3 ms·

Why does a web interface need to directly manipulate the wallet? It needs to store the transactions somewhere where the machine that executes them (using the wa

• btilly 14y ago
  Doesn't matter whether you do it directly or indirectly. There is some way of automatically manipulating money, and it will discover what it is. I can dream up architectures which limit manipulations, require the user to constantly type in passwords, etc. A company not security conscious enough to update is unlikely to have done that. But suppose they did, what happens? EVEN THEN you can turn the website into the digital equivalent of an ATM skimmer, and steal money. That is, of course, assuming that I have not managed to turn shell access into some more direct compromise of your whole network. Here is the moral. If you're directly handling money or a money equivalent on your website, and someone has shell access, they will be able to steal from you.
  • cstejerean 14y ago
    That's why you put velocity controls in place, so that if things go south you can limit losses. Coupled with alerting/reporting on transaction volumes and you should be able to get ahead of someone that bypassed your front end before they make off with all of your cash. That said, if the backend is also vulnerable to the same or another exploit, that's not going to buy you much.