$20 million stolen from misconfigured Ethereum apps
Wherever there are users, there will be user error. With cryptocurrency, those errors can be expensive.
The owner of this Ethereum wallet discovered one simple trick to become a multimillionaire in about four months. At current prices, that wallet holds almost $19 million worth of Ether, stolen from misconfigured Ethereum apps, according to cybersecurity company 360 Netlab.
It's made this money from scanning the Ethereum network for vulnerable Geth (Ethereum mining) clients. It's pulled in a fair amount over the years, but hit paydirt in March 2018, after it started scanning for exposed Remote Procedure Call (RPC) on port 8545. This RPC is used to give approved third-party services access to data, so it's potentially able to transmit some fairly sensitive information like private keys, personal data or to move funds. As such, it usually comes disabled by default and gives a warning when turned on.
But that apparently hasn't stopped people from leaving it open or unknowingly opening it up while tinkering.
It only had about four Ether back in March, but since then it has managed to pull in plenty more. Most of the transfers going into the wallet are relatively small amounts, but they roll in constantly, and occasionally it hits a big payday. These big paydays make up the bulk of the earnings.
This scanner's success has attracted others to the same port, and right now any exposed port is probably going to get snapped up quickly.
"If you have honeypot running on port 8545, you should be able to see the requests in the payload, which has the wallet addresses," the Netlab team said. "And there are quite a few IPs scanning heavily on this port now."
Similar scans go on all the time, and other cryptocurrency networks also get trawled by scanners looking to find someone who accidentally left a door open.
Similar scans, looking for vulnerabilities, are going on all the time on the Internet, but cryptocurrency has given them a new twist. Traditionally, these would just be looking for passwords, personal information and whatever other low-value data someone can get their hands on.
But digital currencies present an opportunity for someone to pick up money directly, making them a much more popular target for tech-savvy thieves. With $20 million of Ether in just a few months, at least one thief has found the exercise well worth it.
Cryptocurrency is a brand new way of tying money and the Internet together, but user error is timeless and continues to be very expensive.
Disclosure: At the time of writing, the author holds ETH, IOTA, ICX, VET, XLM, BTC and NANO.
Latest cryptocurrency news
- SEC crackdown on Binance, Kraken – What it means for Aussie investors
- Sam Bankman-Fried found guilty – what it means for Australian FTX victims
- Bitcoin’s price soars over 10% on ETF rumours – here’s why
- New regulations for Aussie crypto exchanges: What it means for investors
- Sam Bankman-Fried’s FTX trial starts tomorrow – what it means for FTX customers
Picture: Shutterstock
