<p>I am not sure if there are verified reports, but I would be shocked if there were not any man in the middle attacks.</p>

<p>It's super simple to do. Compromise the vendors payment processing (exploit a security hole on the vendors web werver. if the wallet address is generated from a local bitcoin instance, an atacker could point the address generation code away from the vendors instance and towards their own malicious bitcoin instance... Or the malicious user could just hard code their own address in to the payment processing. Depends on how intricate it needs to be. You could even compromise the vendor by having a copy of their wallet, watching silently for a large transaction then running once you find a big haul of coins.) you could compromise their payment gateway api and have it redirect to you(or your coin address) instead of the vendors address. or if they use email: simply compromise the communication protocol (email/web support ticket/etc) and replace the merchants address with yours.</p>

<p>A script kiddie sadly could (and probably has) executed one or all of these methods of attack... There's a ton of ways to do it. Those are just a few off the top of my head.</p>

<p>Be safe. Do not try any of this! This information is posted so you get an idea of what to keep in mind.</p>

CC BY-SA 3.0
2013-11-07T13:05:43.383Z
Thanks for the answer. True, those have probably been executed, but it still seems to be something one rarely sees reports about as opposed to people hacking into a site and emptying wallets for example. (Another example of the man-in-the-middle attack could also be to paste a QR code with the attacker's address over the real address' QR code.)
Brian Fabian Crain
CC BY-SA 3.0
2013-11-06T02:31:01.047Z
2013-11-06T02:31:01.047Z
Joe White
<p>The two main problems generally mentioned that payment protocol <a href="https://en.bitcoin.it/wiki/BIP_0070" rel="nofollow">“BIP 0070” (Andresen, 29-07-2013)</a> is supposed to solve are usability and protection against Man-In-The-Middle attacks. In the latter the attacker would substitute an address he owns for the merchant's address when the payment address is shown to the customer. This could result in the customer paying the attacker instead of the merchant.</p>

<p>Has this attack been done before? If so, how was it implemented?
Or is this just a theoretical problem?</p>

<security><bip70-payment-protocol>
Has the payment protocol – which is supposed to protect against Man-In-The-Middle attacks – ever been implemented?
Brian Fabian Crain
# Has the payment protocol – which is supposed to protect against Man-In-The-Middle attacks – ever been implemented?

(Asked by: username_0 on 2013-11-05)

The two main problems generally mentioned that payment protocol [“BIP 0070” (Andresen, 29-07-2013)](https://en.bitcoin.it/wiki/BIP_0070) is supposed to solve are usability and protection against Man-In-The-Middle attacks. In the latter the attacker would substitute an address he owns for the merchant's address when the payment address is shown to the customer. This could result in the customer paying the attacker instead of the merchant.

Has this attack been done before? If so, how was it implemented?
Or is this just a theoretical problem?

**Tags:** security, bip70-payment-protocol


---

## 1 answers

### Answer by username_1 on 2013-11-06. Score: 1 | Accepted answer

I am not sure if there are verified reports, but I would be shocked if there were not any man in the middle attacks.

It's super simple to do. Compromise the vendors payment processing (exploit a security hole on the vendors web werver. if the wallet address is generated from a local bitcoin instance, an atacker could point the address generation code away from the vendors instance and towards their own malicious bitcoin instance... Or the malicious user could just hard code their own address in to the payment processing. Depends on how intricate it needs to be. You could even compromise the vendor by having a copy of their wallet, watching silently for a large transaction then running once you find a big haul of coins.) you could compromise their payment gateway api and have it redirect to you(or your coin address) instead of the vendors address. or if they use email: simply compromise the communication protocol (email/web support ticket/etc) and replace the merchants address with yours.

A script kiddie sadly could (and probably has) executed one or all of these methods of attack... There's a ton of ways to do it. Those are just a few off the top of my head.

Be safe. Do not try any of this! This information is posted so you get an idea of what to keep in mind.

> **Comments:**
> **username_0**: Thanks for the answer. True, those have probably been executed, but it still seems to be something one rarely sees reports about as opposed to people hacking into a site and emptying wallets for example. (Another example of the man-in-the-middle attack could also be to paste a QR code with the attacker's address over the real address' QR code.)  

---

