Add Monero to Supply Chain Compromises

[maltfield]

This curated list of Supply Chain Compromises is awesome, thanks for maintaining it!

• https://github.com/cncf/tag-security/tree/main/supply-chain-security/compromises

I noticed that the Monero wallet's compromised release from 2019-11-18 is not listed in this repo.

• Wrong hashes (from getmonero.org) monero-project/monero#6151

Considering that Monero is widely considered to be the most popular/secure privacy cryptocurrency, it's easily one of the most security-critical packages that you wouldn't want to become victim to supply chain attacks..

Fortunately, they did have release signing in-place, so users were quickly able to identify the issue and address it. But it's yet another cautionary tale for project maintainers that blindly trust their infrastructure.

Further reading on this incident:

• https://web.getmonero.org/2019/11/19/warning-compromised-binaries.html
• https://old.reddit.com/r/Monero/comments/dyfozs/security_warning_cli_binaries_available_on/
• https://thehackernews.com/2019/11/hacking-monero-cryptocurrency.html

[stale]

This issue has been automatically marked as inactive because it has not had recent activity.

[lumjjb]

@maltfield thanks for opening the issue - would you be willing to make a PR for this?

[stale]

This issue has been automatically marked as inactive because it has not had recent activity.

[krol3]

@lumjjb I would like to help to do this PR

[stale]

This issue has been automatically marked as inactive because it has not had recent activity.

[maltfield]

@lumjjb can the PR be reviewed so this can be closed?

[lumjjb]

sorry that i missed this - i added a comment and updated the branch.

Once we address the comments and CI passes ill merge it!