6 ms·

This is actually super-clever, let me try to explain. Electrum is unique in that it's not a "real" bitcoin wallet. To save time and computer resources, it doesn

by Meekro 8y ago

This is actually super-clever, let me try to explain. Electrum is unique in that it's not a "real" bitcoin wallet. To save time and computer resources, it doesn't download the entire blockchain but rather connects to an Electrum Server which will do the blockchain stuff on your behalf. The Electrum Servers (anyone can run one) can check your balance and send bitcoin on your behalf. Thanks to the magic of cryptography, this is all perfectly safe. If you send bitcoin through them, they couldn't redirect it to themselves. The worst they could do is refuse to send it. Turns out Electrum Servers are allowed to return custom error messages to the client, though. So this guy set up a bunch of these servers and had them always return a message saying "Please update your electrum here: http://github.com/my-hostile-electrum/steal-yo-coins.git" http://github.com/my-hostile-electrum/steal-yo-coins.git". What's worse, because Electrum is using the QT QMessageBox, these errors are displayed with full HTML rendering, making them look even more convincing. So, crap. Bitcoin is, as they say, a bug bounty on the entire world.

sleepybrett 8y ago
Is this just a roundabout way to get paid for finding the bug ;)
Kaveren 8y ago
Here is a picture from the Reddit thread [0]. Absolutely unacceptable design not to account for something like that when programming software. There should be an explicit notice of where the message is coming from. I see people blaming users for trusting a new GitHub repository, but the fault rests solely on the contributors to the project responsible for this. [0] https://user-images.githubusercontent.com/29142493/50359293-8780b500-055c-11e9-8cfd-83b342edeffb.png https://user-images.githubusercontent.com/29142493/50359293-...
- Meekro 8y ago
  You're right, and Electrum actually has a history of severe security bugs. I think there was one a while back where any website you visit could use JS to connect to Electrum's RPC interface and do things on your behalf.
- nradov 8y ago
  It seems unfair to claim that anything is "unacceptable" in free software. If you're not paying for it then be thankful for whatever you get. No one is forced to use it.
  - baddox 8y ago
    I don’t get it. Why should anyone be thankful that they lost bitcoins, simply because the software was free? I really dislike this trend of absolving free software of literally any quality standards whatsoever. Don’t act entitled, sure, but you’re doing no one any favors by refusing to even express desire for better quality.
    - nradov 8y ago
      If a friend gave me a free safe, and then a thief cracked it open easily due to a fragile lock and stole my money, I wouldn't blame my friend.
      - hopler 8y ago
        What if your friend gave you a free coffee with poison in it?
        nradov 8y ago
        All coffee has poison in it. Acrylamide is a known carcinogen. Caffeine is also poisonous: if you drink about 100 cups of coffee it will literally kill you. You'll have to be more specific about the type and quantity of poison.
        ouid 8y ago
        have you ever considered acting in good faith on the internet?
        nradov 8y ago
21 8y ago
Even better, the fake link looks more legit than the legit link. FAKE link: hxxxs://github.com/electrum-wallet LEGIT link: https://github.com/spesmilo/electrum https://github.com/spesmilo/electrum
- Chris_Chambers 8y ago
  Even better, there are people who honestly believe the creators of Electrum didn’t do this themselves and try to make it look like the work of completely unrelated hackers.
- digianarchist 8y ago
  Yeah they should have moved the repos to an org.
- Scoundreller 8y ago
  A redditor reported that the source posted contained the malware. Ie: compiling from source would not have saved you (unless you did the diff yourself and inspected the changes).
- berbec 8y ago
  Repo deleted
lostmsu 8y ago
So Electrum was not hacked itself, but was not designed to avoid fishing?
- meowface 8y ago
  It was not hacked, but I would say it was designed in a way that enabled a particularly pernicious kind of phishing.
  - nixpulvis 8y ago
    Seems pretty hacky to me.
    - meowface 8y ago
      Agreed.
    - gnulinux 8y ago
      I find it interesting that we call our subculture "hacker" subculture but "hacky" is a universally pejorative adjective.
- baby 8y ago
  yes to the first part. to the second part, I would rephrase that to: it has vulnerabilities related to phishing.
  - lostmsu 8y ago
    "Electrum is prone to fishing"
- will_brown 8y ago
  Feels like you are couching the famous DAO additive the code is the law. If the code allows it then it isn’t a bug/hack it’s a feature...only in the world of blockchain(s) of course.
ezoe 8y ago
It is still sounds like super-dumb to me. Bad design and you still relies on somebody else's computer who can veto your transaction. People use non-full-node SaaS Wallet because they don't understand the true value of cryptocurrency. If they got veto from the SaaS service they are using. They practically lost their property. A money never used is a lost money. Also, That's why they manually download the fake update from URL that doesn't belong to the first-party. Because they are dumb enough to use SaaS wallet.
- Meekro 8y ago
  They can't veto your transaction for very long. Remember, there are many Electrum servers and anyone can run one. An Electrum user can just transmit their transaction to other servers.

by Meekro 8y ago

sleepybrett 8y ago

Is this just a roundabout way to get paid for finding the bug ;)

Kaveren 8y ago

Here is a picture from the Reddit thread [0]. Absolutely unacceptable design not to account for something like that when programming software. There should be an explicit notice of where the message is coming from. I see people blaming users for trusting a new GitHub repository, but the fault rests solely on the contributors to the project responsible for this. [0] https://user-images.githubusercontent.com/29142493/50359293-8780b500-055c-11e9-8cfd-83b342edeffb.png https://user-images.githubusercontent.com/29142493/50359293-...

Meekro 8y ago
You're right, and Electrum actually has a history of severe security bugs. I think there was one a while back where any website you visit could use JS to connect to Electrum's RPC interface and do things on your behalf.
nradov 8y ago
It seems unfair to claim that anything is "unacceptable" in free software. If you're not paying for it then be thankful for whatever you get. No one is forced to use it.
- baddox 8y ago
  I don’t get it. Why should anyone be thankful that they lost bitcoins, simply because the software was free? I really dislike this trend of absolving free software of literally any quality standards whatsoever. Don’t act entitled, sure, but you’re doing no one any favors by refusing to even express desire for better quality.
  - nradov 8y ago
    If a friend gave me a free safe, and then a thief cracked it open easily due to a fragile lock and stole my money, I wouldn't blame my friend.
    - hopler 8y ago
      What if your friend gave you a free coffee with poison in it?
      - nradov 8y ago
        All coffee has poison in it. Acrylamide is a known carcinogen. Caffeine is also poisonous: if you drink about 100 cups of coffee it will literally kill you. You'll have to be more specific about the type and quantity of poison.
        ouid 8y ago
        have you ever considered acting in good faith on the internet?
        nradov 8y ago

21 8y ago

Even better, the fake link looks more legit than the legit link. FAKE link: hxxxs://github.com/electrum-wallet LEGIT link: https://github.com/spesmilo/electrum https://github.com/spesmilo/electrum

Chris_Chambers 8y ago
Even better, there are people who honestly believe the creators of Electrum didn’t do this themselves and try to make it look like the work of completely unrelated hackers.
digianarchist 8y ago
Yeah they should have moved the repos to an org.
Scoundreller 8y ago
A redditor reported that the source posted contained the malware. Ie: compiling from source would not have saved you (unless you did the diff yourself and inspected the changes).
berbec 8y ago
Repo deleted

lostmsu 8y ago

So Electrum was not hacked itself, but was not designed to avoid fishing?

meowface 8y ago
It was not hacked, but I would say it was designed in a way that enabled a particularly pernicious kind of phishing.
- nixpulvis 8y ago
  Seems pretty hacky to me.
  - meowface 8y ago
    Agreed.
  - gnulinux 8y ago
    I find it interesting that we call our subculture "hacker" subculture but "hacky" is a universally pejorative adjective.
baby 8y ago
yes to the first part. to the second part, I would rephrase that to: it has vulnerabilities related to phishing.
- lostmsu 8y ago
  "Electrum is prone to fishing"
will_brown 8y ago
Feels like you are couching the famous DAO additive the code is the law. If the code allows it then it isn’t a bug/hack it’s a feature...only in the world of blockchain(s) of course.

ezoe 8y ago

It is still sounds like super-dumb to me. Bad design and you still relies on somebody else's computer who can veto your transaction. People use non-full-node SaaS Wallet because they don't understand the true value of cryptocurrency. If they got veto from the SaaS service they are using. They practically lost their property. A money never used is a lost money. Also, That's why they manually download the fake update from URL that doesn't belong to the first-party. Because they are dumb enough to use SaaS wallet.

Meekro 8y ago
They can't veto your transaction for very long. Remember, there are many Electrum servers and anyone can run one. An Electrum user can just transmit their transaction to other servers.