Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I am running a bitcoin client on my archlinux computer. If somebody can get ahold of the wallet.dat file, located in the ~/.bitcoin/ directory they can steal my coins.

I have minimal software installed. Basically just xfce4, xfce4-goodies, bitcoin and a few other programs I deem necessary.

How plausible is it for one of the developers/repository-managers of the ~100 odd software packages I have installed on my operating system to silently send my wallet.dat file to themselves in the next update of their software?

Should I be inspecting all of my software updates for this possibility to be on the safe side? The downside to this approach is that archlinux inherently uses all of the latest software updates/patches in their official repository.

Are there any protectionary measures in linux to prevent software packages from accessing folders outside of their jurisdiction? Groups perhaps?

share|improve this question
2  
This question appears to be off-topic because it belongs on Information Security... –  jasonwryan Nov 19 '13 at 5:57
2  
don't use software you don't trust. in almost any system (except maybe Linux from Scratch) you will have to trust the software vendors. in the words of Mark Shuttleworth: "um, we [the distributions] have root." –  strugee Nov 19 '13 at 6:25
    
You could take basic security measures like changing the path of your wallet file. I'm not sure if the bitcoin client you're using gives you an option to do that. It most likely should. –  Chirag64 Nov 19 '13 at 7:08
    
I'd store high-value wallets on a dedicated computer that's kept offline. Use this comp to sign transactions, and a normal computer for the reading part. A friend uses a raspberry pi to store the wallet since it's simple and cheap. –  CodesInChaos Nov 20 '13 at 10:44

3 Answers 3

The short answer is no.

The Unix security model is fundamentally designed to isolate one user's data from other users. It is not designed to confine applications. All the applications that you run have the same privileges. Your file manager can obviously read your files (that's the whole point) and it has network access too (e.g. to mount remote shared drives). Other applications perforce have the same privileges.

Most of the time, this porosity is desired. I want to save a file from my email client and open it in my word processor. I want to copy some data from my word processor to my web browser via the clipboard. I want my email client and web browser to open all kinds of external programs to view files that they don't understand natively. I want my desktop macro program to be able to capture all keystrokes and inject keystrokes in applications. I want my backup software to be able to read and write to all my files.

Modern Linux systems have additional security mechanisms that provide a limited form of security restrictions on applications. But they are mostly designed to confine system services that don't interact with many other local applications.

If you want to isolate your Bitcoin wallet from your normal activities, you need to sacrifice some convenience for security. The most basic step is to store your Bitcoin wallet under a different user account. That way, applications that you use only with your normal account would be unable to touch it.

Any application that you use with the Bitcoin account is part of your trusted base — the part of the system that you need to trust since it is able to breach your security. This includes the kernel, a number of system daemons and programs, whatever shell and file manager you run as the Bitcoin user, whatever method you use to log into the Bitcoin account, all Bitcoin software, etc. Of course, the downside of that is that it'll make using your wallet harder. If you isolate your wallet from the context where you use it, that makes transfers more difficult.

An advantage of open-source software is that it makes a backdoor that accesses your Bitcoin wallet somewhat hard to hide. You may not feel the need to inspect the software personally because overall a lot of people dig into the source code for this and that. That's in addition to the network traffic which you or others might detect. If there was a backdoor, there's a good chance that it would be detected.

share|improve this answer
    
Whoever downvoted this, could you leave a comment as to why? I am trying to learn as much as possible about this topic. Thank you Gilles for your response. –  GigabyteCoin Nov 20 '13 at 3:58
    
@GigabyteCoin Nobody either upvoted or downvoted this answer. I linked this question in the Information Security chatroom so it might get a few more eyeballs. –  Gilles Nov 20 '13 at 10:09

The traditional Unix Discretionary Access Control (DAC) mechanisms, such as user and group permissions, are unfortunately ill suited for compartmentalizing processes running with the the same effective UID. To this end, the Linux kernel supports several Mandatory Access Control (MAC) Linux Security Modules (LSMs), which allow an access control policy to be enforced on process subjects and file objects.

The most prominent MAC LSM in Linux is probably Security-Enhanced Linux (SELinux). SELinux features a flexible policy language for defining security domains, commonly called SELinux contexts, and access control rules for which principals are allowed to access a certain context. The mapping between files and the security contexts is called labeling, defined in policy files or extended file attributes on a file-to-file basis.

Another label-based MAC LSM is the Simple Mandatory Access Control Kernel (SMACK), which is influenced by the design of SELinux, but features a much simpler access control rule format.

share|improve this answer

You have several choices when trying to protect some kind of information on your computer against rogue software and/or malware:

  • Don't store the information on your high-risk computer on a permanent basis (eg: store it on some other computing device: your tablet, phone, other computer, whatever), only move the information needed there when you actually need it, and even then, only to the extent needed. This is a meaningful solution only if your other computing device can be held more secure (which is hardly true for an Android phone, though).

  • Keep the information encrypted, using strong enough cryptographic technology (up-to-date encryption software, with a high enough bit-length key, protected by a long enough, non-dictionary-based password). Security by obscurity is not a security solution itself, however, it does increase security in addition to a proper encryption technology against non-directed attacks: not using directory & file names which refer to the contents or the encryption technology used will probably evade stupid bots and viruses which were specifically designed to get your Bitcoin wallet. You have to keep in mind that when a human is directing attack against you personally, security by obscurity will probably not help you much, you'd have to rely on the encryption technology.

  • You can use OS measures (DAC, MAC) to separate the risky activities from the information to be protected. There are drawbacks of this, however: DAC (user/group permissions) system can help you only if you can run your risky applications as a non-root user, and store the information to be protected as another user. MAC solutions can give you a much finer grained way to control access, however, it is also more difficult to set up. The usefulness of all OS measures are usually limited by the security of your OS: if the malware exploits a known vulnerability in your OS kernel, it might be able to circumvent any OS security measures.

You may also combine these approaches, which may or may not give you a better solution.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.