5 ms·
Bitcoin trojan caught in the wild
- codex 15y agoAh, Bitcoin: the new incentive to breach computer security. Why risk stealing credit card or bank information when you can steal Bitcoins safely and anonymously?
- weavejester 15y agoOn the other hand, it's also a powerful incentive to improve computer security.
- rick888 15y agoNo matter how much you improve it, there will be a never ending supply of end users that won't install the proper updates.
- weavejester 15y agoWhy give them the choice? You could automatically download and apply the updates in the background, given a sufficiently sophisticated updater. That's basically Google's plan with ChromeOS.
- Groxx 15y ago>it has one motive: to locate your Bitcoin wallet.dat file and email it to the attacker. Craziness. They could just send the coins to a Bitcoin address, and it wouldn't identify them at all.
- kinghajj 15y agoSending bitcoins is a more involved process than simply copying the wallet.dat file, though. If the author is smart, the email cannot be tied to him anyways.
- illumin8 15y agoStealing your wallet.dat is easier. With a copy of your private keys they can spend your coins from anywhere, without having to get remote access to your PC and send them locally.
- olivercameron 15y agoThis is exactly why Bitcoin will never take off outside of the geek world. Can you imagine, in a world where millions used Bitcoin, the media fallout if users were being robbed with zero way to reclaim their money? Knowing how little "regular" people protect their devices, this scares me.
- truthout 15y agoBitcoin would function as a backend and the payment would be done through processors like banks and credit card companies. What's the difference between bitcoin and dollars in that respect. The average person still has the ability to move coins trough the system but I'm sure processors will be regulated.
- kmfrk 15y agoYou just described PayPal.
- olivercameron 15y agoNot at all. PayPal could not be more different than Bitcoin (centralised, insured etc.). Edit: I'm not defending PayPal, I'm saying Bitcoin and PayPal are two different systems.
- ltamake 15y agoDoesn't mean that PayPal is invincible. It's been hacked before, and being centralised and insured doesn't mean anything.
- olivercameron 15y agoI'm not saying its invincible at all, I'm saying comparing PayPal and Bitcoin isn't appropriate considering they're very different.
- ceejayoz 15y ago> ... being ... insured doesn't mean anything. Uh... it means there's minimal risk that users will lose their money if PayPal gets compromised. That's pretty significant.
- gasull 15y agoA possible solution: http://forum.bitcoin.org/index.php?topic=18141.0 http://forum.bitcoin.org/index.php?topic=18141.0 tl;dr: Create a bitcoin address, backup wallet.dat, delete wallet.dat from your HD, and send your bitcoins to that address.
- gojomo 15y agoWorks until the malware scans the disk for keydata remnants from 'deleted' files (or even old swap pages). And this guy was trying to implement this 'offline savings' strategy, but didn't completely understand the privacy lifecycle and transaction details — and thus last the keys to a $180K balance: http://forum.bitcoin.org/index.php?topic=11104.0;all http://forum.bitcoin.org/index.php?topic=11104.0;all Vanished in a poof of pure logic!
- gasull 15y ago> Works until the malware scans the disk for keydata remnants from 'deleted' files http://srm.sourceforge.net/ http://srm.sourceforge.net/ I don't use Windows but there's probably something similar for it.
- gojomo 15y agoEven 'srm' and similar tools might not work as expected on a solid-state drive with its own firmware and wear-leveling. It's possible to protect your bitcoin keys from an arbitrarily-later malware incursion... but very hard, in ways even most power-users don't consider. I like bitcoin. The current sharp edges and tragic mishaps are useful, for now, for learning about a new medium of exchange, which operates on a logic different from almost anything that we could easily analogize to. If bitcoin or a successor takes off, I suspect carrying large balances will require specially hardened devices – secure VMs inside handhelds, perhaps? And, a general desire for some recourse against instant irreversible fraudulent transfers might make the 'finalization' of certain transactions dependent on a remote secondary key approving (or failing to cancel) a payment, within a timeframe sufficient to deliver second-channel notification/confirmation.
- maeon3 15y agoI have an idea that may fix this broken model of Bitcoin. Make sure each penny has a "history" on it on a public server. You can't spend the money unless it is posted for everyone to see. Each transfer of money is documented, and the reason for the transfer and other data. And in order to spend it, you have to validate and review each transfer of money before it. If there is anyone stealing money, it is just a matter of looking at the history of each penny and then tracking down the unique id to the offender who spent the money they didn't earn. A safe online currency can be done, but if you champion this, the United States government are going to find you, and squish you like the insignificant bug you are. You would be circumventing the primary income stream of the united states with a global standardized currency.
- ghshephard 15y agoEvery bitcoin in existence has its history tracked back to it's origin on every single bitcoin node. There is an optimization for some clients to to pare down that history, but, in general, when you start up a bitcoin node, you have the history of every bitcoin ever created and all of it's transactions that occurred after it. This history, in fact, is how you can be confident that the bitcoin is authentic - unless you have greater than 50% of the computing power of the network, you can't substitute an alternative history which would result in the coin landing in your hands.
- vegai 15y agoThat seems like a highly non-scalable solution.
- weavejester 15y agoIt's not as bad as it seems. VISA only averages 2000 transactions per second, for instance, which isn't actually that much in terms of data.
- 27182818284 15y agoThe BTC clients should encrypt the wallet too.
- ck2 15y agoThis is why we can't have nice things.
- olalonde 15y agoUh? Aren't Bitcoin wallets encrypted?
- gasull 15y agoThey will be in the coming version.
- haberman 15y agoDon't worry, we've identified the thief! Put out an arrest warrant for: f7c956f566b11751c4d3f5ca077c0406 More seriously, it's interesting that the people who have been robbed from could observe in detail exactly where their stolen money is flowing to. So close, yet so far away.
- conductr 15y agoAny one else find the FTP password amusing?
- andrewcooke 15y agowhat's with the random number generation at the start? how does rand() + 3*rand() improve on just rand()?
- mootothemax 15y agoThere's a great series of answers to this on StackOverflow: http://stackoverflow.com/questions/3956478/understanding-randomness http://stackoverflow.com/questions/3956478/understanding-ran... In short: doing things like this actually reduces the randomness of the end result.
- BasDirks 15y agoProblem with bitcoin: it's an eternal beta. Can't be solved either.
- simias 15y agoMmh, the "underground code snippet" looks very fishy, unless I'm missing something: char * appdata = getenv("APPDATA"); char * truepath = strcat(appdata, "\\Bitcoin\\wallet.dat");