{"id":562938,"date":"2023-03-13T07:08:54","date_gmt":"2023-03-13T04:08:54","guid":{"rendered":"https:\/\/en.buradabiliyorum.com\/opensea-patches-vulnerability-that-potentially-exposed-users-identities\/"},"modified":"2023-03-13T07:08:54","modified_gmt":"2023-03-13T04:08:54","slug":"opensea-patches-vulnerability-that-potentially-exposed-users-identities","status":"publish","type":"post","link":"https:\/\/buradabiliyorum.com\/en\/opensea-patches-vulnerability-that-potentially-exposed-users-identities\/","title":{"rendered":"# OpenSea patches vulnerability that potentially exposed users\u2019 identities"},"content":{"rendered":"<div id=\"ez-toc-container\" class=\"ez-toc-v2_0_84 counter-hierarchy ez-toc-counter ez-toc-custom ez-toc-container-direction\">\n<p class=\"ez-toc-title\" style=\"cursor:inherit\">Table of Contents<\/p>\n<label for=\"ez-toc-cssicon-toggle-item-6a2325c27650a\" class=\"ez-toc-cssicon-toggle-label\"><span class=\"\"><span class=\"eztoc-hide\" style=\"display:none;\">Toggle<\/span><span class=\"ez-toc-icon-toggle-span\"><svg style=\"fill: #dd3333;color:#dd3333\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" class=\"list-377408\" width=\"20px\" height=\"20px\" viewBox=\"0 0 24 24\" fill=\"none\"><path d=\"M6 6H4v2h2V6zm14 0H8v2h12V6zM4 11h2v2H4v-2zm16 0H8v2h12v-2zM4 16h2v2H4v-2zm16 0H8v2h12v-2z\" fill=\"currentColor\"><\/path><\/svg><svg style=\"fill: #dd3333;color:#dd3333\" class=\"arrow-unsorted-368013\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"10px\" height=\"10px\" viewBox=\"0 0 24 24\" version=\"1.2\" baseProfile=\"tiny\"><path d=\"M18.2 9.3l-6.2-6.3-6.2 6.3c-.2.2-.3.4-.3.7s.1.5.3.7c.2.2.4.3.7.3h11c.3 0 .5-.1.7-.3.2-.2.3-.5.3-.7s-.1-.5-.3-.7zM5.8 14.7l6.2 6.3 6.2-6.3c.2-.2.3-.5.3-.7s-.1-.5-.3-.7c-.2-.2-.4-.3-.7-.3h-11c-.3 0-.5.1-.7.3-.2.2-.3.5-.3.7s.1.5.3.7z\"\/><\/svg><\/span><\/span><\/label><input type=\"checkbox\"  id=\"ez-toc-cssicon-toggle-item-6a2325c27650a\" checked aria-label=\"Toggle\" \/><nav><ul class='ez-toc-list ez-toc-list-level-1 ' ><li class='ez-toc-page-1 ez-toc-heading-level-1'><a class=\"ez-toc-link ez-toc-heading-1\" href=\"https:\/\/buradabiliyorum.com\/en\/opensea-patches-vulnerability-that-potentially-exposed-users-identities\/#%E2%80%9D_OpenSea_patches_vulnerability_that_potentially_exposed_users_identities_%E2%80%9C\" >&#8221; OpenSea patches vulnerability that potentially exposed users\u2019 identities &#8220;<\/a><\/li><\/ul><\/nav><\/div>\n<h1><span class=\"ez-toc-section\" id=\"%E2%80%9D_OpenSea_patches_vulnerability_that_potentially_exposed_users_identities_%E2%80%9C\"><\/span>&#8221; OpenSea patches vulnerability that potentially exposed users\u2019 identities &#8220;<span class=\"ez-toc-section-end\"><\/span><\/h1>\n<div class=\"post-content\" data-v-48054ca8>Nonfungible token (NFT) marketplace OpenSea has reportedly patched a vulnerability that, if exploited, could expose identifying information about its anonymous users.\u00a0<\/p>\n<p>In a Mar. 9 <a rel=\"nofollow noopener\" target=\"_blank\" href=\"https:\/\/www.imperva.com\/blog\/deanonymizing-opensea-nft-owners-via-xs-leaks-vulnerability\/\">blog<\/a>, cybersecurity firm Imperva detailed how it discovered the vulnerability which it claimed could deanonymize OpenSea users \u201cby linking an IP address, a browser session, or an email in certain conditions\u201d to an NFT.<\/p>\n<p>As the NFT corresponds to a cryptocurrency wallet address, a user\u2019s real identity could be revealed from the information gathered and linked to the wallet and its activity, explained Imperva.<\/p>\n<blockquote class=\"twitter-tweet\">\n<p lang=\"en\" dir=\"ltr\">Imperva Red Team discovered a cross-site search vulnerability affecting the <a rel=\"nofollow noopener\" target=\"_blank\" href=\"https:\/\/twitter.com\/hashtag\/NFT?src=hash&amp;ref_src=twsrc%5Etfw\">#NFT<\/a> marketplace <a rel=\"nofollow noopener\" target=\"_blank\" href=\"https:\/\/twitter.com\/hashtag\/OpenSea?src=hash&amp;ref_src=twsrc%5Etfw\">#OpenSea<\/a>.<\/p>\n<p>This vulnerability allows for the deanonymization of users, potentially revealing a user&#8217;s identity. <a rel=\"nofollow noopener\" target=\"_blank\" href=\"https:\/\/t.co\/nGQWceeGEc\">https:\/\/t.co\/nGQWceeGEc<\/a><\/p>\n<p>\u2014 Imperva (@Imperva) <a rel=\"nofollow noopener\" target=\"_blank\" href=\"https:\/\/twitter.com\/Imperva\/status\/1633832032756449280?ref_src=twsrc%5Etfw\">March 9, 2023<\/a><\/p><\/blockquote>\n<p><script async src=\"https:\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script>The exploit is understood to have taken advantage of a cross-site search vulnerability. Imperva claimed OpenSea had misconfigured a library that resizes webpage elements that load HTML content from elsewhere which are typically used to place ads, interactive content, or embedded videos.<\/p>\n<p>As OpenSea didn\u2019t restrict this library\u2019s communications, exploiters could use the information it broadcasts as an \u201coracle\u201d to narrow down when searches return no results as the webpage would be smaller.<\/p>\n<p>Imperva detailed that an attacker would send their target a link through email or SMS which if clicked \u201creveals valuable information, such as the target\u2019s IP address, user agent, device details, and software versions.\u201d<\/p>\n<figure><img decoding=\"async\" src=\"https:\/\/s3.cointelegraph.com\/uploads\/2023-03\/9f3cc426-d5c1-4528-9b62-e2bece1862df.PNG\"><figcaption style=\"text-align: center;\"><em>Screenshot of OpenSea&#8217;s front page. Source: OpenSea<\/em><\/figcaption><\/figure>\n<p>The attacker would then use OpenSea\u2019s vulnerability to extract the NFT names of their target and associate the corresponding wallet address with identifying information such as an email or phone number which was sent the original link.<\/p>\n<p>Imperva said OpenSea \u201cquickly addressed the issue\u201d and properly restricted the library\u2019s communications and reported the platform \u201cwas no longer at risk of such attacks.\u201d<\/p>\n<p><strong><em>Related: <\/em><\/strong><strong><em>Security team creates dashboard to detect potential NFT hacks in OpenSea<\/em><\/strong><\/p>\n<p>Users of the platform have long been victims of attacks that mimic OpenSea\u2019s functions to undertake exploits, such as phishing websites that resemble the platform or signature requests <a href=\"https:\/\/buradabiliyorum.com\/en\/category\/download-scripts-themes-apps\/\" data-internallinksmanager029f6b8e52c=\"9\" title=\"Download Scripts &amp; Themes &amp; Apps\" target=\"_blank\" rel=\"noopener\">app<\/a>earing to originate from OpenSea.<\/p>\n<p>OpenSea itself has faced criticism for its platform security due to a major phishing attack in February 2022 that resulted in over $1.7 million worth of NFTs being stolen from users.<\/p>\n<p>As for the recent patch, it\u2019s unknown how long it existed or if any users had been affected by the exploit.<\/p>\n<p>OpenSea did not im<a href=\"https:\/\/buradabiliyorum.com\/en\/category\/social-mediaa\/\" data-internallinksmanager029f6b8e52c=\"1\" title=\"Social Media\" target=\"_blank\" rel=\"noopener\">media<\/a>tely respond to Cointelegraph\u2019s request for comment.<\/p>\n<p><template data-name=\"subscription_form\" data-type=\"nifty_newsletter\"><\/template><\/div>\n<blockquote><p><strong><span style=\"color: #ff6600;\">If you liked the article, do not forget to share it with your friends. Follow us on\u00a0<span style=\"color: #ff0000;\"><a style=\"color: #ff0000;\" href=\"https:\/\/news.google.com\/publications\/CAAqBwgKMLG0nwswvr63Aw\" target=\"_blank\" rel=\"nofollow noopener noreferrer\">Google News<\/a><\/span>\u00a0too, click on the star and choose us from your favorites.<\/span><\/strong><\/p><\/blockquote>\n<blockquote>\n<p style=\"text-align: center;\">For forums sites go to <span style=\"color: #ff9900;\"><a style=\"color: #ff9900;\" href=\"https:\/\/forum.buradabiliyorum.com\/\" target=\"_blank\" rel=\"noopener\">Forum.BuradaBiliyorum.Com<\/a><\/span><\/strong>\n<\/p><\/blockquote>\n<blockquote>\n<p style=\"text-align: center;\"><strong>If you want to read more <a href=\"https:\/\/buradabiliyorum.com\/en\/category\/news\/\" data-internallinksmanager029f6b8e52c=\"2\" title=\"News\" target=\"_blank\" rel=\"noopener\">News<\/a> articles, you can visit our <span style=\"color: #ff9900;\"><a style=\"color: #ff9900;\" href=\"https:\/\/en.buradabiliyorum.com\/general\/\" target=\"_blank\" rel=\"noopener\">General category.<\/a><\/span><\/strong><\/p>\n<\/blockquote>\n<p><span style=\"color: black;\"><a style=\"color: #ff9900;\" href=\"https:\/\/cointelegraph.com\/news\/opensea-patches-vulnerability-that-potentially-exposed-users-identities\" target=\"_blank\" rel=\"noopener\">Source<\/a><\/span><\/p>\n","protected":false},"excerpt":{"rendered":"<p>&#8221; OpenSea patches vulnerability that potentially exposed users\u2019 identities &#8220; Nonfungible token (NFT) marketplace OpenSea has reportedly patched a vulnerability that, if exploited, could expose identifying information about its anonymous users.\u00a0 In a Mar. 9 blog, cybersecurity firm Imperva detailed how it discovered the vulnerability which it claimed could deanonymize OpenSea users \u201cby linking an&#8230;<\/p>\n","protected":false},"author":1,"featured_media":562939,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"fifu_image_url":"https:\/\/images.cointelegraph.com\/cdn-cgi\/image\/format=auto,onerror=redirect,quality=90,width=1200\/https:\/\/s3.cointelegraph.com\/uploads\/2023-03\/e3cca07e-0279-42cd-8049-55b6d6fa57ac.jpg","fifu_image_alt":"","footnotes":""},"categories":[1],"tags":[74882,95118,133792,70944,86389],"class_list":["post-562938","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-general","tag-hacks","tag-nft","tag-opensea","tag-hackers","tag-marketplace"],"_links":{"self":[{"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/posts\/562938","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/comments?post=562938"}],"version-history":[{"count":0,"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/posts\/562938\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/media\/562939"}],"wp:attachment":[{"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/media?parent=562938"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/categories?post=562938"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/tags?post=562938"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}