Bitcoin Web Application Security
summary
Catalogue of real exploits and concrete defenses: shows file inclusion, source‑code disclosure, mass‑assignment and CSRF failures that let wallets or admin accounts be taken, and recounts npm incidents (left‑pad and event‑stream/flatmap‑stream) where supply‑chain packages became malware. Cites Safari JIT randomness bug that made some wallets unspendable and SIM‑port SMS attacks that defeat recovery. Recommends practical fixes: pin dependencies with hashes, run a separate watch‑only monitor for funds, prefer hardware keys for MFA, disable unnecessary JavaScript and avoid storing keys on web‑connected hosts.
AI-written summary · about
chapters (17)
- 0:00Intro
- 0:20whoami, background slide
- 0:47Web application security, in general
- 1:40Condensed cheat sheet for web hacking
- 1:58Example: File inclusion vulnerability
- 3:20Example: Source code disclosure via exposed git
- 5:09xkcd 327: Little Bobby Tables
- 5:23Example: Egor Homakov, GitHub and Rails incident
- 7:23Bitcoin exchanges
- 9:59The left-pad incident
- 10:52The event-stream/Bitpay Copay incident
- 12:43Insufficient logging
- 14:46Browser extensions...
- 15:23Account recovery attacks, phone numbers and 2FA • Non random password reset tokens
- 17:18Responsible disclosure
- 19:44Gaming: Reverse engineering
- 20:22Takeaways
related talks
55mBreaking and Fixing Web Application Security
46mApplication security from start to finish
32mWriting Secure JavaScript Code
41mLive Hacking: Breaking into Your Web App
58mModern web application bugs
15m“Security” in the JavaScript ecosystem
47mLive Hacking: Breaking into Your Web App
35mStrangerDanger: Finding Security Vulnerabilities Before They Find You!