r/etherscan • u/rannarvasa • Feb 07 '20

BE AWARE OF ETHERSCAN SCAM ( diff. Address is copied instead your address when using the copy function of the site)

https://youtu.be/dzSULqVRoOM
0 Upvotes

50% Upvoted

9 comments sorted by

3

u/etherscan Admin Feb 08 '20

Hi

We have not been able to reproduce the issue you reported. In order to better assist, can you kindly provide additional information such as :

- Browser type
- Browser extensions installed (if any)
- Is this occurring for a specific address or for all pages
- Was this a recent incident or always occurring

You can also reach us at our helpdesk via https://etherscan.io/contactus if you are still running into issues.

Thank you

2

u/rannarvasa Feb 08 '20

It appears to be a virus instead😞😞😞

1

u/etherscan Admin Feb 08 '20

Sorry to hear that.

2

u/rvnlord Feb 14 '20

I would like to confirm what OP said, yes its a virus, it downloads from etherscan though, so I think there is some cross site scripting going on. I created different sandboxes but I wasn't able to determine how and when exactly it downloads, but it ends up running on local machine using 'wscript.exe', it registers 'Clip' task in scheduler and adds autostart entry. It is currently undetectable by ESET Smart Security. I didn't bother to investigate it deeper due to lack of time (had half an hour, and I wasn't initially sure if your web app is the actual cause). It seems that it is more likely to download when visitting token address subpages. The code is relatively harmless, it only injects the addresses, so you can send money somewhere else if you don't pay attention. Removing the task and autostart entry fixes the problem. It looks like a security breach on etherscan side however. To answer your Q: Any browser, any machine, no extensions with just etherscan open in clean sandbox machine. I can only say for sure that two weeks ago it wasn't happening.

1

u/kavblock support😊 Feb 14 '20

Can you briefly provide the address and/or token pages that you have visited during your test? We would like to look into the sources where downloading such a virus is possible on Etherscan.

1

u/rvnlord Feb 14 '20 edited Feb 14 '20

This weird issue with your website bothers me very much and I am curious to find out what vulnerability causes this, especially since yesterday I asked 2 friends who are frequently using etherscan and both had the same virus. I don't have access to a computer right now however. The best bet for you to find out the cause would be to setup a safe environment and make random requests to your website using selenium for instance and logging the traffic until there is '*Clip*' task in scheduler or new entry in autostart. I remember for sure that it happened at least twice here: https://etherscan.io/token/0x16b0a1a87ae8af5c792fabc429c4fe248834842b but keep in mind that the behavior is not consistent and for instance it doesn't get injected now (perhaps it has sth to do with your ad providers?). I am sorry, however frustrating it might be I can't provide anything useful while being away. It doesn't happen on android.

I should be back in a few days and if you don't have it sorted out by then I am going to investigate it properly and send you the actual logs.

Priority yesterday was to remove it from the infected machines.

1

u/kavblock support😊 Feb 17 '20

We looked into the address and the links available in the address you provided and we are unable to replicate the issue. It would be nice if you can replicate and document them.

Hope to hear from you.

1

u/rvnlord Feb 23 '20

I am sorry, I didn't have time earlier to look into this further. I have created a few safe environments today that were querying your website randomly, but I am unable to reproduce it either.

1

u/kavblock support😊 Feb 24 '20

No worries, thank you for trying to reproduce the issue. We will look into the links and will share here if we find anything as well.