EIDOS mining attack analysis: Developers launching CPU payment tools should self-check potential security risks

Last night between 19:04 and 23:29, PeckShield risk control platform DAppShield detected that hackers launched continuous attacks on the EOS guessing game BigGame, using its newly launched CPU payment function to conduct malicious mining, causing its CPU resources to be exhausted, and a total of 1,993 EIDOS tokens were obtained.

PeckShield security personnel analyzed and found that BigGame's newly launched CPU payment function has a defect that can hijack the transfer notification to initiate inline operations, making its CPU maliciously controlled. With the continued popularity of EIDOS, many digital wallets or DApps have successively developed one-click mining functions to help users automatically implement transfer operations through intelligent programs. However, once there is a potential security risk, this auxiliary tool will become an accomplice of the attacker, causing damage to the ordinary user experience. PeckShield hereby reminds developers that if the CPU payment function has been launched, they should self-check potential security risks to avoid damage to the ordinary user experience due to malicious attacks. If necessary, they can seek assistance from third-party security companies to help them complete attack testing and basic security defense deployment before the launch of new functions.