Get the latest BitBoxApp here: https://shiftcrypto.ch/download
Security first
What happened?
On 21 May 2022, Dmitry Zemlyakov responsibly disclosed through our bug bounty program a vulnerability in the BitBoxApp installer for Windows that potentially allows an attacker to run malware under admin privileges during the installation process. This issue is resolved with this update.
We have found no evidence that the vulnerability was exploited. We would like to thank Dmitry Zemlyakov for his support in improving the security of our products.
Technical details
The BitBoxApp installer on Windows calls the "taskkill" Windows system command to close a running BitBoxApp process so that it can update the BitBoxApp executable. If an attacker manages to place an executable named "taskkill" in the same folder as the BitBoxApp installer (usually the Downloads folder) before you run the installer, that executable would run instead of the system command, potentially running malware.
This update eliminates this risk by not calling "taskkill" anymore.
Am I at risk?
No action is required, this release simply improves your overall system security for this and future updates. In general, the BitBox02 hardware wallet is designed to protect you from potential malware running on your computer or mobile phone accessing your crypto funds, even the BitBoxApp itself. This vulnerability poses no additional risk in this regard. By verifying receive addresses and transactions on the BitBox02, the risk is greatly reduced that malware on the computer can gain access to your funds. Please always make sure to properly verify every action on the BitBox02.
EIP-712: Ethereum typed structured data
EIP is short for “Ethereum Improvement Proposal”. Since Ethereum is an open protocol, anyone is able to make a proposal and it can be implemented if there is consensus by the community.
EIP-712 is a standard for message signing that allows data to be displayed in a human-readable format so the user can verify what they are signing which improves security and usability. Before EIP712, a user could not easily verify what they were signing, since it was only displayed as a hexadecimal string instead of in a human-readable format.
Although this standard was proposed in 2017, it only recently gained traction, especially with smart contracts to list NFTs on platforms such as OpenSea, and others. This firmware update now enables BitBox users to use these services in a more transparent and secure manner.
Various smaller improvements
We continue to improve the user interface of the BitBoxApp and implement best practices. The portfolio view is an example of this: it now shows full-size placeholders indicating that it’s loading data, preventing other content to move once the graph is shown.
Another example comes from an external contributor, updating the BitBoxApp macOS icon according to the new Apple design guidelines. Thanks a lot, Valid Block!
Check out the technical change log of the BitBoxApp and the BitBox02 firmware for a complete list of changes.
How can I stay up-to-date?
We encourage you to sign up to the BitBox news to stay up to date with our latest news, including release notes and bug fixes.
Thank you for being part of the BitBox family!
Shift Crypto is a privately-held company based in Zurich, Switzerland. Our team of Bitcoin contributors, crypto experts, and security engineers builds products that enable customers to enjoy a stress-free journey from novice to mastery level of cryptocurrency management. The BitBox02, our second generation hardware wallet, lets users store, protect, and transact Bitcoin and other cryptocurrencies with ease - along with its software companion, the BitBoxApp.