Messages confirmed - MyEtherWallet was hacked
CryptoBit News Today1 min read
MyEtherWallet (MEW), one of the most popular web-based Ether wallets, fell victim to a sophisticated DNS hijacking attack on April 24. An attacker or group of attackers redirected users to a phishing website for around two hours, stealing 215 Ether worth $160,000 at the time.
Attack mechanics and traffic redirection
The attack started around 12 PM UTC when a couple of DNS registration servers were compromised. This allowed the attackers to redirect MyEtherWallet.com traffic to a server in Russia, where a fake version of the website was hosted. Oracle-owned Internet Intelligence stated on Twitter that roughly 1,300 of Amazon's cloud service IP addresses were hijacked in the incident, which began around 6 a.m. California time on Tuesday morning.
The redirection was made possible by fraudulent routes announced by eNet, a large ISP based in Columbus, Ohio. These unauthorized routes forced traffic intended for Amazon's domain-name system (DNS) resolvers to be rerouted to a server in Chicago, which then performed a man-in-the-middle attack.
Site setup and certificate warnings
During this two-hour period, the fake MyEtherWallet site attempted to collect private keys from MEW users, which were then used to transfer and steal Ethereum from the victims' accounts. During the two-hour leak, servers in the IP range answered only to requests for myetherwallet.com, and MEW reported that most of the impacted visitors had been using Google's DNS.
Wallet response and user warnings
MEW was quick to alert users of the issue, sending out a warning on Twitter at 7:29 a.m. The company recommended that users switch from Google DNS to Cloudflare's, and urged everyone to check for the correct SSL certificate ("MyEtherWallet Inc") before making any transactions.
Meanwhile, Amazon issued a statement saying that "neither AWS nor Amazon Route 53 were hacked or compromised," but that "an upstream Internet Service Provider (ISP) was compromised by a malicious actor, who then used that provider to announce a subset of Route 53 IP addresses to other networks with whom this ISP was peered."
