i make topic: https://bitcointalksearch.org/topic/usage-report-including-conceptual-security-issue-410
thank d1337r! :-)
Topic: A security bug in headless client? (Read 8286 times)
(not found by me, but by linux.org.ru user mkfifo)
If you start bitcoind as one user, then type some command as the other user (e.g. bitcoind getbalance), it will work and output your balance. It may be very dangerous on multi-user systems. Imagine there is a user with a hard password that owns bitcoin wallet and a user with weak password that doesn't. So if a hacker breaks the other user's password or gets access to the other user's account, he could steal the money from the first user.
Some desktops (Windows and Linux) even have the guest account with no password, that can be used to steal bitcoins too.
The solution would be to open a UNIX socket with read/write permissions only for the user/group it is opened as.
If you start bitcoind as one user, then type some command as the other user (e.g. bitcoind getbalance), it will work and output your balance. It may be very dangerous on multi-user systems. Imagine there is a user with a hard password that owns bitcoin wallet and a user with weak password that doesn't. So if a hacker breaks the other user's password or gets access to the other user's account, he could steal the money from the first user.
Some desktops (Windows and Linux) even have the guest account with no password, that can be used to steal bitcoins too.
The solution would be to open a UNIX socket with read/write permissions only for the user/group it is opened as.
Jump to: