XSS Attack Embedded in an ERC20 Token Contract Steals Thousands

Re:XSS Attack Embedded in an ERC20 Token Contract Steals Tho... by AgentME on Wednesday September 27, 2017 @10:07PM (#15354019)

If you use EtherDelta through MetaMask or Mist, then EtherDelta doesn't have direct access to your private keys, and you're given a prompt outside of EtherDelta's control to confirm any action you take, so you're much less vulnerable to malicious behavior from the EtherDelta admin.

[ Parent | on HN ]

Re:XSS Attack Embedded in an ERC20 Token Contract Steals Tho... by foota on Thursday September 28, 2017 @09:32PM (#15362117)

Aw, so there's some local client you run that you use to do the cryptographic bits, and the web client is just used to display results and let you navigate things?

[ Parent | on HN ]

Re:XSS Attack Embedded in an ERC20 Token Contract Steals Tho... by AgentME on Saturday September 30, 2017 @01:23AM (#15371389)

Optionally yes, but EtherDelta specifically does let you instead use it in a normal browser if you give it an Ethereum private key. The hack only affected people who used it that way.

[ Parent | on HN ]

Re:XSS Attack Embedded in an ERC20 Token Contract Steals Tho... by detailyang on Thursday September 28, 2017 @02:53AM (#15355220)

the etherdelta owner can change the js code then send you founds to faker contract:)

[ Parent | on HN ]

Re:XSS Attack Embedded in an ERC20 Token Contract Steals Tho... by AgentME on Thursday September 28, 2017 @03:23AM (#15355380)

The contract address is shown in the Mist/MetaMask prompt. Checking that when you first deposit would be sufficient. (Sure, it's probably true that many users would fail to check that, but I think it counts for something that there is an obvious way that anyone could verify what they were committing their funds to.)

[ Parent | on HN ]