Disable eval and exec inside the Electrum shell (Qt console) to reduce malware attacks on users
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 8.6k
- Forks
- 3.5k
- Avg merge
- 2d 8h
- Merged PRs (30d)
- 61
Description
Recently a user on Reddit reported that a Bitcoin mixing service asked them to run a suspicious command inside their Electrum shell. I investigated the command and discovered it was a wallet stealing malware:
https://github.com/CodeForcer/bitmixer-scam-analysis
I would like to propose that Electrum disable the use of exec() and eval() in the shell. This wont eliminate these kinds of attacks but will make them slightly more difficult.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by locating the Qt console implementation and its handling of eval() and exec(). Review how shell commands are currently executed and determine the safest restriction consistent with the issue. Done means those functions can no longer be used in the Electrum shell, with relevant console behavior covered by tests if existing tests are found.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- cli, security
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100