2

The two main problems generally mentioned that payment protocol “BIP 0070” (Andresen, 29-07-2013) is supposed to solve are usability and protection against Man-In-The-Middle attacks. In the latter the attacker would substitute an address he owns for the merchant's address when the payment address is shown to the customer. This could result in the customer paying the attacker instead of the merchant.

Has this attack been done before? If so, how was it implemented? Or is this just a theoretical problem?

Improve this question

1 Answer 1

Reset to default
1

I am not sure if there are verified reports, but I would be shocked if there were not any man in the middle attacks.

It's super simple to do. Compromise the vendors payment processing (exploit a security hole on the vendors web werver. if the wallet address is generated from a local bitcoin instance, an atacker could point the address generation code away from the vendors instance and towards their own malicious bitcoin instance... Or the malicious user could just hard code their own address in to the payment processing. Depends on how intricate it needs to be. You could even compromise the vendor by having a copy of their wallet, watching silently for a large transaction then running once you find a big haul of coins.) you could compromise their payment gateway api and have it redirect to you(or your coin address) instead of the vendors address. or if they use email: simply compromise the communication protocol (email/web support ticket/etc) and replace the merchants address with yours.

A script kiddie sadly could (and probably has) executed one or all of these methods of attack... There's a ton of ways to do it. Those are just a few off the top of my head.

Be safe. Do not try any of this! This information is posted so you get an idea of what to keep in mind.

Improve this answer
1
  • Thanks for the answer. True, those have probably been executed, but it still seems to be something one rarely sees reports about as opposed to people hacking into a site and emptying wallets for example. (Another example of the man-in-the-middle attack could also be to paste a QR code with the attacker's address over the real address' QR code.)
    – Brian Fabian Crain
    Commented Nov 7, 2013 at 13:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.