BitcoinArmory icon indicating copy to clipboard operation
BitcoinArmory copied to clipboard

Restrict IPC port to local connections

Open s1kx opened this issue 9 years ago • 0 comments

Currently, Armory listens for interprocess connections on port 8223 on all interfaces. This is potentially dangerous, as this means that an attacker can trigger a payment dialog on the users screen from the network (or potentially the internet if the machine is not firewalled).

Example (where 192.168.1.6 is the remote IP of the computer running Armory):

echo 'bitcoin:1ArmoryXcfq7TnCSuZa9fQjRYwJ4bkRKfv?amount=100' | nc 192.168.1.6 8223

This can be fixed by making armory listen only on the local interface with my commit.

s1kx avatar Nov 27 '15 23:11 s1kx