The administrators of the Electrum Bitcoin wallet app have released a security update that fixes a vulnerability that existed in the software for almost two years.
Ironically, it was a Bleeping Computer article that helped a user discover this bug.
Electrum wallet was exposing its JSON RPC interface
Three days after we ran a story about miscreants
scanning the Internet for Ethereum wallets with exposed JSON RPC ports on the Internet, a user going by the name of "jsmad"
reported to the Electrum team that their wallet was also exposing a similar JSON RPC online as well.
A JSON RPC interface is a standard software design element through which developers open their application to other software. Third-party software can make calls to this interface and interact with the original software's data and functions.
JSON RPC can be configured in many ways, based on the software's purpose, but the best security practice is to password-protect and bind the interface to localhost, meaning that only locally installed apps that know a password can interact with the JSON RPC endpoints.
Jsmad suggested that the Electrum team password-protect the JSON RPC interface, so only users and apps knowing the wallet's password could interact with it.
