Analysis of EIDOS Mining Attacks: Developers should self-examine potential security risks when launching CPU payment tools
2019-11-06 01:14
星球日报讯 昨天晚间19:04-23:29之间,PeckShield安全盾风控平台DAppShield监测到黑客向EOS竞猜类游戏BigGame发起连续攻击,利用其新推出的CPU代付功能进行恶意挖矿,致使其CPU资源被耗尽,共计获得1,993个EIDOS代币。
PeckShield安全人员分析发现,BigGame新上线的CPU代付功能,存在可劫持转账通知发起内联操作的缺陷,使得其CPU可被恶意控制。随着EIDOS的持续火热,不少数字钱包或DApp都相继开发了一键挖矿功能,通过智能化程序帮助用户自动实施转账操作,但一旦存在潜在安全风险的话,该辅助工具便会成为攻击者的帮凶,致使普通用户体验受到伤害。PeckShield在此提醒广大开发者,若已上线CPU代付功能的话应自查潜在安全风险,避免因恶意攻击造成普通用户使用体验受损,必要时可寻求第三方安全公司协助,帮助其完成新功能上线前攻击测试及基础安全防御部署。
最热快讯
资讯热榜
日榜
周榜
Hyperliquid’s 50x leveraged BTC short position turned from loss to profit, with a floating profit of over $600,000
James Wynn wrote a long article about himself: He started playing with contracts in March, earned 8-digit profits from Meme coins, and lost 100 million in a week
BTC rebounded and broke through 102,000 USDT, and the 24-hour decline narrowed to 2.87%
SlowMist: Lazarus hackers are using a new stealing Trojan, OtterCookie, to target cryptographic practitioners
Abraxas Capital shorts mainstream currencies for hedging, with current floating profits exceeding $55 million
TRUMP wallet official website linked to account X for the second time