Ethereum Services to be Under New Thread

At the moment, the vulnerability has already been fixed, hackers did not have time to use it

05 February 2019 339

Specialists from the blockchain-startup Parity Technologies have discovered a vulnerability in the JSONRPC protocol that threatens the security of the entire Ethereum ecosystem. In particular, MyEtherWallet, MyCrypto and Infura services are under threat of hacking.

At the moment, the problem has already been fixed, the attackers did not have time to use it.

The developers of Parity Technologies recommended that users update the nodes to the new software version in order to reduce the risk of losing access to decentralized applications.

Recall that in January, due to the critical vulnerability in improving the EIP-1283, which allows hackers to steal user funds, the hardfork network was postponed indefinitely
Ethereum Constantinople.

JavaScript

Third Party Apps Could Read Twitter Messaging

According to the company, no one used this vulnerability and the issues is now solved

18 December 2018 859

Until the beginning of December, third-party applications could access Twitter private messages. According to the company, no one took advantage of this vulnerability. Terence Eden, who found it, was paid almost $ 3,000 under the Bug Bounty program.

In 2013, there was a leak of keys to the Twitter API - so applications could access the interface bypassing the social network. To protect users, Twitter implemented an application authorization mechanism through predefined addresses (Callback URL), but it didn’t suit everyone.

Applications that do not support Callback URLs could authenticate using PIN codes. With this authorization, a window pops up that lists which data the user opens to access. The window did not request access to private messages, but in fact the application received it.

On December 6, Twitter reported that it had solved the problem. Judging by the statement of the company on the HackerOne website, no one had time to take advantage of this vulnerability.

This is not the first social network security error related to the API. In September, Twitter discovered a bug in AAAPI (Account Activity API): the system sent a copy of the user's personal message to a random recipient.