Pitfalls of open architecture: How friends can exploit your cryptocurrency wallet

Tutkimustuotos: Artikkeli kirjassa/konferenssijulkaisussaConference contributionScientificvertaisarvioitu

3 Sitaatiot (Scopus)
389 Lataukset (Pure)

Abstrakti

Many cryptocurrency wallet applications on desktop provide an open remote procedure call (RPC) interface that other blockchain-based applications can use to access their functionality. This paper studies the security of the RPC interface in several cryptocurrency wallets. We find that, in many cases, a malicious process running on the computer regardless of its privileges can impersonate the communication endpoints of the RPC channel and, effectively, steal the funds in the wallet. The attacks are closely related to server and client impersonation on computer networks but occur inside the computer. The malicious process may be created by another authenticated but unprivileged user on the same computer or even by the guest user. The main contribution of this paper is to raise awareness among wallet developers about the need to protect local RPC channels with the same prudence as network connections. We also hope that it will discourage users to run security-critical applications like cryptocurrency wallets on shared systems or computers with guest account enabled.
AlkuperäiskieliEnglanti
OtsikkoProceedings of the 12th European Workshop on Systems Security, EuroSec 2019
KustantajaACM
Sivut6
ISBN (elektroninen)978-1-4503-6274-0
DOI - pysyväislinkit
TilaJulkaistu - 25 maalisk. 2019
OKM-julkaisutyyppiA4 Artikkeli konferenssijulkaisuussa
TapahtumaEuropean Workshop on Systems Security - Dresden, Saksa
Kesto: 25 maalisk. 201928 maalisk. 2019
Konferenssinumero: 12

Workshop

WorkshopEuropean Workshop on Systems Security
LyhennettäEuroSec
Maa/AlueSaksa
KaupunkiDresden
Ajanjakso25/03/201928/03/2019

Sormenjälki

Sukella tutkimusaiheisiin 'Pitfalls of open architecture: How friends can exploit your cryptocurrency wallet'. Ne muodostavat yhdessä ainutlaatuisen sormenjäljen.

Siteeraa tätä