3

Are they more insecure than myself in my teens?

What are the attack vectors? How easily can someone take a sneak peak onto my PC and search for keypair.json?

If I'm not mistaken npm packages, VSC extension etc. can all read from file system rather easily. Should I build a whitehack package/extension/script that does this for the next hackathon?

Improve this question

1 Answer 1

Reset to default
7

They are as secure as your personal compute habits, which for most people are not great. The reason they are considered to be relatively "insecure" is that they are effectively a plain text file stored on your computer.

Think of file system wallets like a text file with your all your username/passwords in it. Would you store valuable information and login info in a plain text file on your computer? I hope not (and if you do, you should reconsider that!)

If your computer has some malicious code/virus/npm package that is running on it, then in would be trivially for the malicious code to scan the common locations that the keypair json file is stored and send it back to the attacker.

Browser based wallets a bit more secure since your private key is encrypted at rest. Meaning, when you enter your browser wallet password, it uses that password to decrypt the file system wallet and load it into memory. So if some malicious code was on your computer, scanning for keypair files in the browser extension data, they would get an encrypted file.

They would then need to obtain your web wallet password (via brute forcing or social engineering) to access your wallet's private key. This is more difficult for an attacker, but still possible given enough time.

Which is why hardware wallets are the most secure. Since the private key never leaves the device. Instead, a transaction is sent to the hardware wallet device, the transaction is signed, and send back to the computer's operating system to handle the transport to the blockchain.

A POC of a malicious package could be interesting and fairly easy to write. This type of attack is referred to a "supply chain" attack. If a package/crate was compromised, then it could exfiltrate private keys on a system.

Improve this answer
3
  • I'd like to play around with white hat hacking a bit in the following months, maybe for OPOS or the next official hackathon. Was thinking of supply chain attack via npm / VSC extension. Is Solana foundation connected with any white hat organizations or does something in particular to educate their devs? Should someone build encryption for file system wallets or we don't really care about that?
    – Josip Volarević
    Commented Jul 18, 2023 at 14:53
  • 1
    I am not personally aware of any connectioned to white hat hacking groups, but you could always reach out to the common security names in the ecosystem (i.e. MadShield, OtterSec, Sec3, etc)
    – nickfrosty
    Commented Jul 19, 2023 at 22:57
  • 1
    I personally don't think encryption for filesystem wallets is important. They are not meant to be "used in production" normally. I think hardware wallets, multisigs, and abstracted wallets are more important to make strides in and improve the user experience to get better, secure usage.
    – nickfrosty
    Commented Jul 19, 2023 at 22:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.