[ANN] AEON: Scalable, private, mobile-friendly cryptocurrency

[10:23:39] Thread 0, GPU ID 0, GPU Type: Tahiti: 897.62H/s
[10:23:41] Thread 0, GPU ID 0, GPU Type: Tahiti: 902.04H/s
[10:23:41] Share rejected (Low difficulty share): 0/2 (0.00%)
[10:23:41] Total Hashrate: 1000.72H/s

[10:23:42] Thread 0, GPU ID 0, GPU Type: Tahiti: 907.16H/s
[10:23:44] Thread 0, GPU ID 0, GPU Type: Tahiti: 8

{
"Algorithms":
[
{
"name": "CryptoNight",
"devices":
[
{
"index": 0,
"corefreq": 975,
"memfreq": 1450,
"fanspeed": 65,
"powertune": 20,
"threads": 1,
"rawintensity": 640,
"worksize": 16
},
{
"index": -1,
"threads": 1,
"rawintensity": 16,
"worksize": 16
}
],
"pools":
[
{
"url": "stratum+tcp://xmr.crypto-pool.fr:3333",
"user": "44AFFq5kSiGBoZ4NMDwYtN18obc8AemS33DBLWs3H7otXft3XjrpDtQGv7SqSsaBYBb98uNbr2VBBEt7f2wfn3RVGQBEP3A",
"pass": "x"
}
]
}
]
}

{
"Algorithms":
[
{
"name": "AEON",
"devices":
[
{
"index": 0,
"corefreq": 975,
"memfreq": 1500,
"fanspeed": 65,
"powertune": 20,
"threads": 1,
"rawintensity": 1328,
"worksize": 16
},
{
"index": -1,
"threads": 1,
"rawintensity": 16,
"worksize": 16
}
],
"pools":
[
{
"url": "stratum+tcp://98.238.231.31:5555",
"user": "WmsSWgtT1JPg5e3cK41hKXSHVpKW7e47bjgiKmWZkYrhSS5LhRemNyqayaSBtAQ6517eo5PtH9wxHVmM78JDZSUu2W8PqRiNs",
"pass": "x"
}
]
}
]
}

Security advisory regarding RPC wallets

MWR Labs reported a vulnerability to Monero (see link below). It applies to all Cryptonote-based which use simplewallet, when simplewallet is used in RPC mode. RPC mode is not the default and would have to be enabled by the command line.

The primary situation in which this would occur is running a GUI wallet wrapper which accesses simplewallet via the rpc service (several are listed in the advisory, though most are obsolete). It could also occur if simplewallet running in rpc mode were used to support a service (such as exchange back end) and the system on which the wallet is hosted is also used with a browser (it would not be a good idea to do this in any case).

The vulnerability occurs when a user:

1. Is using simplewallet in rpc mode
2. Is using a web browser on the same system as simplewallet
3. Browses to a malicious site

Monero implemented a fix for this but the fix is complex and back porting it to AEON's older code base, along with the necessary testing and careful evaluation to avoid introducing any new vulnerabilities does not make sense given that we are moving away from that codebase and simple workarounds exist. I have instead decide to issue this advisory. I may also release a simpler, partial fix that reduces the vulnerability, but caution will still be needed.

In the case of AEON, I have not determined whether the community-supported GUI wallet listed in the OP uses the rpc mode and is vulnerable, though that is most likely the case. As such I recommend not to use the community supported GUI and noted this in the OP. I'm not aware of any other wrapper wallets for AEON but if any exist the same advice would apply.

In addition, if you are using simplewallet in RPC mode for any reason, you should avoid doing so on the same system as a web browser. If you are using simplewallet in the default mode without enabling RPC, you are not affected

https://labs.mwrinfosecurity.com/advisories/csrf-vulnerability-allows-for-remote-compromise-of-monero-wallets/