
Alphabatim
19.2K posts












There are a couple other ways. (this is not an all inclusive list) One is a secondary malicious extension in the browser. The most obvious method is to override / intercept window.ethereum. But another is the extension sitting in between external API fetches and manipulating the DAPP to do something unintended. That includes RPC calls that are not from the wallet itself. Ad blockers historically have had the power needed to pull this off. Another is cache poisoning. Of which there are a few ways to achieve. But getting some kind of front end render proxy to cache a bad JS chunk, or API result. Typical done by achieving a desync in between the frontend proxy and UI server, you can squeeze in some extra headers / body data that gets appended into the next request. Say in the next request you sneak in some headers that makes the proxy believe the data came from the UI server (as the UI server is just regurgitating them back). Now the proxy is serving manipulated data from cache until it expires. The first one, users need to practice good opsec. At the very least Cypto should be it's own browser profile with no unnecessary extensions. The second one is thwarted by locally running self contained apps. Or by ensuring you app has no need other make external calls (fully self contained) and checksumming its own chunks on load. In any case, supply chain attacks on valid tools are almost always possible. Here's a good talk on desync: youtube.com/watch?v=FJbuAy…




thank you for your extremely kind and thoughtful words. unfortunately, having to deal with false claims is not something we’re experiencing for the first time, and it definitely won’t be the last. sooner or later, it may knock on your door too, and you explained that reality beautifully. we spent the last 24 hours investigating the case. a number of sharp developers were involved in that process as well, and most recently we went over many of the details with Alex from Hedron. we even received suggestions on what extra protective measures could be added as a precaution going forward. but this issue was not related to DNS, not RPC-related, not caused by an API exploit, and not contract-related either. it was simply malicious software directly targeting the user. being respectful should always be rule number one. competition creates advantages for everyone. so we’re genuinely grateful for your approach, and we wish you endless success with what you’re building!



Just been sent this very disturbing video. This isn’t terrorism, this is the normalisation of Jew hate in the UK.







