In response, OKX released an update to their iOS application, version 6.45.0, on Dec. 19, addressing this vulnerability. CertiK later confirmed that the security issue had been resolved and stated that no customer assets were affected by this vulnerability.
Quick disclosure sparks debate
However, this incident has raised concerns about the disclosure of such vulnerabilities. MetaMask lead Tay Monahan expressed criticism over the timing of the vulnerability’s disclosure, suggesting that revealing the issue on the same day as the release of the fix could leave many users at risk.
Wait wait wait wait hold up
How long does it take their user base to get majority updated historically?
Like, it takes time to roll out updates. Like weeks, months.
And yet you’re disclosing there’s a vuln that could rekt all users remotely THE DAY OF?
— Tay đź’– (@tayvano_) December 19, 2023
Monahan highlighted the time it typically takes for a user base to update to the latest version of an app, which could range from weeks to months.
Adding to the confusion, there was some discrepancy in the version number of the update containing the fix. While CertiK referred to the updated version as 6.46.0, OKX mentioned version 6.45.0, which was actually released on Dec. 11. The exact version containing the necessary security fix remains unclear.
This incident underscores the vulnerability of cryptocurrency wallets and exchanges to cyber attacks. Recent months have seen a surge in such incidents, including a $114 million theft from Poloniex in November, a $100 million heist involving HTX and the Heco cross-chain bridge, and a $35 million loss by Atomic wallet users in June following an iOS app update.
Hackers’ continuous targeting of these platforms highlights the critical need for robust security measures in the cryptocurrency industry.
Source: https://crypto.news/certik-urges-immediate-ios-update-for-okx-users-amidst-major-security-risk/