etotheipi / BitcoinArmory

Python-Based Bitcoin Software
Other
826 stars 618 forks source link

Restrict IPC port to local connections #317

Open s1kx opened 9 years ago

s1kx commented 9 years ago

Currently, Armory listens for interprocess connections on port 8223 on all interfaces. This is potentially dangerous, as this means that an attacker can trigger a payment dialog on the users screen from the network (or potentially the internet if the machine is not firewalled).

Example (where 192.168.1.6 is the remote IP of the computer running Armory):

echo 'bitcoin:1ArmoryXcfq7TnCSuZa9fQjRYwJ4bkRKfv?amount=100' | nc 192.168.1.6 8223

This can be fixed by making armory listen only on the local interface with my commit.