{"id":6459,"date":"2019-02-05T17:57:21","date_gmt":"2019-02-05T15:57:21","guid":{"rendered":"https:\/\/forklog.media\/?p=6459"},"modified":"2019-02-05T17:57:21","modified_gmt":"2019-02-05T15:57:21","slug":"developers-fix-parity-ethereum-node-vulnerability-urge-all-node-operators-to-update","status":"publish","type":"post","link":"https:\/\/forklog.com\/en\/developers-fix-parity-ethereum-node-vulnerability-urge-all-node-operators-to-update\/","title":{"rendered":"Developers Fix Parity Ethereum Node Vulnerability, Urge All Node Operators to Update"},"content":{"rendered":"<p>A bug found in the Parity node\/wallet software threatened a considerable proportion of the Ethereum infrastructure. Fortunately, the company has already issued a patch to fix the vulnerability.<!--more--><\/p>\n<p>The issue was discovered on February 3rd when Parity received several reports that attackers were able to send a specially-crafted RPC request to public Parity Ethereum nodes.<\/p>\n<blockquote><p><strong>\u201cOn February 3rd, we received several reports that an attacker can send a specially-crafted RPC request to a public Parity Ethereum node (any version pre 2.2.9-stable and pre 2.3.2-beta) and that node will crash,\u201d<\/strong> the <a href=\"https:\/\/www.parity.io\/security-alert-parity-ethereum-03-02\/\" target=\"_blank\" rel=\"noopener\">announcement<\/a> read.<\/p><\/blockquote>\n<p>The bug had opened up an attack vector to allow nodes to be forced offline by potential attackers. If undiscovered, the attack could have threatened a sizeable portion of the Ethereum infrastructure.<\/p>\n<p>It would appear that the only affected nodes were the ones synced up to the JSON-RPC public services like Infura, MyEtherWallet, and MyCrypto, however, all Parity node operators are encouraged to update to the latest upgrade.<\/p>\n<blockquote class=\"twitter-tweet\" data-lang=\"en\">\n<p dir=\"ltr\" lang=\"en\">The fix is out\u2014please update your nodes ASAP. <a href=\"https:\/\/t.co\/t2bJLNuyZV\">https:\/\/t.co\/t2bJLNuyZV<\/a><\/p>\n<p>While the vulnerability only directly affects Parity Ethereum nodes that serve JSONRPC as a public service (e.g., Infura, MEW, MyCrypto, etc), we recommend everyone to update their nodes immediately.<\/p>\n<p>\u2014 Parity Technologies (@ParityTech) <a href=\"https:\/\/twitter.com\/ParityTech\/status\/1092169644453048321?ref_src=twsrc%5Etfw\">February 3, 2019<\/a><\/p><\/blockquote>\n<p><script async src=\"https:\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script><\/p>\n<p>According to <a href=\"https:\/\/etherscan.io\/nodetracker\" target=\"_blank\" rel=\"noopener\">Etherscan<\/a>, Parity clients serve more than a quarter of the Ethereum nodes, specifically those that use public JSONRPC Ethereum service and operate some very important Ethereum apps, including Infura, MyEtherWallet, and MyCrypto.<\/p>\n<p>Described as \u201c<a href=\"https:\/\/media.consensys.net\/why-infura-is-the-secret-weapon-of-ethereum-infrastructure-af6fc7c77052\" target=\"_blank\" rel=\"noopener\">the secret weapon of Ethereum infrastructure<\/a>,\u201d Infura alone provides connectivity to the Ethereum network for a number of key products and projects, such as Metamask, CryptoKitties, the 0x Protocol, and many others.<\/p>\n<p>Much of the attention lately has been on the <a href=\"http:\/\/forklog.media\/ethereum-constantinople-upgrade-delayed-over-security-vulnerability\/\" target=\"_blank\" rel=\"noopener\">delay of Constantinople<\/a>, Ethereum\u2019s major update, caused by potential security issues. The vulnerability, identified by security audit company ChainSecurity on January 15, could potentially make some smart contracts on Ethereum vulnerable to a so-called \u201cre-entrancy attack,\u201d enabling an attacker to steal other people\u2019s ETH.<\/p>\n<p>There was confusion following the delay, as many Ethereum nodes that already upgraded were forced to downgrade back to the stable build. What\u2019s more, Parity developer Afri Schodeon <a href=\"https:\/\/twitter.com\/5chdn\/status\/1085140631482220545\" target=\"_blank\" rel=\"noopener\">noticed<\/a> that Ethereum\u2019s \u201cdifficulty bomb\u201d had been activated, which might cause problems before the Constantinople upgrade (scheduled for February 27) is finally activated.<\/p>\n<p>Follow ForkLog on <span style=\"text-decoration: underline;\"><a href=\" https:\/\/twitter.com\/forklog_en\/\" target=\"_blank\" rel=\"nofollow noopener\">Twitter<\/a><\/span> and <span style=\"text-decoration: underline;\"><a href=\"https:\/\/www.facebook.com\/forklogen\/\" target=\"_blank\" rel=\"nofollow noopener\"> Facebook<\/a><\/span>!<\/p>\n","protected":false},"excerpt":{"rendered":"<p>A bug found in the Parity node\/wallet software threatened a considerable proportion of the Ethereum infrastructure. Fortunately, the company has already issued a patch to fix the vulnerability.<\/p>\n","protected":false},"author":1,"featured_media":5200,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"select":"1","news_style_id":"","cryptorium_level":"","_short_excerpt_text":"","creation_source":"human_written","_metatest_mainpost_news_update":false,"footnotes":""},"categories":[3],"tags":[46,264,942],"class_list":["post-6459","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news-and-analysis","tag-ethereum","tag-parity","tag-vulnerabilities"],"aioseo_notices":[],"amp_enabled":true,"views":"327","promo_type":"1","layout_type":"","short_excerpt":"","is_update":"","_links":{"self":[{"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/posts\/6459","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/comments?post=6459"}],"version-history":[{"count":1,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/posts\/6459\/revisions"}],"predecessor-version":[{"id":6460,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/posts\/6459\/revisions\/6460"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/media\/5200"}],"wp:attachment":[{"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/media?parent=6459"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/categories?post=6459"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/tags?post=6459"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}