Re:How Ethereum can be stolen through DNS rebinding
by baby on Monday March 12, 2018 @10:37AM
(#16568372)
I'm old to the thread but I figured I would bring some arguments against ranking this vulnerability as a high severity one for geth:
* This is a "browser bypass of SOP" issue. All your "unauthenticated" local services should be vulnerable.
* A good part of Geth's usage is for servers that do not browse the internet.
* You usually do not handle accounts inside of a geth node, instead you open the node's API via RPC and have another tool that sends already-signed transactions to it. That means that this attack would probably not yield much if not allow someone to use the geth node as a public node to query public information.
* If you do decide to handle accounts in there, you would probably (1) not open the node with RPC and (2) have the accounts be encrypted. See Ethereum's documentation[1] :
> It supports interactive mode, when you are prompted for password as well as non-interactive mode where passwords are supplied via a given password file. Non-interactive mode is only meant for scripted use on test networks or known safe environments.
* This is a "browser bypass of SOP" issue. All your "unauthenticated" local services should be vulnerable.
* A good part of Geth's usage is for servers that do not browse the internet.
* You usually do not handle accounts inside of a geth node, instead you open the node's API via RPC and have another tool that sends already-signed transactions to it. That means that this attack would probably not yield much if not allow someone to use the geth node as a public node to query public information.
* If you do decide to handle accounts in there, you would probably (1) not open the node with RPC and (2) have the accounts be encrypted. See Ethereum's documentation[1] :
> It supports interactive mode, when you are prompted for password as well as non-interactive mode where passwords are supplied via a given password file. Non-interactive mode is only meant for scripted use on test networks or known safe environments.
[1]: https://github.com/ethereum/go-ethereum/wiki/Managing-your-a...