Skip to main content
Ethereum

Return to Question

replaced http://meta.stackexchange.com/ with https://meta.stackexchange.com/
Source Link
Community Bot
Community Bot
  • 1

As per Jeff's suggestion in this commentJeff's suggestion in this comment:

You can use this question as a formatting sandbox. You can

  • post any answers to this question
  • post comments to this question or its answers
  • test suspected bugs with the editor

Beware that since the changes to syntax highlightingchanges to syntax highlighting in December 2010, and the inline hintsthe inline hints added March 2011, no syntax highlighting is applied unless the question's tags or an inline hint enable it. So, to test highlighting here in the sandbox:

  1. On the start of a line, specify a language inlinespecify a language inline using <!-- language: lang --> hints, and indent the code 4 spaces as usual. There is a full list of hintsfull list of hints (scroll down a little).

     <!-- language: lang-html -->

     While not hinted otherwise: <html></html> source <b>goes</b> "here".

 <!-- language: lang-js -->

     var a = 3;
     while (not (a > 0)) {
         alert("JavaScript code <b>goes</b> here.");
     }

  2. Or:

  • Save your post.

  • Use something like Firebug (Firefox), Web Inspector (Safari, Chrome) or Developer Tools (Internet Explorer 8) to edit the resulting HTML. To open Chrome Dev Tools, press F12

  • Find the <pre> element and add the attribute class="prettyprint", or change it into something more specific, like class="lang-vb prettyprint".

  • Run the following in the location bar: javascript:prettyPrint();

As per Jeff's suggestion in this comment:

You can use this question as a formatting sandbox. You can

  • post any answers to this question
  • post comments to this question or its answers
  • test suspected bugs with the editor

Beware that since the changes to syntax highlighting in December 2010, and the inline hints added March 2011, no syntax highlighting is applied unless the question's tags or an inline hint enable it. So, to test highlighting here in the sandbox:

  1. On the start of a line, specify a language inline using <!-- language: lang --> hints, and indent the code 4 spaces as usual. There is a full list of hints (scroll down a little).

     <!-- language: lang-html -->

     While not hinted otherwise: <html></html> source <b>goes</b> "here".

 <!-- language: lang-js -->

     var a = 3;
     while (not (a > 0)) {
         alert("JavaScript code <b>goes</b> here.");
     }

  2. Or:

  • Save your post.

  • Use something like Firebug (Firefox), Web Inspector (Safari, Chrome) or Developer Tools (Internet Explorer 8) to edit the resulting HTML. To open Chrome Dev Tools, press F12

  • Find the <pre> element and add the attribute class="prettyprint", or change it into something more specific, like class="lang-vb prettyprint".

  • Run the following in the location bar: javascript:prettyPrint();

As per Jeff's suggestion in this comment:

You can use this question as a formatting sandbox. You can

  • post any answers to this question
  • post comments to this question or its answers
  • test suspected bugs with the editor

Beware that since the changes to syntax highlighting in December 2010, and the inline hints added March 2011, no syntax highlighting is applied unless the question's tags or an inline hint enable it. So, to test highlighting here in the sandbox:

  1. On the start of a line, specify a language inline using <!-- language: lang --> hints, and indent the code 4 spaces as usual. There is a full list of hints (scroll down a little).

     <!-- language: lang-html -->

     While not hinted otherwise: <html></html> source <b>goes</b> "here".

 <!-- language: lang-js -->

     var a = 3;
     while (not (a > 0)) {
         alert("JavaScript code <b>goes</b> here.");
     }

  2. Or:

  • Save your post.

  • Use something like Firebug (Firefox), Web Inspector (Safari, Chrome) or Developer Tools (Internet Explorer 8) to edit the resulting HTML. To open Chrome Dev Tools, press F12

  • Find the <pre> element and add the attribute class="prettyprint", or change it into something more specific, like class="lang-vb prettyprint".

  • Run the following in the location bar: javascript:prettyPrint();

Bumped by Community user
added 412 characters in body; edited title
Source Link
q9f Mod
q9f Mod
  • 33k
  • 2
  • 18
  • 68

(Sandbox) How Sandbox to reduce the chances of your Ethereum wallet getting hacked?test stack exchange flavoured markdown or prepare posts prior to publication.

User Patrick on the DAOHub forum posted the message yesterday with the subjectAs per [Urgent]Buying DAO using Mist has hacked.Jeff's suggestion in this comment:

Patrick used the Ethereum Wallet to transfer 1 ether to test out buying TheDAO tokensYou can use this question as a formatting sandbox. When (so far it seemsYou can

  • post any answers to this question
  • post comments to this question or its answers
  • test suspected bugs with the editor

Beware that) Ethereum wallet unlocked his geth wallet for 2 seconds (via the IPC API, not exposed to since the Internet), a bot that was watching his geth wallet activity swoopedchanges to syntax highlighting in to send a transfer instruction toDecember 2010, and geththe inline hints added March 2011, (via JSON-RPCno syntax highlighting is applied unless the question's tags or an inline hint enable it. So, exposed to the Internet) and transferred his remaining 7218 ethers intotest highlighting here in the hacker's account.


Here is Patrick's account showing the 1 ether transfer before the removal of his remaining balance ~ 17 seconds later([0x95a3ba0aabc6296cbbe3862a889ecb37979da493](https://etherchain.org/account/0x95a3ba0aabc6296cbbe3862a889ecb37979da493)):[![enter image description here][1]][1]
Here is the hacker's account showing the 7218 ethers being split into many fragments of 97.54489533580829 ether transactions([0xc5d431ee2470484b94ce5660aa6ae835346abb19](https://etherchain.org/account/0xc5d431ee2470484b94ce5660aa6ae835346abb19#txsent)):[![enter image description here][2]][2]
Here is the bit of code from the Ethereum Wallet [mist/interface/client/templates/popupWindows/sendTransactionConfirmation.js #228](https://github.com/ethereum/mist/blob/master/interface/client/templates/popupWindows/sendTransactionConfirmation.js#L201) that unlocks the `geth` account for 2 seconds:
    web3.personal.unlockAccount(Session.get('data').from, pw || '', 2, function(e, res){

The 1 ETH transaction occurred at 2016-05-12 03:12:57. The 7218.368874849814 ETH transaction occurred at 2016-05-12 03:29sandbox:03, ~ 17 seconds after the 1 ETH transaction, which is the 2 second window + the average ~ 15 second Ethereum blocktime.


What are some steps that can be taken to reduce the chances of this occurring?

  1. On the start of a line, specify a language inline using <!-- language: lang --> hints, and indent the code 4 spaces as usual. There is a full list of hints (scroll down a little).

     <!-- language: lang-html -->

     While not hinted otherwise: <html></html> source <b>goes</b> "here".

 <!-- language: lang-js -->

     var a = 3;
     while (not (a > 0)) {
         alert("JavaScript code <b>goes</b> here.");
     }

  2. Or:

  • Save your post.

  • Use something like Firebug (Firefox), Web Inspector (Safari, Chrome) or Developer Tools (Internet Explorer 8) to edit the resulting HTML. To open Chrome Dev Tools, press F12

  • Find the <pre> element and add the attribute class="prettyprint", or change it into something more specific, like class="lang-vb prettyprint".

  • Run the following in the location bar: javascript:prettyPrint();

(Sandbox) How to reduce the chances of your Ethereum wallet getting hacked?

User Patrick on the DAOHub forum posted the message yesterday with the subject [Urgent]Buying DAO using Mist has hacked.

Patrick used the Ethereum Wallet to transfer 1 ether to test out buying TheDAO tokens. When (so far it seems that) Ethereum wallet unlocked his geth wallet for 2 seconds (via the IPC API, not exposed to the Internet), a bot that was watching his geth wallet activity swooped in to send a transfer instruction to geth (via JSON-RPC, exposed to the Internet) and transferred his remaining 7218 ethers into the hacker's account.


Here is Patrick's account showing the 1 ether transfer before the removal of his remaining balance ~ 17 seconds later([0x95a3ba0aabc6296cbbe3862a889ecb37979da493](https://etherchain.org/account/0x95a3ba0aabc6296cbbe3862a889ecb37979da493)):[![enter image description here][1]][1]
Here is the hacker's account showing the 7218 ethers being split into many fragments of 97.54489533580829 ether transactions([0xc5d431ee2470484b94ce5660aa6ae835346abb19](https://etherchain.org/account/0xc5d431ee2470484b94ce5660aa6ae835346abb19#txsent)):[![enter image description here][2]][2]
Here is the bit of code from the Ethereum Wallet [mist/interface/client/templates/popupWindows/sendTransactionConfirmation.js #228](https://github.com/ethereum/mist/blob/master/interface/client/templates/popupWindows/sendTransactionConfirmation.js#L201) that unlocks the `geth` account for 2 seconds:
    web3.personal.unlockAccount(Session.get('data').from, pw || '', 2, function(e, res){

The 1 ETH transaction occurred at 2016-05-12 03:12:57. The 7218.368874849814 ETH transaction occurred at 2016-05-12 03:29:03, ~ 17 seconds after the 1 ETH transaction, which is the 2 second window + the average ~ 15 second Ethereum blocktime.


What are some steps that can be taken to reduce the chances of this occurring?

Sandbox to test stack exchange flavoured markdown or prepare posts prior to publication.

As per Jeff's suggestion in this comment:

You can use this question as a formatting sandbox. You can

  • post any answers to this question
  • post comments to this question or its answers
  • test suspected bugs with the editor

Beware that since the changes to syntax highlighting in December 2010, and the inline hints added March 2011, no syntax highlighting is applied unless the question's tags or an inline hint enable it. So, to test highlighting here in the sandbox:

  1. On the start of a line, specify a language inline using <!-- language: lang --> hints, and indent the code 4 spaces as usual. There is a full list of hints (scroll down a little).

     <!-- language: lang-html -->

     While not hinted otherwise: <html></html> source <b>goes</b> "here".

 <!-- language: lang-js -->

     var a = 3;
     while (not (a > 0)) {
         alert("JavaScript code <b>goes</b> here.");
     }

  2. Or:

  • Save your post.

  • Use something like Firebug (Firefox), Web Inspector (Safari, Chrome) or Developer Tools (Internet Explorer 8) to edit the resulting HTML. To open Chrome Dev Tools, press F12

  • Find the <pre> element and add the attribute class="prettyprint", or change it into something more specific, like class="lang-vb prettyprint".

  • Run the following in the location bar: javascript:prettyPrint();

Improve
Source Link
BokkyPooBah
BokkyPooBah
  • 40.4k
  • 8
  • 7

(As advised by @5chdn, I'm using Meta as a sandbox)

User Patrick on the DAOHub forum posted the message yesterday with the subject [Urgent]Buying DAO using Mist has hacked.

Patrick used the Ethereum Wallet to transfer 1 ether to test out buying TheDAO tokens. When (so far it seems that) Ethereum wallet unlocked his geth wallet for 2 seconds (via the IPC API, not exposed to the Internet), a bot that was watching his geth wallet activity swooped in to send a transfer instruction to geth (via JSON-RPC, exposed to the Internet) and transferred his remaining 7218 ethers into the hacker's account.


Here is Patrick's account showing the 1 ether transfer before the removal of his remaining balance ~ 17 seconds later ([0x95a3ba0aabc6296cbbe3862a889ecb37979da493](https://etherchain.org/account/0x95a3ba0aabc6296cbbe3862a889ecb37979da493)): [![enter image description here][1]][1]
Here is the hacker's account showing the 7218 ethers being split into many fragments of 97.54489533580829 ether transactions ([0xc5d431ee2470484b94ce5660aa6ae835346abb19](https://etherchain.org/account/0xc5d431ee2470484b94ce5660aa6ae835346abb19#txsent)): [![enter image description here][2]][2]
Here is the bit of code from the Ethereum Wallet [mist/interface/client/templates/popupWindows/sendTransactionConfirmation.js #228](https://github.com/ethereum/mist/blob/master/interface/client/templates/popupWindows/sendTransactionConfirmation.js#L201) that unlocks the `geth` account for 2 seconds: 
    web3.personal.unlockAccount(Session.get('data').from, pw || '', 2, function(e, res){

The 1 ETH transaction occurred at 2016-05-12 03:12:57. The 7218.368874849814 ETH transaction occurred at 2016-05-12 03:29:03, ~ 17 seconds after the 1 ETH transaction, which is the 2 second window + the average ~ 15 second Ethereum blocktime.


What are some steps that can be taken to reduce the chances of this occurring?

(As advised by @5chdn, I'm using Meta as a sandbox)

User Patrick on the DAOHub forum posted the message yesterday with the subject [Urgent]Buying DAO using Mist has hacked.

Patrick used the Ethereum Wallet to transfer 1 ether to test out buying TheDAO tokens. When (so far it seems that) Ethereum wallet unlocked his geth wallet for 2 seconds (via the IPC API, not exposed to the Internet), a bot that was watching his geth wallet activity swooped in to send a transfer instruction to geth (via JSON-RPC, exposed to the Internet) and transferred his remaining 7218 ethers into the hacker's account.


Here is Patrick's account showing the 1 ether transfer before the removal of his remaining balance ~ 17 seconds later ([0x95a3ba0aabc6296cbbe3862a889ecb37979da493](https://etherchain.org/account/0x95a3ba0aabc6296cbbe3862a889ecb37979da493)): [![enter image description here][1]][1]
Here is the hacker's account showing the 7218 ethers being split into many fragments of 97.54489533580829 ether transactions ([0xc5d431ee2470484b94ce5660aa6ae835346abb19](https://etherchain.org/account/0xc5d431ee2470484b94ce5660aa6ae835346abb19#txsent)): [![enter image description here][2]][2]
Here is the bit of code from the Ethereum Wallet [mist/interface/client/templates/popupWindows/sendTransactionConfirmation.js #228](https://github.com/ethereum/mist/blob/master/interface/client/templates/popupWindows/sendTransactionConfirmation.js#L201) that unlocks the `geth` account for 2 seconds: 
    web3.personal.unlockAccount(Session.get('data').from, pw || '', 2, function(e, res){

The 1 ETH transaction occurred at 2016-05-12 03:12:57. The 7218.368874849814 ETH transaction occurred at 2016-05-12 03:29:03, ~ 17 seconds after the 1 ETH transaction, which is the 2 second window + the average ~ 15 second Ethereum blocktime.


What are some steps that can be taken to reduce the chances of this occurring?

User Patrick on the DAOHub forum posted the message yesterday with the subject [Urgent]Buying DAO using Mist has hacked.

Patrick used the Ethereum Wallet to transfer 1 ether to test out buying TheDAO tokens. When (so far it seems that) Ethereum wallet unlocked his geth wallet for 2 seconds (via the IPC API, not exposed to the Internet), a bot that was watching his geth wallet activity swooped in to send a transfer instruction to geth (via JSON-RPC, exposed to the Internet) and transferred his remaining 7218 ethers into the hacker's account.


Here is Patrick's account showing the 1 ether transfer before the removal of his remaining balance ~ 17 seconds later ([0x95a3ba0aabc6296cbbe3862a889ecb37979da493](https://etherchain.org/account/0x95a3ba0aabc6296cbbe3862a889ecb37979da493)): [![enter image description here][1]][1]
Here is the hacker's account showing the 7218 ethers being split into many fragments of 97.54489533580829 ether transactions ([0xc5d431ee2470484b94ce5660aa6ae835346abb19](https://etherchain.org/account/0xc5d431ee2470484b94ce5660aa6ae835346abb19#txsent)): [![enter image description here][2]][2]
Here is the bit of code from the Ethereum Wallet [mist/interface/client/templates/popupWindows/sendTransactionConfirmation.js #228](https://github.com/ethereum/mist/blob/master/interface/client/templates/popupWindows/sendTransactionConfirmation.js#L201) that unlocks the `geth` account for 2 seconds: 
    web3.personal.unlockAccount(Session.get('data').from, pw || '', 2, function(e, res){

The 1 ETH transaction occurred at 2016-05-12 03:12:57. The 7218.368874849814 ETH transaction occurred at 2016-05-12 03:29:03, ~ 17 seconds after the 1 ETH transaction, which is the 2 second window + the average ~ 15 second Ethereum blocktime.


What are some steps that can be taken to reduce the chances of this occurring?
edited tags
Link
q9f Mod
q9f Mod
  • 33k
  • 2
  • 18
  • 68
Source Link
BokkyPooBah
BokkyPooBah
  • 40.4k
  • 8
  • 7