2

is it possible to steal my ether when I unlock my account? The private key is stored in my local storage. I am running geth on my PC. How can someone make transaction with my account? without my private key? I checked that the endpoint port is not opened. But someone has stolen my (ropsten) ether. you can check this account (the persone who stole my ether, but seems others too..)

https://ropsten.etherscan.io/address/0x6ef57be1168628a2bd6c5788322a41265084408a

What else should I check for my PC (running geth node) ?

Improve this question

2 Answers 2

Reset to default
1

I was the person who observed the same account stealing ETH here ETH stolen on Ropsten.

My original command to start geth was geth --testnet --syncmode "light" --rpc --rpcapi db,eth,net,web3,personal,admin --cache=1024 --rpcport 8545 --rpcaddr 0.0.0.0 --rpccorsdomain "*"

This was of course the most insecure since --rpcaddr 0.0.0.0 allows anyone to connect to my geth instance and --rpccorsdomain "*" allows anyone to run cross site scripts on my geth instance.

I changed it to geth --testnet --syncmode "light" --rpc --rpcapi db,eth,net,web3,personal,admin --cache=1024 --rpcport 8545 --rpcaddr 0.0.0.0 --rpccorsdomain "" and waited for 3 hours before my ETH was stolen again.

Next I secured my geth instance with geth --testnet --syncmode "light" --rpc --rpcapi db,eth,net,web3,personal,admin --cache=1024 --rpcport 8545 --rpcaddr 127.0.0.1 --rpccorsdomain "".

My ETH was stolen YET AGAIN. But this time I observed 2 things:

  1. The stealing wasn't in bulk. It took 0.0000728 Ether several times.
  2. I checked my geth instance, there was no signs that the transfer was done through my geth node.

My conclusion was that the hacker now has the password to my account. He unlocked my account on his own geth instance and took his time to take my ETH.

My answer at this point will be the following:

  1. --rpcaddr 127.0.0.1
  2. Turn off rpccorsdomain

A Geth node should always be accessed locally.

Improve this answer
3
  • Thank you for answer. I tested exactly same process as you did. I assumed that the hacker took my private key and my pass code (maybe by brute-force? ) But is there any way to know my (encrypted) private key unless direct access to my local keystore folder?
    – Kronos
    Apr 9, 2018 at 1:06
  • Was your password similar to..say, 'verystrongpassword'? :)
    – Jackson Ng
    Apr 9, 2018 at 1:13
  • nope much easier one. But the hacker should have my encrypted private key file located in my keystore folder, right?? By just using geth node by rpc, is it possible to extract my private key?
    – Kronos
    Apr 10, 2018 at 1:57
1

Wallet security

It's possible to steal many different ways.

Key loggers, malware, software vulnerabilities, etc.

Basically anything running on your PC is subject to being stolen.

If security is what you are after, then you should investigate air-gapped cold wallets (which can be clunky to setup and use), or hardware wallets such as a Trezor or Ledger Nano S.

RPC security

Also if you're running geth with the personal RPC API enabled and with CORS domain set to *, any website you visit will be able to access the funds.

Or if you have personal enabled and the endpoint exposed (which you said you have checked, but I'd definitely double check that) then anyone on the internet that can connect will be able to access the funds.

See link in comments below for more details on this attack.

Improve this answer
4
  • I know many ways...But I am running a ubuntu server, but every time as soon as I unlock my account (coinbase account for mine option for Geth), it steal my ether...
    – Kronos
    Apr 6, 2018 at 14:29
  • Geth has some malware in it? if not, how can it be possible to fully automatically to transfer my ether?
    – Kronos
    Apr 6, 2018 at 14:30
  • Malware? Compromised geth version? Exposed open RPC endpoint (not sure if this would allow it)? Possibilities are endless. With a hardware wallet, each transaction would need to be authorised first.
    – supakaity
    Apr 6, 2018 at 14:55
  • Seems like you are not the only one having this issue. Take a look at this ethereum.stackexchange.com/questions/45008/…
    – Jaime
    Apr 7, 2018 at 12:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.