MyEtherWallet and its users just fell victim to a sophisticated attack that involved hijacking the website’s domain name service.
According to a post on Reddit, people using Google’s public DNS servers were getting the wrong IP address for the MEW website.Instead of going to the usual CloudFront content distribution network address, visitors were sent to a Russian IP address running a web server. When they navigated to the site, they were met with something that mimicked MEW, prompting them to provide their private keys for their wallets.
The hacker’s address was found, labeled “Fake_Phishing899” by Etherscan, a service that allows people to pull up addresses on the Ethereum blockchain and find information on their transactions.
A total of 180 transactions took place at the address, including a cash-out of 215 Ether (~$150,000) that eventually spread to several other addresses. It’s possible that all the money has been laundered through another cryptocurrency already.
Users on Reddit replying to the thread suggested using an offline version of the site or downloading MEW and Parity from Github to run a full node. Both of these measures, however, are preventative. There is no way for the current victims to reclaim their losses.
This advanced form of phishing caught more than a hundred people off guard, dwarfing events in the past involving the website. In another phishing attack in October of last year, hackers made off with $15,000 in Ether as a result of an email-based non-targeted phishing campaign within two hours.
But as far as the current attack is concerned, it could have easily been prevented by looking at the address bar for a green lock with “MyEtherWallet Inc (US)” on it. This would indicate that the site you’re visiting has an OV or EV certificate (which is virtually impossible to replicate) belonging to MyEtherWallet.
Although most websites just have the word “Secure” next to the green lock—which is indicative of a domain validation (DV) certificate—MyEtherWallet and other financial application developers take this a step further and get organizational (OV) or extended validation (EV) certificates, which prove that a vetted organization is currently in charge of the domain.
This article appeared first on Cryptovest
