.jpg)
Insecurely configured Ethereum clients without a firewall and unlocked accounts can lead to attackers accessing funds remotely.
Affected configurations: An issue has been reported in Geth, although all implementations are included. C++ and Python can in principle exhibit this behavior if used unsafely; Only for nodes that leave the JSON-RPC port open to the attacker (this blocks most nodes on internal networks behind NAT), binding the interface to a public IP address, and at the same time leaving the accounts unlocked on startup.
Probability: a little
Danger: high
impact: Loss of funds related to wallets imported or generated by clients
details:
We have noticed that some individuals have bypassed the built-in security placed on the JSON-RPC interface. The RPC interface allows you to send transactions from any account that has been unlocked before sending the transaction and will remain unlocked throughout the session.
By default, RPC is disabled, and with it enabled it can only be accessed from the same host your Ethereum client is running on. By opening up RPC for anyone on the Internet to access and not including firewall rules, you open your wallet to theft by anyone who knows your address as well as your IP address.
Effects on the expected depth of chain reorganization: no one
Remedial action taken by Ethereum:eth RC1 will be completely secure by requiring explicit authorization from the user for any potential remote transaction. Newer versions of Geth may support this functionality.
Proposed temporary solution: Only run the default settings for each client, and when you make changes, understand how those changes impact your security.
Note: This is not a bug, but a misuse of JSON-RPC.
Tip: Never enable the JSON-RPC interface on an Internet-accessible device without a firewall policy in place to block the JSON-RPC port (default: 8545).
Moral: Use RC1 or later.
Geth: Use secure default settings, and know the security implications of the options.
–rpcaddr “127.0.0.1”. This is the default value to allow only connections originating on the local computer; Remote RPC connections are disabled
–Unlock. This parameter is used to open accounts on startup to aid in automation. By default, all accounts are locked
