Bitcoin Ops & Security Primer

rainforest @rainforestqa Bitcoin + Ops Primer:! Understand your risk Manage
attacks

@rainforestqa rainforest Rainforest Human powered QA SaaS Designed for ‘Continuous
QA’ Built for PMs and Developers

@rainforestqa rainforest Us Team of 6 in SoMa All developers
YC S12

@rainforestqa rainforest Understanding risk

rainforest @rainforestqa Understand the trade off More secure generally means
more effort

@rainforestqa rainforest Risk vs Exposure

@rainforestqa rainforest High Risks Hot wallets / key storage Outgoing
payments Physically shipped items Reversible payments (e.g. chargebacks)

@rainforestqa rainforest …more risks Shared hosting / VPS / “physical”
security Staff

@rainforestqa rainforest Limiting Exposure Storing keys Hot wallets -> Cold
wallets, where poss Principle of least privilege

@rainforestqa rainforest What risks?

rainforest @rainforestqa Internet connected = hackable (Though, the NSA can
spy on you, even if you're not connected to the Internet)

@rainforestqa rainforest Top 5 >1k BTC hacks 46k / Linode
(Bitcoinica): exploit in admin area / staff —> hotwallet 11k / Bitcoin7: “hacked” 4.5k / BTC-E: Insecure external API key 4k / Kronos: self hack / backdoor 2.6k / Gox 2011: exploit in admin area

@rainforestqa rainforest Top 3 reasons:

@rainforestqa rainforest Badly conﬁgured servers / services

@rainforestqa rainforest Poorly written software

@rainforestqa rainforest Exploits

@rainforestqa rainforest Attack vectors Your service Your customers You &
your team

@rainforestqa rainforest Your service Domain Email Servers (app, db, etc)
Network External services Backups

@rainforestqa rainforest Domain DNS hijacking MITM attacks Doppelganger domains /
Typo-squatting Renewals

@rainforestqa rainforest HSTS Pinning / force-ssl Cloudﬂare, imho Firewall +
IDS

@rainforestqa rainforest Email DKIM / SPF Account state Clear email
policies Lockout policy

@rainforestqa rainforest Servers Shared / VPS / AWS Dedicated Co-lo
>

@rainforestqa rainforest OS + software updates Automate provisioning Hire pen-testing
Have a security program

@rainforestqa rainforest Transactions & locking (see Flexcoin / Poloniex)

@rainforestqa rainforest Network IDS / IDPS / HIDS Firewall (both
ways) -complex-

@rainforestqa rainforest External services Verify SSL certs Limit IPs Work
out what + who you can trust

@rainforestqa rainforest Backups Major security issue Encrypt them Test them

@rainforestqa rainforest Your customers Understand their behavior (Progressive) Account limits
Policies KYC

@rainforestqa rainforest Primer

@rainforestqa rainforest Educate yourself

@rainforestqa rainforest Pick secure by default tech

@rainforestqa rainforest 2FA

@rainforestqa rainforest Avoid shared servers

@rainforestqa rainforest Honey pots

@rainforestqa rainforest Automate deployment

@rainforestqa rainforest Use SSH keys, rotate them

@rainforestqa rainforest Use a Firewall

@rainforestqa rainforest Use an IDS

@rainforestqa rainforest Encrypt (and take!) backups

@rainforestqa rainforest Subscribe to security lists

@rainforestqa rainforest Do as little as possible

@rainforestqa rainforest Staff opsec

@rainforestqa rainforest Principle of least privilege

@rainforestqa rainforest Split your servers

@rainforestqa rainforest Or consider LXC / KVM

@rainforestqa rainforest Split your app

@rainforestqa rainforest Server: partitions + noexec + nosuid split running
users disable root remove packages SELinux

@rainforestqa rainforest Starting points Figure out your risk + exposure
Implement low hanging fruit Reduce surface Plan the rest

@rainforestqa rainforest Conclusions Simpler = better Understand your exposure and
limit it

@rainforestqa rainforest Further reading Hacks: https://bitcointalk.org/index.php?topic=83794.0 Flexcoin: http://hackingdistributed.com/2014/04/06/another-one-bites-the-dust- ﬂexcoin/ Docker:
http://www.slideshare.net/jpetazzo/linux-containers-lxc-docker-and- security CVE: http://web.nvd.nist.gov/view/vuln/search?execution=e2s1

rainforest @rainforestqa Questions? @rainforestqa @rhs

Bitcoin Ops & Security Primer

Bitcoin Ops & Security Primer

More Decks by Russell Smith

Other Decks in Technology

Featured

Transcript