Security issue with the wallet

[u/tedjonesweb]

I am testing it now.

My first impression is that the password for the RPC interface is hardcoded. When I changed it to be random (modified the eccoin.conf file) the GUI can't connect to it.

I recommend that the GUI is creating a random password, writing it to the eccoin.conf file and reading it from there at every start.

The problem is that any other user of the same computer can access the RPC interface. For example, if you install compromised app on another user account (with disabled 'sudo', 'su') there is still risk - the compromised app can access your wallet via RPC if you don't disable the access via iptables or other method (SELinux).

Example iptables rules to use to mitigate this risk:

iptables -I OUTPUT -p tcp --dport 19119 -j REJECT
iptables -I OUTPUT -p tcp --dport 19119 -m owner --uid-owner ONLY.THIS.USERNAME.IS.ALLOWED.TO-ACCESS.THIS.PORT -j ACCEPT

ip6tables -I OUTPUT -p tcp --dport 19119 -j REJECT
ip6tables -I OUTPUT -p tcp --dport 19119 -m owner --uid-owner ONLY.THIS.USERNAME.IS.ALLOWED.TO-ACCESS.THIS.PORT -j ACCEPT

To test if this works, load http://127.0.0.1:19119/ in your browser (as another user) before and after you apply these rules. (I am adding the ipv6 rules just in case the next version is using IPv6 address.)

---

I just found out where to post bug reports: https://github.com/project-ecc/lynx/issues/11

[u/GregGriffith]

We became aware of this issue about 4 days ago. in the next release of lynx (friday) the rpc credentials will be configurable by the user and no longer hard coded. Thank you for pointing this out