Horizon Alert
Summary of the vulnerability and why it matters
This advisory addresses a vulnerability in Electrum, a cryptocurrency wallet software, where unconfirmed transactions might be manipulated by malicious servers. This could lead to users unknowingly broadcasting a zero-fee transaction to an attacker, who then presents an invalid copy and prompts the user to sign a fee-increase transaction.
- Malicious servers can alter user transactions.
- Users may unknowingly send funds to attackers.
- Confirm relevance and exposure to impacted users.
Attack Path
How an attacker could exploit the issue
An attacker can manipulate unconfirmed transactions by impersonating a malicious server to trick Electrum users. This begins with an attacker broadcasting a legitimate transaction, then presenting a deceptive, zero-fee version of that transaction to the user. The user is then prompted to confirm this fraudulent transaction, effectively signing away their funds to the attacker.
- No prior access needed.
- User signs a fake transaction.
- Funds are stolen by an attacker.
Live Threat
Current exploitation, exposure, and threat context
This vulnerability could affect users of Electrum wallets by allowing malicious servers to trick them into unknowingly signing transactions that send their cryptocurrency to an attacker's address. This could happen when a user broadcasts a transaction, and a malicious server intercepts it, replaces it with a fraudulent one, and presents it back to the user, who may then sign the altered transaction when attempting to adjust the fee.
- User cryptocurrency holdings.
- Malicious server replaces broadcasted transactions.
- Loss of user funds.
Operational Fix
Recommended remediation, mitigation, and detection steps
This vulnerability affects users of the Electrum wallet and requires prompt action to prevent financial loss. The primary responsibility for addressing this lies with individual users or administrators managing the wallets. The first practical step is for users to identify their current Electrum version and confirm they are running a version prior to 4.8.3.
- Users should update Electrum.
- Verify wallet transaction integrity.
- Ensure secure wallet management practices.
