<p>No, just changing the output value would invalidate the transaction's signatures, which the application can easily verify. But since the application is not a fully validating node, what the attacker can do instead is to create their own transaction signed with their private key that pretends to be spending coins that don't actually exist, and use any output values they want.</p>
<p>Of course, if you use a secure channel to communicate between your application and your full node, you shouldn't need to worry about man-in-the-middle attacks.</p>

CC BY-SA 4.0
2022-02-01T12:44:15.263Z
2022-02-01T12:44:15.263Z
Vojtěch Strnad
<p>I have the appication listening bitcoin full node and receiving <code>tx</code> messages. Is it possible to change <code>TxOut</code> value by man in the middle, so I don't detect this changes?</p>
<p>Node I connect is public node, not my own. My app just recieve and send messages. No validate. When it recieve message from node it just checks checksum. So, if I'm right, Man-In-The-Middle can change message and it's checksum while message transfering.</p>

<security><attack><data-security>
Is it possible to realize MitM attack between bitcoin full node and listener of this node?
NIKITA TALANOV
# Is it possible to realize MitM attack between bitcoin full node and listener of this node?

(Asked by: username_0 on 2022-02-01)

I have the appication listening bitcoin full node and receiving `tx` messages. Is it possible to change `TxOut` value by man in the middle, so I don't detect this changes?

Node I connect is public node, not my own. My app just recieve and send messages. No validate. When it recieve message from node it just checks checksum. So, if I'm right, Man-In-The-Middle can change message and it's checksum while message transfering.

**Tags:** security, attack, data-security


---

## 1 answers

### Answer by username_1 on 2022-02-01. Score: 2

No, just changing the output value would invalidate the transaction's signatures, which the application can easily verify. But since the application is not a fully validating node, what the attacker can do instead is to create their own transaction signed with their private key that pretends to be spending coins that don't actually exist, and use any output values they want.

Of course, if you use a secure channel to communicate between your application and your full node, you shouldn't need to worry about man-in-the-middle attacks.


---

