Electrum 4.8.3. This release fixes a critical security issue

[flatfly]

https://x.com/ElectrumWallet/status/2113935057656369564

Quoting the tweet:

New release: Electrum 4.8.3. This release fixes a critical security issue, so we urge all users to upgrade. A description of the vulnerability will be published later today. (note: Windows Defender may show a warning about ZXing.dll, ignore that, it is a false positive)

[Upgrade00]

The false positive bit is throwing me off. I will not be bypassing a windows warning until I am sure what exactly is the reason it was flagged. I consider there is more risk updating with no more information than sticking to the version I am currently on.

What does other users recommend?

[flatfly]

Advisory has just been published on github:

https://github.com/spesmilo/electrum/security/advisories/GHSA-6jp4-8v48-cc5v

[satscraper]

https://x.com/ElectrumWallet/status/2113935057656369564

Quoting the tweet:

New release: Electrum 4.8.3. This release fixes a critical security issue, so we urge all users to upgrade. A description of the vulnerability will be published later today. (note: Windows Defender may show a warning about ZXing.dll, ignore that, it is a false positive)

Forum already has the relevant, more informative post that was published 2hrs before yours. Why duplicate it by creating new thread?

[hosemary]

Forum already has the relevant, more informative post that was published 2hrs before yours. Why duplicate it by creating new thread?

I appreciate you warning users about the security issue in your thread. Thanks for that, but I don't really see any problem with flatfly creating this topic.
This was an urgent announcement, and I think it deserved a separate topic to get more visibility.

[Karl_3000]

Thanks for this information. I will update my wallet to 4.8.3 just right now.

Forum already has the relevant, more informative post that was published 2hrs before yours. Why duplicate it by creating new thread?

I think it is good to have a new thread for it. I was not following that you thread because I have noticed Cygan has always post new threads for Electrum updates which is one of the reasons I have been following the Electrum board. If not for this thread, I would not have seen this important update.

If Electrum has a board, I think there can always be a new topic for new updates.

[Faisal2202]

The false positive bit is throwing me off. I will not be bypassing a windows warning until I am sure what exactly is the reason it was flagged. I consider there is more risk updating with no more information than sticking to the version I am currently on.

What does other users recommend?

I have not updated anything yet. I am waiting, as this update has been changed everywhere on their GitHub too, the sig is correct too, and everything looks so far so good, but I don't know why it feels a little off, as I read a few comments under that tweet and they also had the same thoughts (they can be made to make our doubt solid). Well, I checked everywhere, and so far, there are no signs of their Twitter account being hacked or anything, and the latest update seems fine too, as Satscraper said, so everything seems fine so far! Can't be sure, though.

This was an urgent announcement, and I think it deserved a separate topic to get more visibility.

I agree because otherwise I would not have known this. As I have only put this board on the tracker not that topic.

[ghost43]

The twitter account was not hacked. but even if it was it would not matter much.

The binaries are reproducible and 5 different people built and signed them. The same 5 people that signed the last release and the release before that, etc. There is a tag on GitHub. There is a signed version announcement on the website that the client verifies when it does the update check. The IRC channel topic was updated to say there is a new release.

But if you care about Windows Defender that much, even that false positive should be gone now as Microsoft sent an automated reply to our report and claimed they removed the false positive detection from their database.

Still, you can wait a bit before updating, just read the disclosure then and try to understand it.

[Italian Panic]

It appears that no particular incidents have occurred, and it seems the bug was discovered to the external service owned by Electrum.

The same issue has also been found in Cake Wallet, which has also released an update today.

Essentially, Electrum does not normally download blocks but uses its own external server to manage the mempool. It has been discovered that a malicious server could intercept a users transaction with RBF (where fees are manually increased for various reasons) and insert a second transaction using the first users input but with the output altered to benefit the attacker. In other words a man in the middle.

At this point, the tx has valid signatures because they are not verified by the client (Electrum). If the user manually increases the fees, a sort of switch occurs, triggering the bug: the tx that is validated is the tx of attacker, with funds transferred in their favour, whilst the original transaction disappears.

So, update Electrum and Cake Wallet.

Don't make tx until the update.