Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

XSS Attack Embedded in an ERC20 Token Contract Steals Thousands

hackernoon.com

Post reply on HN
Print view View original

21–30 of 50 posts

Re: XSS Attack Embedded in an ERC20 Token Contract Steals Thousands

#21

Post by vosper »

imaginenore wrote: post #20
jdp23 wrote: post #3

> I want to make one point clear: I believe that EtherDelta, in concept, is safer and more “trustworthy” than a traditional exchange. Everything about how EtherDelta functions is transparent and verifiable by users.... The attack detailed in this piece could have been identified by anyone before it was exploited, and if there had been a security review protocol in place, it would have been easily prevented. Even "in…

This blows my mind. These programmers can implement quite complex contacts-financial-exchanges on top of a quite complex distributed system, but then fail to sanitize user input in their web interface. It makes no sense.

They're pretty different programming disciplines, though. For a company as a whole it's not really excusable, but I'm sure there are plenty of fintech or distributed systems programmers who aren't up on web attack vectors, just as there are lots of web people who're well aware of them but who know nothing about fintech.

Re: XSS Attack Embedded in an ERC20 Token Contract Steals Thousands

#22

Post by meowface »

>Thus, users of EtherDelta must enter their public wallet address and private key when using the site, meaning their private key could be captured from the browser session by a malicious code injection.

This isn't some sort of fancy cryptocontract based attack. The private key is just stored as a JavaScript object in the session and an attacker found and exploited a reflected XSS vulnerability to send off the key.

Even if you're not sending your private key to the server directly surely some people must have made these users aware of the risks they were taking? Not only XSS risks, but risks of a rogue admin or backend compromise injecting malicious JS.

Re: XSS Attack Embedded in an ERC20 Token Contract Steals Thousands

#23

Post by pdkl95 »

thephyber wrote: post #16
davewritescode wrote: post #13

The smart contracts in Ethereum sounds awesome in practice and way more useful than Bitcoin mining but it seems like a giant security hole.

Kinda like a knife -- it's a very useful tool if used well and a very painful tool if mishandled.

You're assuming it's possible to "use well". It's delusional to believe it's possible to understand the subtle interactions within and between "smart contracts". Even if we ignore the ambiguity of the real world, malicious actors, and other complexity multipliers, we already know it isn't possible to know if a "smart contract" will halt.

Code will always have bugs, and you cannot truly understand how something written in a Turing complete language will behave without running it.

> very painful tool if mishandled

Part of being a skilled craftsman is choosing the right tools, which includes understanding and respecting their limits. The language for writing contracts makes all state mutable by default, has ambiguous operators that change behavior depending on storage location or if the operand was a literal, and doesn't defined the order of evaluation for expressions, to name just a few of it's design problems[1]. This isn't a "useful tool:", it's a strong indicator of a another fractal of bad design[2].

[1] https://news.ycombinator.com/item?id=14810008

[2] https://blog.codinghorror.com/the-php-singularity/

Re: XSS Attack Embedded in an ERC20 Token Contract Steals Thousands

#24

Post by mhluongo »

KGIII wrote: post #18
srcmap wrote: post #14

Earlier quoted context omitted.

The story is almost like the 2008 time where wall street wiz kids package the mortgages to special mortgages back securities/contacts and resell them over and over again to banks, mutual funds, etc. Hugh hype was created. Last time: It was safe because it was back by mortgage. This time: It is safe because it is back by crypto algorithm. Last time few smart insiders got billions richer and unload everything before th…

In 2007, I sold my business. In 2008, I put a bunch into the stock market and property. It was comparatively dirt cheap. I made a killing. I'd do the same with cryptocurrency, but I can't figure out how. My 2008 investments were pretty risk-free. Of course the economy was going to recover. It always does. I've no idea how to do that with cryptocurrency.

What are you having trouble figuring out? Happy to help people into crypto

Re: XSS Attack Embedded in an ERC20 Token Contract Steals Thousands

#25

Post by KGIII »

mhluongo wrote: post #24
KGIII wrote: post #18

Earlier quoted context omitted.

In 2007, I sold my business. In 2008, I put a bunch into the stock market and property. It was comparatively dirt cheap. I made a killing. I'd do the same with cryptocurrency, but I can't figure out how. My 2008 investments were pretty risk-free. Of course the economy was going to recover. It always does. I've no idea how to do that with cryptocurrency.

What are you having trouble figuring out? Happy to help people into crypto

Basically, how to bet that it is going to plummet in value and make money on that process. I figure it's a bubble and there's going to be a popping, even if it is done by force of law.

These ICOs are starting to make powerful people angry. Thefts like this one are starting to get regular media coverage. At some point, probably soon, the governments are going to come and clamp down on it.

Is there a way to long-term short Etherium or Bitcoin?

Re: XSS Attack Embedded in an ERC20 Token Contract Steals Thousands

#26

Post by [deleted] »

AgentME wrote: post #15
foota wrote: post #12

Don't you also have to trust that the person running EtherDelta hasn't modified what's running on the site...?

If you use EtherDelta through MetaMask or Mist, then EtherDelta doesn't have direct access to your private keys, and you're given a prompt outside of EtherDelta's control to confirm any action you take, so you're much less vulnerable to malicious behavior from the EtherDelta admin.

[deleted]

Re: XSS Attack Embedded in an ERC20 Token Contract Steals Thousands

#27

Post by meowface »

meowface wrote: post #22

>Thus, users of EtherDelta must enter their public wallet address and private key when using the site, meaning their private key could be captured from the browser session by a malicious code injection. This isn't some sort of fancy cryptocontract based attack. The private key is just stored as a JavaScript object in the session and an attacker found and exploited a reflected XSS vulnerability to send off the key. Ev…

(Persistent XSS actually, but exploited similarly to a reflected XSS vulnerability because you have to send a specific link to your victims. It has a much higher exploitation success chance than reflected XSS since pesky browser XSS auditors won't be able to step in.)

Re: XSS Attack Embedded in an ERC20 Token Contract Steals Thousands

#28

Post by detailyang »

AgentME wrote: post #15
foota wrote: post #12

Don't you also have to trust that the person running EtherDelta hasn't modified what's running on the site...?

If you use EtherDelta through MetaMask or Mist, then EtherDelta doesn't have direct access to your private keys, and you're given a prompt outside of EtherDelta's control to confirm any action you take, so you're much less vulnerable to malicious behavior from the EtherDelta admin.

the etherdelta owner can change the js code then send you founds to faker contract:)

Re: XSS Attack Embedded in an ERC20 Token Contract Steals Thousands

#29

Post by AgentME »

detailyang wrote: post #28
AgentME wrote: post #15

Earlier quoted context omitted.

If you use EtherDelta through MetaMask or Mist, then EtherDelta doesn't have direct access to your private keys, and you're given a prompt outside of EtherDelta's control to confirm any action you take, so you're much less vulnerable to malicious behavior from the EtherDelta admin.

the etherdelta owner can change the js code then send you founds to faker contract:)

The contract address is shown in the Mist/MetaMask prompt. Checking that when you first deposit would be sufficient. (Sure, it's probably true that many users would fail to check that, but I think it counts for something that there is an obvious way that anyone could verify what they were committing their funds to.)

Re: XSS Attack Embedded in an ERC20 Token Contract Steals Thousands

#30

Post by flashmob »

KGIII wrote: post #25
mhluongo wrote: post #24

Earlier quoted context omitted.

What are you having trouble figuring out? Happy to help people into crypto

Basically, how to bet that it is going to plummet in value and make money on that process. I figure it's a bubble and there's going to be a popping, even if it is done by force of law. These ICOs are starting to make powerful people angry. Thefts like this one are starting to get regular media coverage. At some point, probably soon, the governments are going to come and clamp down on it. Is there a way to long-term s…

Media coverage is negative only because that's what people like to click on. I think government regulation will only legitimize it and bring it to the masses.
Post reply on HN