{"id":55724,"date":"2024-03-28T11:45:13","date_gmt":"2024-03-28T11:45:13","guid":{"rendered":"https:\/\/www.threatshub.org\/blog\/canonical-cracks-down-on-crypto-cons-following-snap-store-scam-spree\/"},"modified":"2024-03-28T11:45:13","modified_gmt":"2024-03-28T11:45:13","slug":"canonical-cracks-down-on-crypto-cons-following-snap-store-scam-spree","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/canonical-cracks-down-on-crypto-cons-following-snap-store-scam-spree\/","title":{"rendered":"Canonical cracks down on crypto cons following Snap Store scam spree"},"content":{"rendered":"

After multiple waves of cryptocurrency credential-stealing apps were uploaded to the Snap store, Canonical is changing its policies.<\/p>\n

In what’s expected to be a temporary measure, an announcement on the Snapcraft Discourse says that the Ubuntu vendor will switch to manual review of all new snap name registrations<\/a>. The post from Holly Hall<\/a> says:<\/p>\n

Former Ubuntu staffer Alan “Popey” Pope has detailed some of this wave of scammy apps. Firstly, a fake “Exodus” wallet app caused one user to lose nine Bitcoins<\/a> \u2013 currently worth roughly $490,000. This scam app from movementexod<\/code> was masquerading as the real Exodus wallet from Exodus Movement \u2013 a company that already offers native Debian packages alongside its Windows and Mac versions.<\/p>\n

A few days later, Popey published a follow-up post<\/a> including the response of Canonical founder and “self-appointed benevolent dictator for life” Mark Shuttleworth. You can read the discussions<\/a> of the problem<\/a> on the Snapcraft forums. (If you are inclined to join in, note that the Snapcraft Discourse instance has its own membership system, separate from the official Ubuntu instance<\/a>.)<\/p>\n

The saga did not end there. This month, he detailed ten more fake wallets<\/a> that appeared on the Snap Store, from an account called digisafe00000<\/code>. When these were removed, the next day, replacements reappeared from a new account called codeshield0x0000<\/code><\/a>. Popey also did some digging into how they work. Worse still, these fake wallets aren’t the only ones \u2013 he has a Mastodon thread<\/a> detailing others.<\/p>\n