Is it possible to use address you don't own while running ethereum RPC node (using geth)?

Question

In other words, you start your own node and then somehow add accounts you don't own (aka - you don't have their private keys)?

I'm asking because I wanted to make my own node exposed via RPC/internet. Then got curious how secure this is...apparently it isn't since someone used exposed RPC to steal millions a while back. Then I started googling and discovered some 'well known' rpc hosts, while looking into 10-20 of them I found one holding ethers worth nearly $200,000!

Fortunately (maybe fortunately??) this account was locked and "personal" was not available, so unless I am wrong this means no one can send transaction? I didn't try given how illegal this will be but I am 99% sure you can't do this with locked account without "personal".

I am rather curious: are these people too smart, too uncautious or what? And even if I use "personal" to lock the account with strong password - what prevents a hacker to try millions of dictionary combinations to guess the password?

Again: my plan is to start geth without "personal" on account which by default will/should be locked so that no one without root/sh access can start geth as unlocked (yeah not really root since I am on windows anyway but similar...).

Answer 1

I don't think in 2019 someone will leave 200K in a server exposed to the internet, perhaps it is a testnet server or a honeypot.

I'd suggest to use a firewall or similar tool if you want to expose RPC your node to the internet.

The geth/parity have some protection but its functionality is limited to block certain calls. If you want more advanced features like ip whitelisting/authorization, DoS attacks prevention you will have to use another application in front of geth/parity.