ETHERLive
ETHERLive delivers real-time price and volume data across 16+ exchanges to users in a clear and easy-to-understand package. Users can get up-to-the-second updates for each exchange/currency pair, as well as aggregated market averages for each exchange, currency, and the market as a whole. It also provides a global converted average of all the currency pairs monitored by ETHNews, converted to USD.

---

24hr ---
--%
Saturday Aug 18th 2018
RESOURCES

The Basics

Learn the basics of Ethereum and various cryptocurrency technologies

Learn More

What is Ethereum?

Understand the underlying principles of the Ethereum Platform

Learn More

The Blockchain

Discover the revolutionizing technology known as the blockchain

Learn More
SUBMIT

Press Release

Submit a press release for consideration on ETHNews

Submit Press

Story / Dapp

Submit a story or DAPP to be considered for publication on ETHNews.

Submit Story

Explanation

Submit "Ethereum Explainer" content for consideration to be featured on ETHNews

Submit Topic
ETHNews Logo
---
--%
Home
News
Etherlive
Ether Price Analysis
Resources
Contact Us

Ethereum’s Etherscan Combats Hacking Attempt

By

Daniel

Putney

WriterETHNews.com

Hackers tried to use the comments section of Etherscan to infiltrate the website.

According to an official Etherscan announcement via reddit on Monday, random JavaScript alerts containing the text "1337" popped up on the block explorer website. A hacker (or hackers) injected the alerts into the summarized comments section provided by Disqus, a third-party comment hosting service. Etherscan identified the offending comment, seen below:

Etherscan

The organization said no systems were compromised besides the appearance of pop-up alerts. Immediately after receiving user reports regarding the suspicious activity, Etherscan disabled the Disqus comments section and tested a patch to encode footer comments to prevent future attacks. The block explorer has also applied a patch to address "un-escaped javascript exploits" on its top comments sections.

Upon further investigation, Etherscan discovered there were three attempts to inject the "1337" alert. The organization said the first attempt seemed non-malicious in nature, whereas the following two attempts originated from a party associated with Etherscan. Additionally, there was an attempt to inject a Web3 JavaScript application programming interface (API), although this was stopped by the block explorer's backend.

Etherscan went on to dispel any fear, uncertainty, and doubt about Disqus, asserting that the comments were encoded, but the APIs were not.

When asked if funds would be safe, Etherscan replied, "Yes, funds are safe. We will post a more detailed follow up later." A Disqus developer suggested the phrase "message" should be used in the code rather than "raw_message." The block explorer's admin said it would "implement the suggestion."

However, another redditor suggested the attack was a precursor for something potentially more malicious, stating:

"Often in penetration testing you would do small tests that could look more like errors or vandalism but you're still finding holes poked in the frame. One of those holes might open up to something much more important than just creating a popup."

Based on this insight, the injected code could have been an early attempt at a phishing scam, like to obtain users' private keys.

Daniel Putney

Daniel Putney is a full-time writer for ETHNews. He received his bachelor's degree in English writing from the University of Nevada, Reno, where he also studied journalism and queer theory. In his free time, he writes poetry, plays the piano, and fangirls over fictional characters. He lives with his partner, three dogs, and two cats in the middle of nowhere, Nevada.

ETHNews is committed to its Editorial Policy

Like what you read? Follow us on Twitter @ETHNews_ to receive the latest Etherscan, Ethereum or other Ethereum ecosystem news.