ETHERLive
ETHERLive delivers real-time price and volume data across 16+ exchanges to users in a clear and easy-to-understand package. Users can get up-to-the-second updates for each exchange/currency pair, as well as aggregated market averages for each exchange, currency, and the market as a whole. It also provides a global converted average of all the currency pairs monitored by ETHNews, converted to USD.

---

24hr ---
--%
Friday Jan 19th 2018
RESOURCES

The Basics

Learn the basics of Ethereum and various cryptocurrency technologies

Learn More

What is Ethereum?

Understand the underlying principles of the Ethereum Platform

Learn More

The Blockchain

Discover the revolutionizing technology known as the blockchain

Learn More
SUBMIT

Press Release

Submit a press release for consideration on ETHNews

Submit Press

Story / Dapp

Submit a story or DAPP to be considered for publication on ETHNews.

Submit Story

Explanation

Submit "Ethereum Explainer" content for consideration to be featured on ETHNews

Submit Topic
ETHNews Logo
---
--%
Home
News
Etherlive
Ether Price Analysis
Resources
Contact Us

Mist Browser Possibly Vulnerable To Malicious Sites

By

Matthew

De Silva

WriterETHNews.com

On Friday, the Ethereum Foundation announced that due to a Chromium vulnerability impacting all released versions of the Mist Browser Beta v0.9.3 and below, users are warned not to browse untrusted websites with the browser. The Ethereum wallet desktop app is not affected.

"Due to a Chromium vulnerability affecting all released versions of the Mist Browser Beta v0.9.3 and below, we are issuing this alert warning users not to browse untrusted websites with Mist Browser Beta at this time," wrote Mist developer Everton Fraga in a post to the Ethereum Foundation website on December 15, 2017. "Users of 'Ethereum Wallet' desktop app are not affected."

The vulnerability is listed with a "medium" likelihood and a "high" severity, as "malicious websites can potentially steal your private keys."

"For now, it is recommended to use Ethereum Wallet to manage funds and interact with smart contracts instead," explained Fraga.

It appears that rollout delays have impeded the timely development of patches.

"A core problem with the current architecture is that any 0-day Chromium vulnerability is several patch-steps away from Mist," wrote Fraga. "First Chromium needs to be patched, then Electron needs to update the Chromium version, and finally, Mist needs to update to the new Electron version."

Led by GitHub, Electron is a project that aims to "ease the creation of cross-platform applications using JavaScript."

Fraga also reminded users that "Mist is still beta software, and you must treat it as such." He notes that "there are no warranties of any kind, expressed or implied, including, but not limited to, warranties of merchantability or fitness of purpose."

He closed with a "Quick security checklist," reproduced below:

  • Avoid keeping large quantities of ether or tokens in private keys on an online computer. Instead, use a hardware wallet, an offline device or a contract-based solution (preferably a mix of those).
  • Back up your private keys — Cloud services are not the best option to store it.
  • Do not visit untrusted websites with Mist.
  • Do not use Mist on untrusted networks.
  • Keep your day-to-day browser updated.
  • Keep track of your Operating System and anti-virus updates.
  • Learn how to verify file checksums (link).

Matthew De Silva

Matthew is a writer with a passion for emerging technology. Prior to joining ETHNews, he interned for the U.S. Securities and Exchange Commission as well as the OECD. He graduated cum laude from Georgetown University where he studied international economics. In his spare time, Matthew loves playing basketball and listening to podcasts. He currently lives in Los Angeles. Matthew is a full-time staff writer for ETHNews.

ETHNews is committed to its Editorial Policy

Like what you read? Follow us on Twitter @ETHNews_ to receive the latest Mist, browser or other Ethereum dapps news.