Ethereum’s Etherscan Fights Hacking Attempt

Ethereum’s Etherscan Fights Hacking Attempt
Jul 24, 2018 05:04 PM By: Ben Noble | 7229 Views

According to an official Etherscan report via Reddit on Monday, casual JavaScript alerts containing the text "1337" risen on the block explorer website. A hacker (or hackers) added the alerts into the summarized comments section given by Disqus, a third-party comment hosting set. Etherscan knew the offending comment, seen below:

The company said no systems were compromised besides the form of pop-up alerts. Immediately after getting user reports regarding the suspicious activity, Etherscan disabled the Disqus comments segment and examined a patch to encode footer comments to prevent future assaults. The block explorer has also used a patch to address "un-escaped javascript achievements" on its top comments sections.

Upon further research, Etherscan found there were three attempts to inject the "1337" alert. The company said the first attempt seemed non-malicious, whereas the next two attempts originated from a party connected with Etherscan. Additionally, there was an effort to inject a Web3 JavaScript purpose programming interface (API), although the block explorer's backend finished this.

Etherscan went on to dismiss any fear, uncertainty, and doubt about Disqus, stating that the comments were encoded, but the APIs were not.

When asked if supplies would be safe, Etherscan answered, "Yes, funds are safe. We will post a more complete follow up later." A Disqus developer proposed the phrase "message" should be used in the code first then "raw_message." The block explorer's admin said it would "implement the plan."

However, different Redditor suggested the attack was a parent for something potentially more wicked, saying:

"Often in penetration testing, you would do small tests that could look more like errors or vandalism, but you're still finding holes poked in the frame. One of those holes might open up to something much more important than just creating a popup."
Based on this penetration, the added code could have been an early effort at a phishing scam, like to obtain users' private keys.

#Ethereum #Hacking Attempt

image source

RELATED ARTICLES


ICOs List

camp