Hacker News Reader

rhodey_orbitson How to steal a developer's local database

Cool to see DNS Rebinding getting more attention lately :D just a couple months ago I used DNS Rebinding to attack Ethereum wallets: https://medium.com/@rhodey/walking-past-same-origin-policy-n...

rhodey_orbitson Ethereum Wallet and Mist Beta with Hard Fork choice

thanks! I didn't take the time to setup Mist but my understanding is that Mist is especially vulnerable because it's bundled with a wallet and used for browsing DAPPS which always require the JSON API to be enabled.

rhodey_orbitson Ethereum Wallet and Mist Beta with Hard Fork choice

Ethereum brushed off my bug bounty submission and then began this hard fork junk so I documented and packaged my exploit publicly. It hasn't gotten much exposure yet, please have fun with it.

"Walking Past Same-origin Policy, NAT, and Firewall for Ethereum Wallet Control" - https://medium.com/@rhodey/walking-past-same-origin-policy-n...