3 ms·

Plot twist, that guy is actually Satoshi, and pretending to look for himself is to deflect suspicion.

by b112 3y ago

wslh 3y ago
Great twist, as someone who knows Sergio since elementary school he was always perfectly capable of being him but from my knowledge of other details I don't think so. Just an opinion. BTW2: adding a little bit of serendipity to this Sunday I came up with this repository [1] which seems very dangerous and fishy. It says that "34 000 Satoshi Nakamoto wallets with pubkeys (50 BTC each other)" but the download points to a .zip with an .exe. In GitHub you can denounce people but do you suggest to investigate the .exe before right? Seems like a good, and probably simple, reversing play. On the context of Satoshi's public keys, you cannot (like some other blockchains) get his/her/their public keys from the address. [1] [potential malware]
- nullc 3y ago
  99.99% chance you're linking to malware, it might be polite to break the url.
  - wslh 3y ago
    Yes, I removed it but I assume someone could check that collaborative here since I put the warning/warning/warning beforehand. It would be great if you add to your comment the best way to act in this case? I could research the potential malware but I assume that GitHub has some tooling/resources to quickly research it? It is like the automatic scanning in Gmail. If it is an obvious malware it could be detected with existing tools. You can also run it in a very isolated VM and/or computer and see what happens behind the scene in a black box manner. BTW3: I played with our AI friends to do an image of this conversation [1]. [1] https://nitter.net/coinfabrik/status/1743992974067867868#m https://nitter.net/coinfabrik/status/1743992974067867868#m
    - nullc 3y ago
      A lot of cryptostealer malware is bespoke and won't get caught by scanners, but you could start by dropping it into virustotal. Particularly anything that looks like wallet crackers is frequently full of malware-- as I assume people feel less worry of arrest and less moral concern with robbing other (wanna-be) thieves. From my experience on bitcointalk ... It's often hard to prove it's malware, as a popular technique is to make the software phone home for some quasi legitimate looking purpose and then have an RCE vulnerability in the phone home interface. It may even be the same guy that keeps making new trojans that work this way over and over again.
      - wslh 3y ago
        Virustotal doesn't give any alert [1]. Good opportunity to analyze it by myself. Wait! It is not clear that Virustotal analyzes ZIPs [2]. When I upload the EXE within, it gives different results but no virus alert [3]. The weird thing is that [1] result in "clean" status over the antiviruses tested while [3] results on "Undetected". [1] https://www.virustotal.com/gui/url/3815d095d5031535475478b04bf102a41580cbf91825e77c67cab1f9f0990a41 https://www.virustotal.com/gui/url/3815d095d5031535475478b04... [2] https://superuser.com/questions/1651122/why-isnt-virustotal-detecting-a-zip-file-that-contains-malware https://superuser.com/questions/1651122/why-isnt-virustotal-... [3] https://www.virustotal.com/gui/file/93fe6b75fada79b5fa6d0affa0eb7d9a873bcec691b6236c948533097903e63d https://www.virustotal.com/gui/file/93fe6b75fada79b5fa6d0aff...

Plot twist, that guy is actually Satoshi, and pretending to look for himself is to deflect suspicion.

by b112 3y ago

Plot twist, that guy is actually Satoshi, and pretending to look for himself is to deflect suspicion.

wslh 3y ago

Great twist, as someone who knows Sergio since elementary school he was always perfectly capable of being him but from my knowledge of other details I don't think so. Just an opinion. BTW2: adding a little bit of serendipity to this Sunday I came up with this repository [1] which seems very dangerous and fishy. It says that "34 000 Satoshi Nakamoto wallets with pubkeys (50 BTC each other)" but the download points to a .zip with an .exe. In GitHub you can denounce people but do you suggest to investigate the .exe before right? Seems like a good, and probably simple, reversing play. On the context of Satoshi's public keys, you cannot (like some other blockchains) get his/her/their public keys from the address. [1] [potential malware]

nullc 3y ago
99.99% chance you're linking to malware, it might be polite to break the url.
- wslh 3y ago
  Yes, I removed it but I assume someone could check that collaborative here since I put the warning/warning/warning beforehand. It would be great if you add to your comment the best way to act in this case? I could research the potential malware but I assume that GitHub has some tooling/resources to quickly research it? It is like the automatic scanning in Gmail. If it is an obvious malware it could be detected with existing tools. You can also run it in a very isolated VM and/or computer and see what happens behind the scene in a black box manner. BTW3: I played with our AI friends to do an image of this conversation [1]. [1] https://nitter.net/coinfabrik/status/1743992974067867868#m https://nitter.net/coinfabrik/status/1743992974067867868#m
  - nullc 3y ago
    A lot of cryptostealer malware is bespoke and won't get caught by scanners, but you could start by dropping it into virustotal. Particularly anything that looks like wallet crackers is frequently full of malware-- as I assume people feel less worry of arrest and less moral concern with robbing other (wanna-be) thieves. From my experience on bitcointalk ... It's often hard to prove it's malware, as a popular technique is to make the software phone home for some quasi legitimate looking purpose and then have an RCE vulnerability in the phone home interface. It may even be the same guy that keeps making new trojans that work this way over and over again.
    - wslh 3y ago
      Virustotal doesn't give any alert [1]. Good opportunity to analyze it by myself. Wait! It is not clear that Virustotal analyzes ZIPs [2]. When I upload the EXE within, it gives different results but no virus alert [3]. The weird thing is that [1] result in "clean" status over the antiviruses tested while [3] results on "Undetected". [1] https://www.virustotal.com/gui/url/3815d095d5031535475478b04bf102a41580cbf91825e77c67cab1f9f0990a41 https://www.virustotal.com/gui/url/3815d095d5031535475478b04... [2] https://superuser.com/questions/1651122/why-isnt-virustotal-detecting-a-zip-file-that-contains-malware https://superuser.com/questions/1651122/why-isnt-virustotal-... [3] https://www.virustotal.com/gui/file/93fe6b75fada79b5fa6d0affa0eb7d9a873bcec691b6236c948533097903e63d https://www.virustotal.com/gui/file/93fe6b75fada79b5fa6d0aff...