![]() ![]() Or is it stopped on OUTPUT chain? This is some neat firewall we have.Ĭurl was blocked by the firewall because it’s configured to go only through Tor, without being able to reach localhost. ![]() # Traffic on the loopback interface is accepted. ![]() # Established incoming connections are accepted. Internal traffic from localhost to localhost is allowed in Tails (?): Older version of Electrum are not exploitable in Tails particular firewall setup, looking from the ‘malicious website attack’ point of view, where the only ways in are Unsafe Browser and Tor Browser which are properly configured to NOT allow access to Electrum daemon’s RPC interface. Electrum 3.0.5 was just released which:Ī) properly protects the RPC interface with a password (128 bit of entropy if not set by user) ī) disables RPC commands entirely when the GUI is running (only allows ping, to make sure one single instance is running)ģ.0.5 was just uploaded to unstable and then it will be ported to stretch-backports and included in Tails.Īs for the discussion related to how Electrum in Tails can be exploited (Tails itself doesn’t have any problems). there is ticket Feature #15022 to upgrade Electrum in Tails. update to 3.0.4 is not sufficient because it only removes the CORS code, it does not protect the RPC interface properly with a password. The current version is pretty old to be honest. Hence, I still request TAILS to include version 3.0.4 for the users to benefit from the added features. Anyways, Electrum 3+ contains support for Segwit addresses for Bitcoin which helps reduce transaction fees if many users start using it. Also, if TAILS does block JSON-RPC connections via the firewall that’s good, but I’ve been also told otherwise ( ). ![]() I’m not sure on how the attacker would exploit this in TAILS and I don’t know how to code the Javascript exploit to be able to perform this and write down the reproduction steps. So let me rephrase: how exactly would an attacker exploit this in Tails?Ī couple of things. Hence my request for more information from you. > This is precisely what I’ve tried to verify and failed: it appears that our firewall and browsers configuration blocks connections to that JSON-RPC interface. If it finds one (considering older version of electrum didn’t have this encrypted / password protected) then it’ll attempt to steal the users funds if and only if the users wallet isn’t set with a password. > if the user uses an older version of electrum (below 3.0.4) and browses a webpage that has some form of malicious javascript that scans for open JSON-RPC interface ports. I request you to kindly update the electrum on TAILS to version 3.0.4 Hence, this bug isn’t about TAILS, but affects users who use older versions of Electrum on TAILS with the risk of them losing funds. If it finds one (considering older version of electrum didn’t have this encrypted / password protected) then it’ll attempt to steal the users funds if and only if the users wallet isn’t set with a password.Įlectrum 3.0.4 disables CORS which will prevent such port scans and lookups until another newer version of electrum would be released with a password protection enabled for it. Kind of new to this.īasically the Electrum vulnerability doesn’t affect TAILS, but it affects the user’s Electrum wallet funds if the user uses an older version of electrum (below 3.0.4) and browses a webpage that has some form of malicious javascript that scans for open JSON-RPC interface ports. I’m sorry If was unclear in the bug description. > Could you please clarify why you think Tails is affected by the security issue? Then I’ve tried to connect to this port from Tor Browser and the connection failed (no firewall log, I think that Tor Browser blocked the attempt itself). Same with curl on the command line from both the amnesia and root users. I’ve tried to connect to this port from the Unsafe Browser and I see in the logs that our firewall blocked it. Electrum listens to a (apparently random) high TCP port in Tails 3.3. ![]()
0 Comments
Leave a Reply. |
AuthorWrite something about yourself. No need to be fancy, just an overview. ArchivesCategories |