So how would someone steal coins from my site? Nearly every attack I've ever read about has involved bad website coding in one fashion or another. Like that that attack on the Doge wallet site in December, where they allegedly injected the website, and got in through a quirk in Apache to modify the source code, which allowed the alleged crooks to allegedly modify the destination of the transactions by replacing a variable with a hard coded address, that led to their wallet --thereby stealing new transactions and withdrawals. It's been the same or similar with most other attacks on sites that store wallets on the server that I've read about.

So the importance of coding a secure multi-tiered website is very important. I need to watch for injection attacks, apache permissions issues, and open ports, and all the usual stuff I would watch for on a site where money is changing hands. Got it.

But is it always poor website coding that causes site owners to lose money? Is there anything a potential vandal or cracker can do in order to compromise my site in other ways? Also, is there a whitepaper on building bitcoin protocol empowered websites securely, anywhere?

Thanks in advance for your time.
You should assume your site is going to be hacked, and design with that in mind.

Blaming things on "poor coding" is a get out. There will always be bugs. You must be sure your procedures, your protocols, are faultless despite these bugs.

The majority of bitcoins should be in offline storage, and your hot wallet should be on its own dedicated server, with access through some kind of very limited API that does sanity checks and rate limiting on everything. (Access could be through a custom and very carefully written daemon i.e. not just some Apache HTTP API with associated vulnerabilities!)

Ideally, the user owns an encryption key that is used to somehow client side sign transactions (or any other action they take) which are applied to their account or the hot wallet.

Even then, a hacker could presumably hijack the serving of your pages, modify the crypto etc to steal their key. But at least if the user's key was only generated once and is only used by them occasionally, the chance for massive theft is reduced. Two factor auth may help too.

You could have daemons on other hidden servers that regularly check your site and its resources for tampering, suspending everything if necessary. Perhaps release a browser add-on which verifies your site. Your entire site could be signed, and the add-on could request a new signature to verify any changes. (And you perform this signing offline). As long as the user's browser or the add-on publishing system doesn't get compromised, you'll be alright ;)

To summarise all that:


client side encryption/authorisation of any action a user can take
this simply tunnels through the terribly insecure WWW/apache etc layer to a very limited access highly secure "hot wallet" server
some way of verifying that client side encryption is not compromised, e.g. watchdogs running on IPs unknown to attackers
(and lots of other watchdogs all over the place which halt service at the slightest cause for concern)


You'll do all this and then your hosting provider will be compromised by social engineering.

At the end of the day, all said and done, your most effective protection will be the offline cold wallet with manual (and slow and annoying) transfers of customer's funds, and regular audits to check all funds are actually there (mtgox lol).

btw, this is written by somebody with no background in security, imagine what somebody who did have such a background might write ;)

Final point: If you are thinking of running a wallet service, don't. Just don't. Give up now. It's going to end in tears, and death threats.