PSA: Electrum has a critical security vulnerability

[squatter]

Tavis Ormandy, security researcher at Google, pointed out a critical vulnerability to the Electrum team earlier today. They immediately pushed a security update. It's advisable to shut down immediately if you are running Electrum.

A vulnerability was found in the Electrum wallet software which potentially allows random websites to steal your wallet via JavaScript. The bug presumably also affects altcoin derivatives of Electrum such as Electron Cash. If you don't use Electrum or a derivative, then you are not affected and you can ignore this.

Action steps:

 1. If you are running Electrum, shut it down right this second.
 2. Upgrade to 3.0.4 (making sure to verify the PGP signature).

You don't necessarily need to rush to upgrade. In fact, in cases like this it can be prudent to wait a while just to make sure that everything is settled. The important thing is to not use the old versions.

It's a bit disappointing to see that the vulnerability was already an open issue from last year. I guess they didn't realize how severe it was.

[zhekinsp]

Tavis Ormandy, security researcher at Google, pointed out a critical vulnerability to the Electrum team earlier today. They immediately pushed a security update. It's advisable to shut down immediately if you are running Electrum.

A vulnerability was found in the Electrum wallet software which potentially allows random websites to steal your wallet via JavaScript. The bug presumably also affects altcoin derivatives of Electrum such as Electron Cash. If you don't use Electrum or a derivative, then you are not affected and you can ignore this.

Action steps:

 1. If you are running Electrum, shut it down right this second.
 2. Upgrade to 3.0.4 (making sure to verify the PGP signature).

You don't necessarily need to rush to upgrade. In fact, in cases like this it can be prudent to wait a while just to make sure that everything is settled. The important thing is to not use the old versions.

It's a bit disappointing to see that the vulnerability was already an open issue from last year. I guess they didn't realize how severe it was.

Mr.Theymos also informed about this issue in the headlines of our forum.

So people who are using electrum immediately upgrade to 3.0.4 version to keep secured from those thieves who are stealing everyone's bitcoin already.But electrum is considered as one of the secured wallet for bitcoin but it faces the security issues will decrease the trust about the wallet among users.
So if people who are having large amount of investments it is necessary to buy a hardware wallet to keep safe all our coins for future.

[Rahar02]

I've updated electrum 3.0.3 for 2-3 weeks and just seen the critical news an hour ago that makes me like panic to update electrum 3.0.4. Even don't dare to open my own wallet now and consider to send all of my funds out of electrum.
Yes, it's a big mistake since the vulnerability has been reported on Github since November 2017 but electrum devs didn't pay attention to it or maybe they just missed it? However, I've never heard someone lost bitcoin due to electrum wallet security breach.

[bL4nkcode]

Can someone tell me if an imported private keys on electrum is affected too with this vulnerability or only to those wallet that is generated using electrum?

[keyboard warrior]

Can someone tell me if an imported private keys on electrum is affected too with this vulnerability or only to those wallet that is generated using electrum?

The vulnerability potentially affects any wallet below version 3.0.4 if no wallet passphrase was set and if it ever been online at the same time a webpage in a browser was open.

Theymos's warning explains it all.

https://bitcointalk.org/index.php?topic=2702103.0

[manchester93]

What's the proper way to update? If I download and install the new version, is there any chance of losing my wallet files? Will the 3.0.4 version be able to read my wallet files, or will I need to import my seed?

I assume I'll lose all of my notes if I import from seed, right? That's sort of a bummer. I was using it to keep records of the transactions, but now I'm afraid to open my wallet.

[VitKoyn]

Yes it's really disappointing to hear a vulnerability like this, given that there are lots of people using electrum wallet to store their Bitcoins for a long time now. I also personally use electrum but the previous version which is 3.0.3 but immediately updated it to 3.0.4 and created a new wallet to use for storing my coins after seeing the announcement made by theymos today. But I just want to know if the android version of electrum is also affected by this vulnerabilities? because I also use that wallet and have some of my Bitcoin on it.

[akram143]

Electrum is considered as one of the best and secured wallet for bitcoin but now it made this kind of issue many investors are going to suffer with these issues.So people immediately upgrade to 3.0.4 version or else you will lose your bitcoins.

[teddy5145]

What's the proper way to update? If I download and install the new version, is there any chance of losing my wallet files? Will the 3.0.4 version be able to read my wallet files, or will I need to import my seed?

I assume I'll lose all of my notes if I import from seed, right? That's sort of a bummer. I was using it to keep records of the transactions, but now I'm afraid to open my wallet.

You wallet are stored inside Appdata folder on your windows, even if you upgraded your electrum to latest version it will still search that location for your wallet file, so yea no need to be afraid of losing access to your coins.
If somehow through sheer miracle that you can't access your wallet you can always restore from seed, and If I'm not wrong electrum will keep listing your transaction history.

Any list of websites that uses this vulnerability to steal our seed though?
So far there hasn't any reports of stolen coins from Electrum through this exploits

[BrewMaster]

this is going to cause some issues for many users. specifically those that are on older versions of Windows like windows 7 have had a tough time upgrading to versions above 3.0 because of the migration to python3.

does anyone have any solution for that that doesn't involve dropping windows?

[Murloc]

Can anyone explain me once more how this issue works? Directly interested is it possoble to steal my data via already passed JavaScript? For example can someone get my keys after I've visited his vebsite several month ago? Pretty sure that after this info came public many scammers will try to use the exploit on those who didn't know about it.
Thanks a lot to Theymos fot pinning his post at the head of the forum.

[Samarkand]

this is going to cause some issues for many users. specifically those that are on older versions of Windows like windows 7 have had a tough time upgrading to versions above 3.0 because of the migration to python3.

does anyone have any solution for that that doesn't involve dropping windows?

You could install a newer Python version on your old windows version (if Windows 7
indeed doesn´t support Python3?).

Alternatively, there is always the Electrum Android app or you could simply
switch to another wallet. Preferably another wallet that already supports
SegWit.

A good overview of SegWit wallets can be found in this thread:
https://bitcointalk.org/index.php?topic=2657620.0

[949miner]

Theymos has already explained that, but i think that it won affect you as long as you do not have an electroneum version that is quite old..

Anyway, why do not you use a hardware wallet? I have been using electrum for a while, and i stopped using it because i knew that it was a little bit vulnerable, that is why i prefered to invest $70 and buy a ledger.

Guys, just stop risking your asses just invest some money and protect all your assets.

Can someone tell me if an imported private keys on electrum is affected too with this vulnerability or only to those wallet that is generated using electrum?

[figmentofmyass]

If somehow through sheer miracle that you can't access your wallet you can always restore from seed, and If I'm not wrong electrum will keep listing your transaction history.

i'm also curious about how this works, though. do new versions retain the descriptions that we have kept on all our addresses and UTXOs? i'd rather not try to re-piece everything from memory. i'm bound to fuck up my privacy somewhere.

Any list of websites that uses this vulnerability to steal our seed though?
So far there hasn't any reports of stolen coins from Electrum through this exploits

i'm sure that reports will start coming in over the next few weeks. now that the vulnerability is exposed, people are probably building websites to exploit it as we speak. and you know how slow people are to upgrade. i would also expect phishing attempts since there is a panic to download the patched version.

i'm waiting until the dust settles. i'm hesitant to rush anything. in the meantime, i have a very strong password. i'll migrate everything in an offline environment over the next few days.

[TryNinja]

Again a new update...

New release: 3.0.5. (security update). https://electrum.org/#download  
Please upgrade; release 3.0.4 did not completely address the vulnerability.

https://twitter.com/ElectrumWallet/status/950163143082299392

And from theymos' post:

Update 2: Version 3.0.5 was just released, which further protects the component of Electrum which was previously vulnerable. It is not critically necessary to upgrade from 3.0.4 to 3.0.5, though upgrading would be a good idea. Also, I've heard some people saying that only versions 3.0.0-3.0.3 are affected, but this is absolutely wrong; all versions from 2.6 to 3.0.3 are affected by the vulnerability.

https://bitcointalk.org/index.php?topic=2702103.0

Be sure to download the latest version (again) to be 100% safe against the vulnerabilities.

[ChipMixer]

Can someone tell me if an imported private keys on electrum is affected too with this vulnerability or only to those wallet that is generated using electrum?

If you use wallet with imported private keys - your current private keys may be known to attacker. Even if they have not been spent, they can still be.
If you use wallet with seed - your current and future private keys may be known to attacker. You should generate new seed and move your funds.

i'm also curious about how this works, though. do new versions retain the descriptions that we have kept on all our addresses and UTXOs? i'd rather not try to re-piece everything from memory. i'm bound to fuck up my privacy somewhere.

Descriptions are stored in wallet.json file with your seed / private keys. Instead of using one wallet with descriptions for all UTXOs and tracking where you spend what - you may create multiple electrum wallets for different personas.

[BrewMaster]

Anyway, why do not you use a hardware wallet? I have been using electrum for a while, and i stopped using it because i knew that it was a little bit vulnerable, that is why i prefered to invest $70 and buy a ledger.

Guys, just stop risking your asses just invest some money and protect all your assets.

there also has been bugs in hardware wallets. that is why some people say there is no 100% safe thing.

in any case i personally don't use hardware wallets because i was capable of simply creating a secure setup for my bitcoins in a cold storage. i have them on a Linux OS with multiple encryptions and its network cut off for good.

[Samarkand]

...

there also has been bugs in hardware wallets. that is why some people say there is no 100% safe thing.

in any case i personally don't use hardware wallets because i was capable of simply creating a secure setup for my bitcoins in a cold storage. i have them on a Linux OS with multiple encryptions and its network cut off for good.

This could be a barrier for mainstream adoption. Most people are not tech-savvy enough
to set up a Linux installation and don´t get me started on disk encryption. The people,
who discovered Bitcoin in its early days on average are way more sophisticated in terms of computer security
than the people, who bought BTC during the 2017 bull run.

I think hardware wallets are still a good choice for most people even though they have their issues as well.
E.g. I remember reading somewhere that parts of the Ledger firmware are closed-source, which deterred
me from buying a Ledger Nano S back in the day.

[figmentofmyass]

Most people are not tech-savvy enough
to set up a Linux installation and don´t get me started on disk encryption. The people,
who discovered Bitcoin in its early days on average are way more sophisticated in terms of computer security
than the people, who bought BTC during the 2017 bull run.

the scary thing is that if we are truly seeing "the s-curve" of technology adoption (like with televisions or phones), this problem is going to get much worse. at any given time, the average user is becoming less knowledgeable about cryptocurrencies and computer security. that's the nature of exponential adoption. the entrances have been flooded by more noobs than ever before.

I think hardware wallets are still a good choice for most people even though they have their issues as well.
E.g. I remember reading somewhere that parts of the Ledger firmware are closed-source, which deterred
me from buying a Ledger Nano S back in the day.

i don't know the specifics, but i have heard of hardware wallet bugs where private keys were exposed. personally, i'm a bit paranoid to use them. but i was relying on electrum too, which has now just seen this critical vulnerability. still, i feel more comfortable signing transactions offline than using a hardware wallet as recommended.

[whirlcoin]

Even if we have to upgrade to 3.0.4 version already it is important to upgrade 3.0.5 because the old version even 3.0.4 maybe attacked by the attackers.But in my knowledge it is better to move all our bitcoins into other bitcoin wallet like blockchain wallet or to hardware wallets to keep our coins secured.