Security Patch Announcement

steemitdev (63) in steem • 7 years ago (edited)

Earlier this week, steemit was informed of a potential vulnerability in steemd that could lead to a denial of service attack in both the API and P2P layers of steemd, but has absolutely no impact on the cryptography securing the Steem blockchain.

This threat did not create any risk to Steem accounts or token balances, however, our engineers quickly located the problem and fixed it. The patch was deployed to steemit's Steem nodes within 24 hours of discovering the bug. We have contacted witnesses to update their seed and witness nodes to preserve the stability of the P2P network and are in the process of informing exchanges to ensure their continuous operation. The patch doesn't require a replay; Node operators should simply update and restart steemd.

At this time, we do not believe the vulnerability is being actively exploited in any sort of attack, however, we recommend anyone running a steemd node upgrade to the newest version of stable. This can be done via docker pull steemit/steem using our provided Docker image.

steemit devs

7 years ago by steemitdev (63)

Authors get paid when people like you upvote their post.
If you enjoyed what you read here, create your account today and start earning FREE STEEM!

Sort Order:

wokejijasper (44) · 7 years ago

How do I update my witness please?

timcliff (73) · 7 years ago

If you are not running a witness server, then you don’t have to worry about it.

$0.00

steevc (73) · 7 years ago

Good to hear you are on the case. Security is a constant battle and Steemit is sure to come under attack as it gets more popular. Some of us remember a previous assault. At least we had some other options to access the blockchain.

ddrfr33k (63) · 7 years ago

It's like a game of whack-a-mole, isn't it? The moment you patch one hole, another one shows up...

locikll (55) · 7 years ago

@Curie 's Witness/Seed has been updated, Cheers.

ausbitbank (73) · 7 years ago

My witness, backup witness, seed and rpc nodes have all been updated now :)

firedream (61) · 7 years ago

Dear @ausbitbank;

I need any help to stop @grumpycat hurting innocent people.
We have to show that Steemit is bigger than any bully who is trying to impose his own rules by using his high SP on innocent people.
The post below is the summary of the situation :
https://steemit.com/life/@firedream/stop-the-grumpycat
Thank you for any help to stop the actions of @grumpycat.

Best Regards.

FD.

klye (73) · 7 years ago

All my servers and services have been updated with the updated code.

Good work Steem Team!

swelker101 (66) · 7 years ago

Witness updated. Thanks

rival (67) · 7 years ago

Check, I update 3 hours ago my witness servers.

drakos (70) · 7 years ago

All my servers already updated.

yehey (63) · 7 years ago (edited)

Updated and running smoothly. Thank you for a quick turn around of fixing the issue.

All my witness servers are up to date.
Full STEEMING continue.

Cheers,
@yehey

pouchon (70) · 7 years ago

Good job dev, good to catch this issue before it is too late.

adsactly-witness (64) · 7 years ago

Witness fully updated! Thank you!

decomoescribir (52) · 7 years ago

Way to go, guys!

How can we explore the next steemit updates? I would like to know what you guys working at in the near future...

timcliff (73) · 7 years ago (edited)

https://github.com/steemit

$0.00

decomoescribir (52) · 7 years ago

Thanks!!

blocktrades (74) · 7 years ago

Blocktrades' witness node was updated.

rondras (61) · 7 years ago

good that you guys take care of it.

therealwolf (75) · 7 years ago

Witness updated!

mahdiyari (67) · 7 years ago

Already updated seed and witness nodes.
keep up the updates:P

arcange (73) · 7 years ago

All my witness servers are updated.
Node servers used by SteemSQL and Steemitboard have been updated too

aggroed (78) · 7 years ago

All jacked up and good to go!

bobinson (63) · 7 years ago

updated

anarcho-andrei (64) · 7 years ago

Both my main and back up witness nodes are updated and running. Thanks for the update!

pfunk (72) · 7 years ago

My nodes are updated.

liberosist (70) · 7 years ago

Updated.

guiltyparties (70) · 7 years ago

It's been done for a while now. Thanks for the official post.

precise (57) · 7 years ago

witness server update, up and running.

klye (73) · 7 years ago

@steemitdev Got a 32.75% Vote via @klye
Send any amount of STEEM or SBD Over 1.000 & Recieve a RANDOM @KLYE VOTE Make sure to include the link to your post in the memo field of the transfer! _{( Any amounts < 1.000 STEEM or SBD will be considered donations )}
Vote power is Generated via RNG (Random Number Generator)

$0.00

rifat (1) · 7 years ago

wow great news.

$0.00

funbobby51 (59) · 7 years ago

It's reassuring to hear that there was such a quick and robust response before this vulnerability was exploited, good job to everyone involved!

$0.00

samrg472 (60) · 7 years ago

My server has been updated, thank you.

$0.00

evol14life (32) · 7 years ago (edited)

.

$0.00

lahvista (44) · 7 years ago

I LOVE knowing that you guys are on it. Thank you.

$0.00

mignacio (50) · 7 years ago

That's a relief. Thanks for the info

$0.00

setapart (52) · 7 years ago

Thats a great news...at least we have wonderful engineers. Thanks for info

$0.00

sarahvain (51) · 7 years ago

Thank you for looking after the community, the investments and the tech!

$0.00

palik (47) · 7 years ago

Earlier this week, steemit was informed of a potential vulnerability in steemd that could lead to a denial of service attack in both the API and P2P layers of steemd, but has absolutely no impact on the cryptography securing the Steem blockchain

Who informed?
Where informed ?
Could you refer to an issue or PR, please.

$0.00

mejustandrew (58) · 7 years ago

A DoS is not so bad unless it lasts a lot. It is great to hear that it is fixed now, you are moving fast, guys, great job!

$0.00

veleje (49) · 7 years ago (edited)

Suggestion, could it be added a check, verification, who of witnesses did update and give us voters this information on that witness web page, so we voters can ask 'our' witness to do their job or we can take votes away from the ones not doing update. Could this be done?

$0.00

oldtimer (75) · 7 years ago

good job guys.

$0.00

dakini5d (55) · 7 years ago

Thanks so much for keeping us informed as quickly as possible of threats to Steemd security. Much appreciated!

$0.00

juicy-shark (55) · 7 years ago

Cryptwo Witness node has been all updated

$0.00

detoye (47) · 7 years ago

Ok. We totally understand that there will always be security risks. Now we can rest assured that your security team is actively in control. We shall keep steeming

$0.00

official-hord (60) · 7 years ago

Thanks for sharing this information.

$0.00

gunner12guage (35) · 7 years ago

Good thing your on top of things guys. Good job

$0.00

idowu-kunlere (46) · 7 years ago

Kudos to all the engineers working around the clock to keep the Steem/Steemit platform safe.

In these days of volatile digital vulnerabilities, your tasks are no easy jobs! You guys and ladies rock.

$0.00

princeyk (48) · 7 years ago

Wow, i am glad the probem was identified on time and fixed. Thanks for the important update

$0.00

charitybot (63) · 7 years ago

This isn't responsible for the network slowing down for about half the day each day, is it? Bandwidth seems to get crushed around the same hours all the time.

$0.00

timcliff (73) · 7 years ago

Bandwidth is unrelated.

$0.00

bitgeek (62) · 7 years ago

Congratulations @steemitdev, this post is the most rewarded post (based on pending payouts) in the last 12 hours written by a User account holder (accounts that hold between 0.1 and 1.0 Mega Vests). The total number of posts by User account holders during this period was 2609 and the total pending payments to posts in this category was $11820.44. To see the full list of highest paid posts across all accounts categories, click here.

If you do not wish to receive these messages in future, please reply stop to this comment.

$0.00

statsmonkey (49) · 7 years ago

Congratulations, your post received one of the top 10 most powerful upvotes in the last 12 hours. You received an upvote from @thejohalfiles valued at 281.70 SBD, based on the pending payout at the time the data was extracted.

If you do not wish to receive these messages in future, reply with the word "stop".

$0.00

cranium (76) · 7 years ago

Any information that the system is safe in me is very encouraging.

$0.00

akbarsyekhi (25) · 7 years ago

I am glad to hear you in this case. Security is a constant battle and Steemit may be attacked as it gets more popular. Some of us remember the previous attacks. At least we have some other options to access the blockchain..

$0.00

eljuans (41) · 7 years ago

could you explain how to do this o.O!!!!!!!!!!!!!

$0.00

masterwriter (58) · 7 years ago

Kudos to the engineers for a timely intervention.
We are unstoppable.

$0.00

libertyranger (59) · 7 years ago

My witness node is now compliant with the update as per @someguy123 revision he posted for steem-in-abox

$0.00

vandumxx (41) · 7 years ago

thanks for the info!
hehehe
great help...
God bless!!!

$0.00

isnochys (66) · 7 years ago

Where are the release notes?
What has been changed?

$0.00

isnochys (66) · 3 years ago

_

$0.00

alphacore (64) · 7 years ago

is this the reason poloniex deposit is broken again?

$0.00

vvk (50) · 7 years ago

Can you please provide URL to commit which fixes the issue? It that related to latest fc library changes?

$0.00

shanto24 (52) · 7 years ago

Please visit this link
i am sure changing your mind
https://steemit.com/respect/@shanto24/great-steemit-user-2-18

Thank you..👌

$0.00

sircork (64) · 7 years ago (edited)

$0.00

sircork (64) · 7 years ago

$0.00