Search and delete bitcoin core and other related files to reduce attack surface

Question

1. Do we have any option in Bitcoin Core to search files used by it? Or any option to delete all such files?

2. Are all important files deleted when uninstalling Bitcoin Core?

3. Should we remove such files from different machines and what are the easiest ways possible to do this for images, VMs and hosts?

Answer 1

1. No

2. No. What happens to wallet.dat if I uninstall and re-install on Windows Bitcoin desktop client?

3. Depends on the user and it's good to delete such files from system that will not be used anymore if you have backup.

Scanning bitcoin core related important files with an open source tool: https://github.com/deepfence/SecretScanner

It will search for lot of files including 3 related to Bitcoin Core:

  - part:  'filename'
    match: 'wallet.dat'
    name: 'Bitcoin Core wallet'
  - part:  'filename'
    match: 'onion_v3_private_key'
    name: 'Private key for Bitcoin Core onion service'
  - part:  'filename'
    match: 'bitcoin.conf'
    name: 'Bitcoin Core config'

https://github.com/deepfence/SecretScanner/blob/779b22df6d536b54bc4fb74fdf56d582f008f4a0/config.yaml#L477

Maybe we can even add debug.log in this.

A blog post about "Detecting secrets to reduce attack surface": https://medium.com/deepfence-cloud-native-security/detecting-secrets-to-reduce-attack-surface-3405ee6329b5

TLDR:

Secrets are as important as vulnerabilities from cybersecurity point of view, as attackers can very easily get backdoor access into customer infrastructure and spread laterally to launch multi-stage attacks due to leakage of secrets.