Unpatched Ethereum Clients Pose 51% Attack Risk, Says Report

Ethereum clients that still haven't patched known vulnerabilities pose a security risk to the entire network, according to new research.

A report from Security Research Labs that used ethernodes.org data, indicates that a large number of nodes using the most popular clients Parity and Geth have been left exposed for "extended periods of time" after patches for security flaws have been released.

SRLabs says it reported a vulnerability in the Parity client in February that can open nodes up to being crashed remotely.

The report states:

Another patch, released on March 2, was also not picked up by 30% of Parity nodes, it says, while 7 percent of Parity nodes still have a version vulnerable to a critical consensus vulnerability patched last July.

While the Parity client does have an automated update process, it "suffers from high complexity" and not all updates are included, the report says.

The patch scenario for Geth is even worse, the research indicates.

"According to their announced headers, around 44% of the Geth nodes visible at ethernodes.org were below version v.1.8.20, a security-critical update, released two-month before our measurement.," say the SR Labs team, noting that Geth does not have an auto-update feature, apparently by design.

SR Labs goes on to say that by leaving large numbers of clients potentially open to attacks, the whole ethereum network, which relies on having nodes highly available, is vulnerable too.

It warns:

To address the issue, the team suggests that "more reliable" processes for auto-updating clients are required. Further decentralizing the ethereum network by moving hashing power away from concentrations of miners would also help, it adds, although that looks unlikely to happen and wide security awareness would be key to the move's success.

Hat tip: ZDNet

Network image via Shutterstock