Avast quarantined Bitcoin-QT.exe 0.13.0 binary

PremiumCodeX

hero member

Activity: 1204

Merit: 531

Metaverse 👾 Cyberweapons

For me that detection seems to be false positive. I too have experienced similar some months ago and I handled it as false positive. I did not experience any suspicious activity within my system that could be connected to that so I think I was right. I, however, disagree with the advice that you should not use Windows. Windows could be very secure if you know what you are doing and Linux could be easily vulnerable too if you do not. As a general advice I suggest separating the system that you daily use from the one where you store your wallet and choose a system for your wallet that you are comfortable with and aware of how to build a powerful security with it.

Cereberus

legendary

Activity: 910

Merit: 1000

I downloaded it in my second partition where I have windows just to try and Avira says nothing about it so I think is safe and your antivirus warning is just a false positive. Its not recommended keeping sensitive data , like storing your bitcoins in a windows system. I have all the desktop wallets installed in Linux Mint latest. Bitcoin core, Electrum and Multibit HD.

mertliti

newbie

Activity: 25

Merit: 0

Quote from: Shiroslullaby on August 24, 2016, 10:08:07 PM

For someone that is concerned with verifying file checksums, state sponsored attacks, etc...
I'm surprised you are using Avast! Good antivirus, but I had to remove it when they started snooping on users encrypted traffic.
(MITM traffic interception using pre-installed certificates)

Heres a good write-up for anyone interested:
http://www.thesafemac.com/avasts-man-in-the-middle/

OT maybe, but interesting nonetheless!
I just verified my Google SSL certificates in Chrome are signed by GeoTrust Global (not Avast), and BofA by VeriSign.
And Avast is blocking https://revoked.grc.com/ (revoked certificate test mentioned in that article).

On Firefox, it is blocking the revoked certificate, but it *is* using its own certificate on google.com! Just disabled HTTPS scanning. Bad Avast!

Thanks

Shiroslullaby

sr. member

Activity: 434

Merit: 250

For someone that is concerned with verifying file checksums, state sponsored attacks, etc...
I'm surprised you are using Avast! Good antivirus, but I had to remove it when they started snooping on users encrypted traffic.
(MITM traffic interception using pre-installed certificates)

Heres a good write-up for anyone interested:
http://www.thesafemac.com/avasts-man-in-the-middle/

mertliti

newbie

Activity: 25

Merit: 0

Hey thanks!
No, it wasn't whitespace but it was email obfuscation formatting that was done on that first page!

<[email protected]> BECAME

Well, it seems like a bad link for the security notice to be asking people to verify, because it's NOT going to verify!
Hope someone can share this with the devs still. They should provide better, working instructions for verification if people are going to be able to fend off potential attacks.

With the "raw" URL you sent, the verification is now working:

Code:

*** PGP SIGNATURE VERIFICATION ***
*** Status:   Good Signature
*** Signer:   Wladimir J. van der Laan  (0x2346C9A6)
*** Signed:   6/24/2015 1:45:06 PM
*** Verified: 8/25/2016 4:56:28 AM
*** BEGIN PGP VERIFIED MESSAGE ***

Hello,

Starting with 0.11.0rc3, SHA256SUMS.asc will be signed with the following key:

    pub   4096R/36C2E964 2015-06-24 Wladimir J. van der Laan (Bitcoin Core binary release signing key) 
    Primary key fingerprint: 01EA 5486 DE18 A882 D4C2  6845 90C8 019E 36C2 E964

For gitian and commit signing I will keep using this key.

Wladimir

*** END PGP VERIFIED MESSAGE ***

phantomcircuit

sr. member

Activity: 463

Merit: 252

Quote from: mertliti on August 24, 2016, 08:29:09 PM

I just upgraded to Bitcoin-QT 0.13.0 on Windows 7 64 bit.
Before anyone asks, yes I verified the download signature against the SHA256SUMS.asc file, whose signature correctly matched that of Wladimir J. van der Laan's PGP key (that I downloaded long ago, before the recent threat announcement).

When I tried to run it for the first time, Avast did a deep scan and quarantined the binary.
Is anyone else having this issue or found a solution?
Could a file that passed signature verification still have an infection?!

You're running into an issue with whitespace and HTML.

Try again http://pastebin.com/raw/PWcYtqi3

mertliti

newbie

Activity: 25

Merit: 0

Could you perhaps do me a favor and share this thread's URL on the mailing list to the devs?
I'm not on the list, but would appreciate getting advice from the devs, as I'm trying to follow the instructions on their notice posted here (https://bitcoin.org/en/alert/2016-08-17-binary-safety), and it says to verify the message at that link above (
https://lists.linuxfoundation.org/pipermail/bitcoin-dev/2015-June/009045.html).

Thanks!

achow101

staff

Activity: 3458

Merit: 6793

Just writing some code

Interesting that that happens. When I pull up the email from Thunderbird, enigmail says that it is a good signature.

It might just be a formatting problem caused by the mailing list archive.

mertliti

newbie

Activity: 25

Merit: 0

Thanks. I'm getting concerned though...
On this page, there is a message posted and signed by Wladimir:

https://lists.linuxfoundation.org/pipermail/bitcoin-dev/2015-June/009045.html

Code:

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Hello,

Starting with 0.11.0rc3, SHA256SUMS.asc will be signed with the following key:

    pub   4096R/36C2E964 2015-06-24 Wladimir J. van der Laan (Bitcoin Core binary release signing key) 
    Primary key fingerprint: 01EA 5486 DE18 A882 D4C2  6845 90C8 019E 36C2 E964

For gitian and commit signing I will keep using this key.

Wladimir
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQEcBAEBCgAGBQJViphCAAoJEHSBCwEjRsmmtRoIALBzJMGXzoj5t9OQSedxjnjP
sxfHuBwQxeuPYXbRlMjY5UZhmabbt0/mLRfVSdscnCzp0YxbMRwD7I6MdHqXyBtd
oS+TUfMNir5lk7Ti2hRStgvxqsAbHUJ08LlqpJXV5dq3QgeJyJwZM76a6yyaGwxP
SwqvKklQZ/qdrKOgjjn6d5HywgsmybJSDzEDR3k+ogkLsfM1jcpqZhwFeRVpk94m
SgZGLLx5zAIKcLHn4I1FaZ+OAmmS0ukYcmotMOUk6NBEjHTDfjEFBrbrlwvL4G7r
kjd1mRxkaJMxX3nJicXiEQClVoeUrMVyJrrsTGyPixSicdQbItuyLWXm37fAfE0=
=4v49
-----END PGP SIGNATURE-----

For some reason, when I try to verify this message with PGP (Symantec Encryption Desktop 10.3.0), using the same key, I signed **years** ago in my PGP keyring, and that still shows as verified, I am getting a mismatch:

Code:

*** PGP SIGNATURE VERIFICATION ***
*** Status:   Bad Signature
*** Alert:    Signature did not verify. Message has been altered.
*** Signer:   Wladimir J. van der Laan  (0x2346C9A6)
*** Signed:   6/24/2015 1:45:06 PM
*** Verified: 8/25/2016 4:03:21 AM
*** BEGIN PGP VERIFIED MESSAGE ***

Hello,

Starting with 0.11.0rc3, SHA256SUMS.asc will be signed with the following key:

    pub   4096R/36C2E964 2015-06-24 Wladimir J. van der Laan (Bitcoin Core binary release signing key) 
    Primary key fingerprint: 01EA 5486 DE18 A882 D4C2  6845 90C8 019E 36C2 E964

For gitian and commit signing I will keep using this key.

Wladimir

*** END PGP VERIFIED MESSAGE ***

The key signature matches! Is there some possible incompatibility between PGP and GPG? Some whitespace / line endings mismatch?
Given, that "state-sponsored" attackers are suspected to be a risk, I'm starting to get paranoid now!!! This is the first time I think I've ever seen verifications fail.

Can anyone else verify the signature on that message with Wladimir's key?

achow101

staff

Activity: 3458

Merit: 6793

Just writing some code

This is actually not uncommon. It happens to quite a few people. The antivirus warning is usually a false positive. Of course, you should double check and re-verify the download just to be sure. If the download verifies, then it is extremely unlikely that there is a virus as multiple things (your gpg install, your connection to bitcoin.org, and your checksum utility) would have to be compromised.

mertliti

newbie

Activity: 25

Merit: 0

I just upgraded to Bitcoin-QT 0.13.0 on Windows 7 64 bit.
Before anyone asks, yes I verified the download signature against the SHA256SUMS.asc file, whose signature correctly matched that of Wladimir J. van der Laan's PGP key (that I downloaded long ago, before the recent threat announcement).

When I tried to run it for the first time, Avast did a deep scan and quarantined the binary.
Is anyone else having this issue or found a solution?
Could a file that passed signature verification still have an infection?!

Topic: Avast quarantined Bitcoin-QT.exe 0.13.0 binary (Read 1708 times)