While hackers already hunt for ways to steal money, some vulnerabilities further allow them for successful crypto hacks. Recently, experts from Chinese cybersecurity firm Qihoo’s 360 Netlab revealed a massive theft of $20 Million worth of Ethereum by hackers. Apparently, a Geth vulnerability allowed the hackers to make this theft possible from unsafe clients.
Geth Vulnerability Made Ethereum Clients Unsafe
A few months ago, 360 Netlab, a Chinese cybersecurity company, told crypto traders about how a Geth vulnerability could let hackers steal money. The issue affected port 8545 which allowed for a hacker to access Geth clients.
https://twitter.com/360Netlab/status/974374944711815168
- 360Netlab
Now, the researchers confirm that their speculation was right. In fact, not only they confirmed the vulnerability, but they also proved its functionality. According to their recent tweet, hackers have already stolen Ethereum from unsecured Geth clients worth $20 million.
https://twitter.com/360Netlab/status/1006065566728085504?s=07
- 360Netlab
Geth is a famous client meant for running full Ethereum nodes that enables the users to manage them remotely through JSON-RPC interface. According to 360 Netlab, Geth by default ‘listens on port 8545’. The hackers, thus, actively look for vulnerabilities in this 8545 port to steal cryptocurrency. Usually, this port is available only locally and is not open to the external internet. Therefore, anyone having this port open publicly is a target for being hacked.
Securing Your Wallets From Hackers
A quick scan of the hacker's address will let you know the exact amount. When LHN looked over the hackers account (0x957cD4Ff9b3894FC78b5134A8DC72b032fFbC464), the amount stolen seems to have increased further, crossing the amount of Ether reported earlier (38,642.23856 ETH). At the time of writing this article, the hacker’s wallet shows 38,642.68624 ETH as available.
This proves that the hackers are still actively stealing money from unsecured wallets. According to 360 Netlab, you can view these addresses in the payload.
“If you’ve honeypot running on port 8545, you should be able to see the requests in the payload which has the wallet addresses. There are quite a few IPs scanning heavily on this port now.”
The researchers have also disclosed some wallet addresses that supposedly belong to hackers.
https://twitter.com/360Netlab/status/1006425660431036416
- 360Netlab
Users should only connect with Geth clients from local computers. They can also enable user-authorization for remote RPC connections.
Posted from my blog with SteemPress : https://latesthackingnews.com/2018/06/12/20-million-worth-of-ethereum-stolen-due-to-geth-vulnerability/