9 ms·
MS Security Essentials reporting false positives in the Bitcoin blockchain
- nwh 12y agoSo a joker decided to embed some Anti Virus bait in the blockchain, just a few bytes is enough to make the software go nuts deleting a whole lot of files the Bitcoin client needs. The solution the Bitcoin developers suggest is pure old-school malware style, XOR the blocks to hide it from the Anti Virus suites. Classic. https://github.com/bitcoin/bitcoin/issues/4069 https://github.com/bitcoin/bitcoin/issues/4069
- voltagex_ 12y agoFrom a comment on that issue: >Just for fun, there's about 8000 reachable nodes on the network at the time of writing. Assuming that a large portion of the network is unreachable (NAT, filtering, intermittent, just not listening), it's probably safe to assume there's probably at least 50,000 nodes with the complete blockchain. If we XOR just the chainstate, we cause 50000 * 430 MB of disk writes, 50000 * 430 * 2 MB read and write combined, somewhere in the region of 43TB. If we XOR the entire blockchain on disk we cause 50000 * 21000 * 2 MB of IO, around 1.95PB of RW across the wider Bitcoin network. Incredible.
- sliverstorm 12y agoJust 8000 bitcoin nodes? So much for the People's Distributed Currency.
- pmorici 12y agoThose are probably 'full nodes' to participate in the network as a miner or casual user you don't need to run a full node.
- sliverstorm 12y agoYeah, but if there are just 8,000 nodes, suddenly it seems like it wouldn't be all that hard to hijack the network. It's possible I misunderstand, and overestimate the value of full nodes.
- VMG 12y agoYou're basically right though, there are regular calls on /r/bitcoin for people to run a full node because the number has gone down recently. I decided set one up on my dedicated host due to one of these.
- lifeisstillgood 12y agoInteresting - I have been meaning to look into how the blockchain works (I missed the get-rich-quick rush and dismissed it all until heard Andreessen explain the reasons) Anyway - what does being a full node entail?
- jnbiche 12y agoSimply run bitcoin-qt or bitcoind all the time and make sure that you have port 8333 open to the outside world (if you have a router, this usually means forwarding 8333). It takes a few hours to a half day for the node to catch up, depending on your bandwidth and CPU, but after that it requires relatively little processing time. But you do need ~20 GB of free hard drive space for the blockchain.
- thelamest 12y agoNon-mining nodes just hold and relay validated blocks, they don't do anything that can be hijacked.
- servowire 12y agoFull nodes host the memory pool for the txid's - So they serve a purpose: Making transactions propagate over the network. And serve blocks to nodes that are not up-to-date (And clients).
- deleted 12y ago[deleted]
- deleted 12y ago[deleted]
- nwh 12y ago8000 nodes listening on IPv4. There's probably hundreds of thousands of non listening ones. Not every node is listening, not every wallet is a node. You can still be trustless even without a copy of the blockchain at hand.
- windsurfer 12y agoIsn't this just an arms race, though? What's to stop people from doing this again?
- nullc 12y agoEvery host would have a unique mask.
- cjg 12y agoIn one of the comments in that article: "I can't wait until someone legally changes their name to one of these sequences and we find out that all sorts of government databases didn't have functioning backups..."
- cnvogel 12y agoI think you could put the "EICAR Test String" easily in a lot of databases, maybe as the answer to a security question, a special "delivery instruction"... http://www.eicar.org/86-0-Intended-use.html http://www.eicar.org/86-0-Intended-use.html It's detected by almost any antivirus product, on my work computer the corporate antivirus immediately quarantines a file with this content. X 5 O ! P % @ A P [ 4 \ P Z X 5 (...)
- maaarghk 12y agoNot EICAR because that has to be at the start of the file. But some other signature, sure.
- mahdavi 12y agoit won't solve the problem, the joker can simply inject a string that becomes a virus signature after XOR.
- mschuster91 12y agoIf every client uses his own keystream, then not.
- deleted 12y ago[deleted]
- drzaiusapelord 12y agoThis is an old trick. A little while ago someone was putting the EICAR test string in email subject lines, headers, inside PDF files, in mime headers, and in other random places. He managed to crash a lot of enterprise level AV solutions and email servers. If you want to be a dick, just copy and paste that string everywhere you can. The AV will treat it like a real threat.
- userbinator 12y agoThat somewhat reminds me of this: http://en.wikipedia.org/wiki/BLIT_(short_story) http://en.wikipedia.org/wiki/BLIT_(short_story)
- afreak 12y agoThe simple solution is to not allow your anti-virus software to scan anything that cannot malware. There are exceptions to the rule of course such as MP3s that had executable code, but why does it need to scan every single file on your system? Full disclosure: I used to work for an AV software company and personally think that AV is a dead technology.
- DerpDerpDerp 12y agoCould you elaborate on why you think it's a dead technology?
- afreak 12y agoThere are many articles describing why but really it comes down to this: malware authors can pump out so many copies of their software at once that signature-based detections in which the AV industry relies on are no longer reliable or effective. We're at a point now where what may have worked as a defence against stuff being found on floppy drives just isn't able to scale for today's modern infrastructure. AV is really a last-line of defence against being forgetful, and nothing more.
- wmt 12y agoI'm not sure what should I not forget when I visit a hacked web forum which sends me to an exploit kit, that knows an unpatched, possible zero day, vulnerability from my browser? You're oversimplifying modern AV by acting like it's just a signature based file scanner. That's just a one defence of many in a good AV product.
- afreak 12y agoYou're mixing apples and oranges here. What the problem described in the story is that files are being picked up by an overzealous AV scanner doing disk-based scanning. It's reading non-executable data as executable and throwing alerts or performing whatever actions are dictated as per policy. AV is not there to stop zero-day attacks--if it were, I would not be having this conversation today. What you're describing is web filtering and this can be achieved using methods either internal or external--an external example would be a solution from OpenDNS and an internal can be whatever appliance makes you happy. AV vendors have thrown in web filtering as a part of their suite, but it still relies on your system being up to date and not already infected. An external solution to your endpoint is a far better solution really. I am not oversimplifying things when I say that AV is ineffective at stopping CryptoLocker because file-based detections are useless when there are thousands of copies of the malware generated every day. AV is dead because there is not enough manpower and coverage to stop things like CryptoLocker. It is better to spend those resources trying to prevent the spread of malware using other methods.
- deleted 12y ago[deleted]
- afreak 12y agoThe malicious code would have exploit software that handles the block chain. In addition, the size of the transaction affects your transaction fee, so you'd have to take that into account. Effectively, it's not good business if you're looking to do something like that unless you know you'll get a good payout.
- kijin 12y agoMSE was top-notch when it was first released. It aced all the malware detection benchmarks, not to mention it was completely ad-free and extremely lightweight, which was unheard of in the free antivirus market. The high detection rate and low performance impact made lots of Windows users flock to MSE, myself included. Nowadays, MSE is still lightweight, but it sits at the bottom of every malware detection benchmark. I've been recommending MSE to everyone around me, but recently they started getting all sorts of malware despite keeping MSE up to date. All of these were easily detected and removed by avast!, BitDefender, and Malwarebytes, but MSE just sat there like a cow, oblivious to the malware's presence. Why has Microsoft let MSE rot like this? Now that MSE is built into Windows 8, are they afraid of getting slapped with antitrust fines if they shipped an antivirus that can actually compete with third-party offerings? This year, I'm moving my family off of MSE. So long, it was good while it lasted. But third-party antiviruses have caught up in the meantime, and now they're just as lightweight as MSE.
- nivla 12y agoNah I will stick with MSE because the alternative for me is not to use an antivirus. If you ever want to know how to bring a 8-core i7 to its knees, install Norton. MSE is the only antivirus that is lightweight, stays out of your way and the least annoying of everything out there and not to mention its free with no ads. Sure, it doesn't have an heuristic scanning but it did once do a good job of detecting a malware that both Avast and Norton missed, which is good enough trust for me. The best feature is that it doesn't have a girl screaming "Avast, Your database have been updated." or "Your license is about to expire in 90days unless you pay $$$" every 4 hours. Don't download anything sketchy, keep an updated version of your browser, don't run yourself as root and your should be fine for 99.9% infections out there. For the rest just keep MSE around.
- ghshephard 12y agoYou forgot the top two other pieces of advice - Make sure you have a decent adaptive firewall, and run anything even slightly worrisome in a virtual machine, never on your main operating system.
- bobbles 12y agoI seem to remember just having some text copy+pasted into IRC channels used to send peoples anti virus software into meltdown.. but this was sometime like 2000-2001
- duskwuff 12y agoFor a while, some security suites would freak out and terminate an IRC connection if they saw the text "start keylogger" show up. You could get people to drop by saying it in a channel, for instance.
- ygra 12y agoOr, more sneakily, by embedding it in your hostmask.
- TazeTSchnitzel 12y agohttp://bash.org/?13213 http://bash.org/?13213 Like this?
- duskwuff 12y agoWorse, actually. As I recall, it'd block access to the responsible IRC server until you rebooted the machine. But yes, kind of like that.
- deleted 12y ago[deleted]
- simcop2387 12y agoDCC SEND LOLLERCOPTER There were a few others, but that's the one i remember. the part after DCC SEND doesn't matter as long as it was longer than 8 characters i think it was.
- frik 12y agoIt was a bug in Linksys, Netgear routers that rebooted the device. bug report e.g. http://colloquy.info/project/ticket/531 http://colloquy.info/project/ticket/531
- nivla 12y agoOR they could have just used the string from EICAR test file [1]. Since I don't use bitcoin, let me ask, does everyone have to download the whole blockchain to their computer in order to mine or receive/sent the coins? Wouldn't the blockchain be in XX GB size by now? [1] http://en.wikipedia.org/wiki/EICAR_test_file http://en.wikipedia.org/wiki/EICAR_test_file
- bowmessage 12y agoYes, they do. And yes its quite large! Over 10 GB.
- Jach 12y agoNo they don't. Mining software that connects to pools is independent of having a blockchain copy. There are also several bitcoin wallet implementations that don't require a full copy of the blockchain.
- maaku 12y agoStrictly speaking, that is hashing software. Mining software is what runs on the pool, and it absolutely must download and verify the blockchain.
- deleted 12y ago[deleted]
- andrewmunsell 12y agoIf you use a client such as Electrum, it uses a server based model to index the Blockchain. The advantage of this is primarily "instant" start up time of the client. https://electrum.org/ https://electrum.org/
- ars 12y agoOver 20GB actually, and growing by about 2GB per month.
- 12y ago
- etiam 12y agoWe actually received advance warning of this some time ago: https://news.ycombinator.com/item?id=7542920 https://news.ycombinator.com/item?id=7542920 After some consideration and the feedback here https://news.ycombinator.com/item?id=7543196 https://news.ycombinator.com/item?id=7543196 I decided to inform one major antivirus vendor about it. They offered their thanks for the warning, but also the opinion that false alerts would be strongly limited since the virus signatures are in files that would generally not be scanned. The scope of this remains to be seen, but apparently at least Microsoft Security Essentials doesn't handle this entirely without problems.
- izietto 12y agoThe part I prefer: > It appears to be a joke or prank, simply because this particular virus does nothing more than periodically show "YOUR COMPUTER HAS BEEN STONED" on one out of every eight computer boot-ups, and is over 25 years old. When viruses were mainly jokes...
- jamedjo 12y agoThe Xkcd would go "We thought we sanitised our input but we still lost this years student records. Did you really name your son Little Bobby Drop [DOS/STONED]{16 byte malware Signature}?"
- userbinator 12y agoI think this is another great example of how modern AV software can be used as a tool of mass censorship. They can simply add signatures for any file contents they disagree with (or some other organisation with the appropriate power requests to do so), and it will disappear from their user's computers under the pretense of being malicious. Users will trust them in order to "stay safe". That's why I believe in behavioural monitoring rather than signature-based approaches, since what's malicious is really the activity itself.