How Ethereum can be stolen through DNS rebinding
> PS: This has been reported to the ethereum foundation but they don’t consider it a valid vulnerability.<p>This is ludicrous. If a <i>torrent client</i> considers this class of bug to be a vulnerability[1], I don't see why folks who are trying to revolutionise money (something that is far more important than a few small RCEs) don't. While it is true you need to run it with the --rpc option, I'm confused why the RPC is unauthenticated by default, and whether there is any front-end that will start up the RPC server in the background (similar to electrum).<p>[1]: <a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-5702" rel="nofollow">https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-5702</a>