Wie kann ich überprüfen, ob der Trezor Suite Download echt ist?

[root_s2yse8vt]

Up

0

Down

::

Der jüngste Phishing-Betrug macht deutlich, wie wichtig die Überprüfung von Software ist. Wenn die Trezor Suite anzeigt, dass es einen neuen Download gibt, wie kann dieser vor der Installation überprüft werden?

Welche Schritte unternimmt Trezor, um sicherzustellen, dass die Infrastruktur für die Softwareverteilung nicht kompromittiert wird, wie im Fall der [SolarWinds supply chain exploit](https://en.wikipedia.org/wiki/2020_United_States_federal_government_data_breach)?

[SilverTruth7809]

Up

0

Down

::

https://wiki.trezor.io/Apps:Trezor_Suite#How_to_verify_the_binaries

[yepimthetoaster]

Up

0

Down

::

What I can at least tell you about [that new phish email scam](https://i.imgur.com/3tqY1tQ.png) (sent from a fake domain, „trezor.us“, created yesterday that Trezor has already been able to get taken down) is that it leads you to a fake Trezor Suite download url, and the way in this case that you can tell that it is a fake Trezor Suite url is that the real Trezor Suite site url is „trezor.suite.io“.

But the url that that scam email sent me to was slightly, barely noticeably different with one of the letters in „trezor“ in the url (it said „suite.ţrezor“ instead in the url).

And that was just the fake url I was sent to. I saw another user on here saying their download url was also similar in that email sent yesterday, but there’s had a different „e“ in „trezor“ or „suite“, so whoever’s sending those phishing links has multiple versions.

So to kind of answer your question, the easy way scammers make fake Trezor Suite download links is to slightly change the url in hard to notice ways, at least that’s the way they did it in this case.

[Autor]

Beiträge