“Shortly after we reported this vulnerability, Parity released a security alert, urging participants to update their nodes,” Security Research Labs also said.
Using data from ethernodes.org, the security research firm found that one month after the alert, around 40% of all scanned Parity nodes were not patched at the time. Another patch released on March 2 reached 70% of nodes, SRLabs said. This data also showed that “7% of the Parity Ethereum nodes announce a version, which is vulnerable to a critical consensus vulnerability that was patched on July 5, 2018”.
Meanwhile, around 44% of the Geth nodes visible at ethernodes.org were below version v.1.8.20, a security-critical update, released two months before SRLabs made its measurement. The percentage of unpatched Geth nodes is higher, because the client lacks, seemingly by design, an auto update feature. However, while Parity has such a feature, it “suffers from high complexity and some updates are left out”.
Like other public blockchains, Ethereum relies on “high availability” to prevent double spending. However, if hackers take control over 51% or more of the computational power in the network, they can double spend crypto coins. Crashing a large number of nodes makes taking control over the network easier, SRLabs explains.
Another security issue stems from the fact that the vast amount of computational power is controlled by large mining pools, which “often share one node to communicate with the Ethereum network”. While “we can safely assume that those mining pools are very security aware and keep their nodes up-to-date”, this level of centralisation means that attackers would only need to crash a handful of nodes to break “the backbone of the Ethereum network”, SRLabs notes.
Featured image: kkssr / Shutterstock.com
The post Unpatched nodes pose security risk to Ethereum network, according to study appeared first on The Independent Republic.
TheBitcoinNews.com is here for you 24/7 to keep you informed on everything crypto. Like what we do? Tip us some Satoshi with the exciting new Lightning Network Tippin.me tool!