4

Coingape reported that Internet Security Giant 360 found an Epic Secutiry Bug in EOS.

According to the article, "remote attacks on its blockchain platform can directly control it and take over all the nodes that are running on EOS coin. According to the post, 360 has already reported to the EOS officials."

They go on to claim that EOS have fixed the bug at around 2pm on the 29th.

However, the article also quotes a reddit user saying they checked the EOS github and found no commits or issues relating to this bug.

So is this just a fabricated FUD story? Has there been any independent or official verification or denial of the claim?

Improve this question
4
  • 1
    I checked the story and the bug had been closed. There had been some further discussion, but it is mostly overblown media reaction who do not understand the underlying technicalities.
    – Mikko Ohtamaa
    May 30, 2018 at 10:45
  • Not a duplicate exactly, but I just noticed you already mentioned this bug in another question: eosio.stackexchange.com/questions/510/…
    – AntonChanning
    May 30, 2018 at 12:54
  • 1
    I am curious how EOS team plans to mitigate such bugs in the future. You can build several layers of protection in the software to prevent the damage caused by a buffer overflow.
    – Mikko Ohtamaa
    May 30, 2018 at 14:55
  • 1
    I have starred your question as I too am curious as to the answer on that one.
    – AntonChanning
    May 30, 2018 at 15:00

1 Answer 1

Reset to default
3

Apparently the media report missed several details.

Block.One apparently issued a bug finding bounty, in an attempt to remove as many security holes as possible before launch. 360 apparently responded by finding the bug reported.

The reddit user that reported finding no issue or commit relating to it in Github was apparently mistaken.

It was assigned issue #3498, and was fixed in this commit.

Whilst this bug is now fixed, it was found worrying close to launch. So it does raise a question about whether similar issues remain undiscovered or undisclosed by those hoping to exploit them. However, it does remain part of the power of Open Source (and the ability to pay a bounty) that this issue was able to be discovered before launch.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.