SoylentNews is people
SoylentNews
Submitted via IRC for Bytram
A vulnerability in Parity's Ethereum wallet software has been exploited by thieves to rob victims on a massive scale.
A few hours ago, Parity told its users to move their ETH holdings from their in-browser wallets to more secure accounts immediately:
The warning came after three transactions appeared on Etherscan.io, in which accounts were drained of 150,000 coins worth just over US$30 million at the current price. It's understood a trivial programming blunder in Parity's code allowed crooks to hijack strangers' wallets at will.
Coindesk reports 377,000 more Ether were at risk of theft, but were drained into holding accounts by white hats. That gallant action was outlined by Kurt Knudsen on Parity's Gitter channel:
The White Hat Group were made aware of a vulnerability in a specific version of a commonly used multisig contract. This vulnerability was trivial to execute, so they took the necessary action to drain every vulnerable multisig they could find as quickly as possible. Thank you to the greater Ethereum Community that helped finding these vulnerable contracts. The White Hat account currently holding the rescued funds is [here].
(Score: 4, Interesting) by tonyPick on Thursday July 20 2017, @02:07PM (7 children)
Where it's worth reading the comments
https://news.ycombinator.com/item?id=14807779 [ycombinator.com]
and specifically this:
https://news.ycombinator.com/item?id=14810008 [ycombinator.com]
as to the underlying problems with Solidity (the language used to write smart contracts for the Ethereum VM). TLDR - writing secure languages very very is hard. Trying to build one out of Javascript is bordering on the mildly insane...
And whilst we're calling it a vulnerability and throwing around the word "thieves": If the position of the Ethereum guys is that "the code is the contract", then the guys who drained the accounts were simply better at reading the contract - by definition what the code actually did was what you agreed to, even if you didn't like the outcome...
(Score: 0) by Anonymous Coward on Thursday July 20 2017, @02:09PM
I avoided the whole ETC thing over the "Turing complete" aspect alone.
(Score: 2) by JNCF on Thursday July 20 2017, @04:47PM (4 children)
It's not. The Ethereum folks did a hard-fork of their own blockchain to roll back a prominent "theft" of coins in the past, while Ethereum Classic takes the position that code is law. In Math We Trust? In Mob We Trust? Fork if I know.
I wonder if any of the other high level Ethereum languages are more reasonable.
(Score: 2) by bob_super on Thursday July 20 2017, @06:10PM (2 children)
I'd like someone to film themselves explaining to grandma that this is money, and you have to trust the math and disregard volatility. But if something unexpected happens, others might just decide to "fork the blockchain".
The mattress-with-underpockets business isn't about to die.
(Score: 2) by JNCF on Thursday July 20 2017, @06:38PM
Note that there is still a blockchain in which the original contract was respected, and that the value of the currency on that blockchain happens to be significantly higher today than it was before the fork. I'm not even convinced that hard-forks are unhealthy, though they do raise questions. The precedent set by a community rolling back transactions certainly leaves a bad taste in my mouth.
I do get your point. It took us a long time to transition from metal to paper, and some people still haven't. Moving from paper to information won't be easy. I'm really excited by what is happening with blockchains, but I don't think we're ready for mass adoption yet.
(Score: 0) by Anonymous Coward on Friday July 21 2017, @01:16AM
A quick search didn't find any mattresses with money pockets, but you are correct that this is still popular according to this 2015 article,
http://www.businessinsider.com/americans-hide-money-under-the-mattress-2015-2 [businessinsider.com]
(Score: 2) by tonyPick on Friday July 21 2017, @05:40AM
I'd agree that practically this isn't the case, given the whole Ethereum Classic split, but it's worth highlighting that the Ethereum pages still have the claims:
(from https://www.ethereum.org/dao) [ethereum.org]
So it's a claim they're still making, even if the practical position has "unless *we* lose out, in which case all bets are off".
(Score: 0) by Anonymous Coward on Thursday July 20 2017, @11:47PM
Then they should have picked a better base language, one like Lua. Lua lets you encapsulate the entire environment and present a subset of that to another segment of code. It's often used as the scripting language in video games and works well in preventing modders from accessing the rest of the game or breaking out of the restricted sandbox.
This was the bug. Basically someone didn't mark a function private, so hackers were able to call it using their user ID and someone else's wallet ID: "The initWallet function should have been marked internal, but was instead not marked. Unmarked functions default to public in Solidity, so anyone can call that function and reinitialize the wallet to be under their control" ~some reddit user
Clearly no one who knew anything about security designed their system.