Security researchers warned a few months ago about cybercriminals who managed to steal over $19 million by taking control of vulnerable Ethereum nodes. Qihoo 360 tweeted in March about the criminal, who scanned port 8545, looking for vulnerable clients. At the time of the tweet, he had managed to steal almost 4 Ethereum.
However, last week the same researchers discovered a different group of criminals who managed to steal 38,642 Ethereum, worth a total of about $19.3 million. The cryptocurrencies came from Ethereum nodes that had JSON-RPC (port 8545) enabled, a protocol that allows remote control of the Node, and gives access to functions such as sending Ethereum to another address.
By doing a simple Google search with the hacker's address where the coins from all the compromised nodes ended up, one can find hundreds of blog posts and forum reports from users who had the misfortune to fall victim.
According to a post on the official Ethereum blog 3 years ago, leaving JSON-RPC enabled on a device that has internet access without a firewall is vulnerable to this type of attack. Anyone who knows the wallet address combined with its IP address can take control of the system.
Netlab, from Qihoo 360, warns that many are constantly scanning for vulnerable systems, and urges users to block remote connections to their systems, allowing only local ones. Additionally, implementing some user-authorization in case remote connections are necessary is recommended.
