This is a primer for people that are running apps using bitcoin - what are the common things that get attacked, how do you you understand your risk. Originally presented at http://www.meetup.com/SF-Bitcoin-Devs/events/175021632/

1. rainforest @rainforestqa
Bitcoin + Ops Primer:!
Understand your risk
Manage attacks

2. @rainforestqarainforest
Rainforest
Human powered QA SaaS
Designed for ‘Continuous QA’
Built for PMs and Developers

3. @rainforestqarainforest
Us
Team of 6 in SoMa
All developers
YC S12

4. @rainforestqarainforest
Understanding risk

5. rainforest @rainforestqa
Understand the trade off
More secure generally means more effort

6. @rainforestqarainforest
Risk vs Exposure

7. @rainforestqarainforest
High Risks
Hot wallets / key storage
Outgoing payments
Physically shipped items
Reversible payments (e.g. chargebacks)

8. @rainforestqarainforest
…more risks
Shared hosting / VPS / “physical” security
Staff

9. @rainforestqarainforest
Limiting Exposure
Storing keys
Hot wallets -> Cold wallets, where poss
Principle of least privilege

10. @rainforestqarainforest
What risks?

11. rainforest @rainforestqa
Internet connected = hackable
(Though, the NSA can spy on you, even if you're not connected to the Internet)

12. @rainforestqarainforest
Top 5 >1k BTC hacks
46k / Linode (Bitcoinica): exploit in admin area / staff
—> hotwallet
11k / Bitcoin7: “hacked”
4.5k / BTC-E: Insecure external API key
4k / Kronos: self hack / backdoor
2.6k / Gox 2011: exploit in admin area

13. @rainforestqarainforest
Top 3 reasons:

14. @rainforestqarainforest
Badly configured servers /
services

15. @rainforestqarainforest
Poorly written software

16. @rainforestqarainforest
Exploits

17. @rainforestqarainforest
Attack vectors
Your service
Your customers
You & your team

18. @rainforestqarainforest
Your service
Domain
Email
Servers (app, db, etc)
Network
External services
Backups

19. @rainforestqarainforest
Domain
DNS hijacking
MITM attacks
Doppelganger domains / Typo-squatting
Renewals

20. @rainforestqarainforest
HSTS
Pinning / force-ssl
Cloudflare, imho
Firewall + IDS

21. @rainforestqarainforest
Email
DKIM / SPF
Account state
Clear email policies
Lockout policy

22. @rainforestqarainforest
Servers
Shared / VPS / AWS
Dedicated
Co-lo
>

23. @rainforestqarainforest
OS + software updates
Automate provisioning
Hire pen-testing
Have a security program

24. @rainforestqarainforest
Transactions & locking
(see Flexcoin / Poloniex)

25. @rainforestqarainforest
Network
IDS / IDPS / HIDS
Firewall (both ways)
-complex-

26. @rainforestqarainforest
External services
Verify SSL certs
Limit IPs
Work out what + who you can trust

27. @rainforestqarainforest
Backups
Major security issue
Encrypt them
Test them

28. @rainforestqarainforest
Your customers
Understand their behavior
(Progressive) Account limits
Policies
KYC

29. @rainforestqarainforest
Primer

30. @rainforestqarainforest
Educate yourself

31. @rainforestqarainforest
Pick secure by default tech

32. @rainforestqarainforest
2FA

33. @rainforestqarainforest
Avoid shared servers

34. @rainforestqarainforest
Honey pots

35. @rainforestqarainforest
Automate deployment

36. @rainforestqarainforest
Use SSH keys, rotate them

37. @rainforestqarainforest
Use a Firewall

38. @rainforestqarainforest
Use an IDS

39. @rainforestqarainforest
Encrypt (and take!) backups

40. @rainforestqarainforest
Subscribe to security lists

41. @rainforestqarainforest
Do as little as possible

42. @rainforestqarainforest
Staff opsec

43. @rainforestqarainforest
Principle of least privilege

44. @rainforestqarainforest
Split your servers

45. @rainforestqarainforest
Or consider LXC / KVM

46. @rainforestqarainforest
Split your app

47. @rainforestqarainforest
Server:
partitions + noexec + nosuid
split running users
disable root
remove packages
SELinux

48. @rainforestqarainforest
Starting points
Figure out your risk + exposure
Implement low hanging fruit
Reduce surface
Plan the rest

49. @rainforestqarainforest
Conclusions
Simpler = better
Understand your exposure and limit it

50. @rainforestqarainforest
Further reading
Hacks: https://bitcointalk.org/index.php?topic=83794.0
Flexcoin: http://hackingdistributed.com/2014/04/06/another-one-bites-the-dust-
flexcoin/
Docker: http://www.slideshare.net/jpetazzo/linux-containers-lxc-docker-and-
security
CVE: http://web.nvd.nist.gov/view/vuln/search?execution=e2s1

51. rainforest @rainforestqa
Questions?
@rainforestqa
@rhs