Keystone kompaniyasi 26-oktabrda e'lon qilgan bayonotida, uning veb-saytiga kirish huquqiga ega bo'lgan hujumchi apparat hamyonlarining haqiqiyligini isbotlash uchun ishlatiladigan kalitni qo'lga kiritganini aytdi.
Ushbu kalitga ega bo'lgan kishi onlayn tekshiruvdan o'tadigan soxta qurilmalarni yasashi mumkin, bu esa egalarining o'z qurilmalarining haqiqiyligini tekshirish uchun foydalanadigan tekshiruvdir. Soxta qurilmaga ishonch bildirgan xaridorning kriptovalyutasi o'g'irlanishi mumkin, ammo hodisa egalarining tiklanish iboralari yoki hamyon shaxsiy kalitlari bilan bog'liq emas edi.
Keystone kalitni o'z ichiga olgan 18 835 ta sotilmagan qurilmani yo'q qiladi va barcha yangi qurilmalar yangi kalit oladi.
Keystone 20-oktabrda ruxsatsiz kirishni aniqladi va egalariga beradigan maslahat qurilma qachon yetib kelganiga bog'liq. 20-oktabrdan keyin eski kalit bilan yetib kelgan qurilma haqida kompaniya shunday dedi: "Agar bunday qurilma autentifikatsiyadan o'tsa ham, uning soxta ekanligini to'liq inkor eta olmaymiz."
Bunday qurilma egasi Keystone qo'llab-quvvatlash xizmati bilan bog'lanishi va uni faqat kompaniya haqiqiyligini tasdiqlaganidan keyin ishlatishi kerak.
20-oktabrdan oldin yetkazilgan va tekshiruvdan o'tgan qurilmani haqiqiy deb hisoblash va odatdagidek ishlatish mumkin, deb aytdi Keystone. Kompaniya hujumchi birinchi marta qachon kirganini aytmagan.
Kompaniya ma'lumotiga ko'ra, hujumchi Keystone veb-sayti foydalanadigan uchinchi tomon ma'lumot monitoring vositasidagi zaiflikdan foydalanib, huquqlarni oshirishga muvaffaq bo'ldi. Bu hujumchiga mijoz ma'lumotlari va kalitni qo'lga kiritish imkonini berdi.
Keystone 20-oktabrda hujumchining kirishini to'sdi va o'shandan beri zaiflikni tuzatdi. U kalit qayerda saqlanganini aytmagan.
Qurilma Tekshiruvi Qanday Ishlaydi
Egasi Keystone tekshirish sahifasidagi QR kodni qurilma bilan skanerlaydi, so'ngra qurilma ko'rsatadigan kodni sahifaga kiritadi.
Keystone ochiq manbali dasturiy ta'minotida QR kod ushbu kodni shifrlangan shaklda o'z ichiga oladi va qurilma uni saqlangan kalit bilan shifrlaydi. Shunday qilib, to'g'ri kod qurilmaning kalitni saqlashini ko'rsatadi.
Kalit faqat ushbu tekshiruv uchun ishlatiladi. U tiklanish iboralarini yaratishda, shaxsiy kalitlarni hosil qilishda yoki tranzaksiyalarni imzolashda hech qanday rol o'ynamaydi.
Kalit nusxasiga ega bo'lgan har kim to'g'ri kodlarni ishlab chiqarishi mumkin, shuning uchun uni o'z ichiga olgan soxta qurilma tekshiruvdan o'tishi mumkin. Bunday qurilmalar mijozlarga sotilishi yoki jo'natilishi mumkin, bu esa ularning kriptovalyutasining o'g'irlanishiga olib keladi, deb aytdi Keystone. Kompaniya soxta qurilmalar yoki o'g'irliklar haqida xabar bermagan.
Kalit har bir qurilmaga ishlab chiqarish jarayonida yoziladi va o'chirilishi yoki qayta yozilishi mumkin emas. Dasturiy ta'minot uni faqat bir marta yozilishi mumkin bo'lgan xotirada saqlaydi va ikkinchi kalitni qabul qilishdan bosh tortadi. Shuning uchun allaqachon ishlab chiqarilgan qurilmalarni yangi kalitga almashtirish mumkin emas.
Mijoz Yozuvlari
Keystone birinchi marta buzilishni 24-oktabrda e'lon qildi va uchinchi tomon mijozlarning jo'natish ma'lumotlarini qo'lga kiritganini aytdi.
Hodisa 2024-yildan 2026-yilgacha Keystone veb-saytida sotib olingan 25 964 ta xaridor yozuviga ta'sir qildi, deb aytdi kompaniya 26-oktabrda. Yozuvlar ismlar, aloqa ma'lumotlari, jo'natish manzillari va buyurtma tafsilotlarini o'z ichiga oladi. Keystone onlayn do'koni Shopify'da ishlaydi, u yozuvlarni saqlagan va boshqargan.
To'lov kartasi va bank tafsilotlari hamda davlat shaxsni tasdiqlovchi raqamlar hodisaga aloqador emas, deb aytdi Keystone. Amazon va Keystone'ning boshqa savdo kanallaridan sotib olingan yozuvlar ta'sirlanmagan.
Keystone shuningdek, ehtiyot chorasi sifatida 12 873 ta to'lanmagan to'lov yozuvini ham javobiga kiritdi. Ular hech qachon tugallanmagan xaridlardan olingan ismlar, aloqa ma'lumotlari va jo'natish ma'lumotlarini o'z ichiga oladi.
Ta'sirlangan ma'lumotlarning ba'zilari allaqachon o'chirilishi kerak edi. Keystone har bir buyurtmadan 180 kun o'tgach jo'natish ma'lumotlarini o'chirishga va'da bergan edi.
Keystone yozuvlarni ommaviy o'chirish uchun qurgan avtomatlashtirilgan vosita ishonchli ishlamadi. Ba'zi o'chirishlar muvaffaqiyatsiz bo'ldi va Keystone muvaffaqiyatsizliklarni o'z vaqtida aniqlamadi.
Keystone mijozlarning shaxsiy ma'lumotlarini saqlash muddatini 180 kundan 90 kunga qisqartirmoqda, bu darhol amal qiladi. U Shopify'dan 90 kundan eski xaridorlarning shaxsiy ma'lumotlarini o'chirishni so'radi va bu 3-noyabrda bajarilishini kutmoqda. 27-oktabr holatiga ko'ra, uning maxfiylik siyosati hali ham 180 kunni ko'rsatardi.
Keystone ta'sirlangan mijozlarga elektron pochta yubormoqda va odamlar o'z ma'lumotlari ta'sirlanganligini tekshirishi mumkin bo'lgan sahifa rejalashtirmoqda.
Keystone Egalariga Nima Qilish Kerak
Keystone ko'rsatmalari quyidagi holatlarni qamrab oladi:
- 20-oktabrdan oldin yetkazilgan: Tekshiruvdan o'tgan qurilmani odatdagidek ishlatish mumkin.
- 20-oktabrdan keyin eski kalit bilan olingan: Keystone qo'llab-quvvatlash xizmati, support@keyst.one, qurilmaning haqiqiyligini tasdiqlamaguncha qurilmani ishlatmang. Keystone bu egalariga qurilma tekshirish sahifasidagi ko'rsatmalarga amal qilishni aytdi, ammo 27-oktabr holatiga ko'ra sahifada bunday ko'rsatmalar ko'rinmadi. Keystone qurilma qaysi kalitni o'z ichiga olishini qanday aniqlashni yoki bunday qurilmaga allaqachon kriptovalyuta yuborgan egalar nima qilishlari kerakligini aytmagan.
- Keystone veb-saytidan buyurtma kutayotgan: Yangi kalitli qurilmalar tayyor bo'lguncha jo'natish to'xtatilgan. 27-oktabr holatiga ko'ra, do'kon Keystone 3 Pro ni oldindan buyurtma sifatida ro'yxatga olgan va 4-6 hafta ichida jo'natilishi kutilmoqda.
- Amazon yoki qayta sotuvchidan sotib olingan: Xuddi shu ko'rsatmalar amal qiladi, chunki ular qurilma qachon yetib kelganiga asoslanadi, qayerdan sotib olinganiga emas. Keystone rasmiy Amazon do'konlari va vakolatli qayta sotuvchilar orqali sotadi. Keystone eski kalitli qurilmalar hali ham u yerda sotilayotganini aytmagan.
- Allaqachon Keystone bilan kriptovalyuta saqlayotgan: Egalar hodisa tufayli kriptovalyutalarini ko'chirishlari shart emas, deb aytdi Keystone. 20-oktabrdan keyin eski kalit bilan olingan qurilma egasi yuqoridagi qadamlarni bajarishi kerak.
- Firibgarlik xabarlari: Qaytarish, almashtirish qurilmasi, chaqirib olish, hamyon tekshiruvi yoki kriptovalyutani ko'chirishda yordam taklif qiladigan har qanday qo'ng'iroq, matn, elektron pochta yoki xatni firibgarlik deb hisoblang. Keystone hech kimdan qurilmani qaytarishni so'ramaydi. Hech qachon buyurtma qilmagan qurilmaga tiklanish iborasini kiritmang va havolalarga amal qilish o'rniga brauzeringizga keyst.one ni yozing.
An attacker who gained access to Keystone's website obtained the key that its hardware wallets use to prove they are genuine, the company said in a statement on October 26.
Someone with that key could build counterfeit devices that pass the online check owners use to verify a Keystone. A buyer who trusted a counterfeit could have their crypto stolen, but the incident did not involve owners' recovery phrases or wallet private keys.
Keystone will destroy 18,835 unsold devices that carry the key, and all new devices will get a new one.
Keystone found the unauthorized access on October 20, and its advice to owners depends on when a device arrived. For a device received after that date with the old key, the company said: "Even if such a device passes authentication, we cannot completely rule out the possibility that it is counterfeit."
Owners of such a device should contact Keystone support and use it only after the company confirms it is genuine.
A device delivered before October 20 that passes the check can be considered genuine and used normally, according to Keystone. The company has not said when the attacker first got in.
The attacker exploited a vulnerability in a third-party data monitoring tool used by Keystone's website to escalate privileges, according to the company. That let the attacker obtain customer data and the key.
Keystone blocked the attacker's access on October 20 and has since fixed the vulnerability. It has not said where the key was stored.
How the Device Check Works
The owner scans a QR code on Keystone's verification page with the device, then enters the code the device displays on the page.
In Keystone's open-source firmware, the QR code carries that code in encrypted form, and the device decrypts it with its stored key. So a correct code shows that the device holds the key.
The key is used only for this check. It plays no part in creating recovery phrases, deriving private keys, or signing transactions.
Anyone with a copy of the key could produce the right codes, so a counterfeit device carrying it could pass the check. Such devices could be sold or shipped to customers, leading to the theft of their crypto, Keystone said. The company has not reported any counterfeit devices or thefts.
The key is written into each device during manufacturing and cannot be erased or rewritten. The firmware keeps it in memory, which can be written only once, and refuses to accept a second key. So devices already made cannot be switched to the new key.
Customer Records
Keystone first disclosed the breach on October 24, saying a third party had obtained customers' shipping information.
The incident affected 25,964 buyer records from purchases on Keystone's website between 2024 and 2026, the company said on October 26. The records hold names, contact details, shipping addresses, and order details. Keystone's online store runs on Shopify, which stored and managed the records.
Payment card and bank details and government ID numbers were not involved, Keystone said. Purchase records from Amazon and Keystone's other sales channels were not affected.
Keystone has also included 12,873 unpaid checkout records in its response as a precaution. These hold names, contact details, and shipping information from purchases that were never completed.
Some of the affected data should already have been deleted. Keystone had promised to delete shipping information 180 days after each order.
An automated tool Keystone built to erase records in bulk did not work reliably. Some deletions failed, and Keystone did not catch the failures in time.
Keystone is shortening the period it retains customers' personal data from 180 days to 90 days, effective immediately. It has asked Shopify to delete buyers' personal data older than 90 days and expects that to be done on November 3. As of October 27, its privacy policy still listed 180 days.
Keystone is emailing affected customers and plans a page where people can check whether their information was affected.
What Keystone Owners Should Do
Keystone's guidance covers these situations:
- Delivered before October 20: A device that passes the check can be used normally.
- Received after October 20 with the old key: Do not use the device until Keystone support, at support@keyst.one, confirms it is genuine. Keystone told these owners to follow instructions on its device verification page, but the page showed no such instructions as of October 27. Keystone has not said how to tell which key a device carries, or what owners who have already sent crypto to such a device should do.
- Waiting on an order from Keystone's website: Shipping is paused until devices with the new key are ready. As of October 27, the store listed the Keystone 3 Pro as a pre-order expected to ship within 4 to 6 weeks.
- Bought through Amazon or a reseller: The same guidance applies, because it is based on when a device arrived, not where it was bought. Keystone sells through Amazon official stores and authorized resellers. Keystone has not said whether devices with the old key are still on sale there.
- Already holding crypto with a Keystone: Owners do not need to move their crypto just because of the incident, Keystone said. Those with a device received after October 20 with the old key should still follow the steps above.
- Scam messages: Treat any call, text, email, or letter offering a refund, a replacement device, a recall, wallet verification, or help moving crypto as a scam. Keystone will not ask anyone to return a device. Never enter a recovery phrase into a device you did not order, and type keyst.one into your browser instead of following links.
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.