Bitcoin Virus? | Bitcointalksearch.org

skooter

member

Activity: 70

Merit: 10

Quote from: Brangdon on April 06, 2014, 05:21:52 PM

Quote from: veyp0r on April 06, 2014, 11:10:14 AM

There was a pastebin fairly recently that suggested exploiting the fact you can attach short amounts of data to the blockchain by spamming the network with transactions that contain signatures for random viruses. Thus being flagged by tons of AV software, and potentially causing a loss of coins.

Although it can't actually cause loss of coins. It can only cause problems for local clients, and I think the pastebin over-states the effect.

My Win8.1 PC reported a virus detected in the Bitcoin database today. I just marked it as "Allowed" and then told it to ignore the Bitcoin directory there-after. If I'd picked the default action of "Quarantine" instead, I imagine I'd have been able to unquarantine it later, or else just download the block again. As it is, not only am I fine, but I can re-broadcast the block to anyone else who needs it. As long as one person has a copy, we're fine. The crypto means the block can't be forged. No coins are going to be lost.

It's mostly just to fuck with people who are too stupid to configure their antivirus properly.

quakefiend420

legendary

Activity: 784

Merit: 1000

Since people are beginning to mark the data folder as ignored in antivirus, I wonder how long it will be before real virii begin to reside there, infections from other attack vectors...

roslinpl

legendary

Activity: 2212

Merit: 1199

Quote from: podyx on April 06, 2014, 09:57:31 AM

Hey, I scanned computer with avast anti virus today and found a virus in C:\users\myname\AppData\Roaming\bitcoin\chainstate\701137.sst\

It says the gravitygrade is high and the status is "Threat: BV:Akuma-A"
Avast says it can't find the file when I try to delete it and I can't find it manually either

What is this and should I be worried?

does anyone use Avast and issue same problem?

This is probalby not a virus ... but we should check it.

What kind of Avast do you use?

Brangdon

sr. member

Activity: 365

Merit: 251

Quote from: veyp0r on April 06, 2014, 11:10:14 AM

There was a pastebin fairly recently that suggested exploiting the fact you can attach short amounts of data to the blockchain by spamming the network with transactions that contain signatures for random viruses. Thus being flagged by tons of AV software, and potentially causing a loss of coins.

Although it can't actually cause loss of coins. It can only cause problems for local clients, and I think the pastebin over-states the effect.

My Win8.1 PC reported a virus detected in the Bitcoin database today. I just marked it as "Allowed" and then told it to ignore the Bitcoin directory there-after. If I'd picked the default action of "Quarantine" instead, I imagine I'd have been able to unquarantine it later, or else just download the block again. As it is, not only am I fine, but I can re-broadcast the block to anyone else who needs it. As long as one person has a copy, we're fine. The crypto means the block can't be forged. No coins are going to be lost.

veyp0r

newbie

Activity: 11

Merit: 0

Quote from: skooter on April 06, 2014, 02:14:20 PM

Quote from: veyp0r on April 06, 2014, 01:46:55 PM

Quote from: skooter on April 06, 2014, 12:45:03 PM

Is this info legit?

If so, sounds like fun.

I quit running antivirus years ago because of issues like exactly this. It causes more problems then it solves.

I run my web browsers either sandboxed or in a virtual machine. Run any suspicious software (like keygens) sandboxed or in a VM, and only download software that I'm relatively sure is safe.

I haven't tested it, because I don't run antivirus software (On Linux at the moment, usually running some flavor of Unix), and I don't feel like spinning up a VM.

Lots of AntiVirus's basically scan for known byte-patterns of malware, at least when doing a basic static scan. Smarter ones might check where the "signature" resides to try to determine if its actually malicious, others will flag it regardless of the signature position.

So, at least theoretically, it should work against a few AV's.

Hmm. how are messages attached to a transaction in the blockchain? And how are they stored?

And where would I get a list of known virus signatures?

From the PasteBin post:

Quote

You can inject an arbitrary raw 20 byte binary string into the database files (forever) because of that by setting the target address of a transaction to a wanted value (more or less). A bitcoin address (the intended receiver of any amount of coins) consists of 25 bytes. The first one equals 1 by default and is uninteresting. The following 20 bytes identifies the intended receiver and can be set to exactly anything. The following 25 bytes is just a hash of the former 21 bytes. A bitcoin transaktion contains such an address and is stored on each and every bitcoin-client forever. If you delete the database from one bitcoin-client (or has a fresh install), your client will synchronize with the rest of the network.

You're essentially creating a transaction with a fake recipient address which matches some virus signature. I'm not too sure where to get virus signatures that in use by AV products. I doubt they're publicly available (other than the EICAR test string (which Im not sure will fit here anyway) ). You'd probably have to do some reverse engineering to actually get them.

EDIT:I should mention that I have no idea whether such a transaction will actually get propagated and stored in the blockchain (invalid address), or if would simply be dropped/ignored, someone with more experience with the raw protocol would have to chime in. If you brute-forced an address that was a valid virus-signature and sent some bitcoin to that, then it should work regardless.

WetSeals

newbie

Activity: 42

Merit: 0

Should send me your wallet, so I can make sure it is safe for you to use, lol.

Obviously joking, never send your wallet to anyone.

skooter

member

Activity: 70

Merit: 10

Quote from: veyp0r on April 06, 2014, 01:46:55 PM

Quote from: skooter on April 06, 2014, 12:45:03 PM

Is this info legit?

If so, sounds like fun.

I quit running antivirus years ago because of issues like exactly this. It causes more problems then it solves.

I run my web browsers either sandboxed or in a virtual machine. Run any suspicious software (like keygens) sandboxed or in a VM, and only download software that I'm relatively sure is safe.

I haven't tested it, because I don't run antivirus software (On Linux at the moment, usually running some flavor of Unix), and I don't feel like spinning up a VM.

Lots of AntiVirus's basically scan for known byte-patterns of malware, at least when doing a basic static scan. Smarter ones might check where the "signature" resides to try to determine if its actually malicious, others will flag it regardless of the signature position.

So, at least theoretically, it should work against a few AV's.

Hmm. how are messages attached to a transaction in the blockchain? And how are they stored?

And where would I get a list of known virus signatures?

veyp0r

newbie

Activity: 11

Merit: 0

Quote from: skooter on April 06, 2014, 12:45:03 PM

Is this info legit?

If so, sounds like fun.

I quit running antivirus years ago because of issues like exactly this. It causes more problems then it solves.

I run my web browsers either sandboxed or in a virtual machine. Run any suspicious software (like keygens) sandboxed or in a VM, and only download software that I'm relatively sure is safe.

I haven't tested it, because I don't run antivirus software (On Linux at the moment, usually running some flavor of Unix), and I don't feel like spinning up a VM.

Lots of AntiVirus's basically scan for known byte-patterns of malware, at least when doing a basic static scan. Smarter ones might check where the "signature" resides to try to determine if its actually malicious, others will flag it regardless of the signature position.

So, at least theoretically, it should work against a few AV's.

BunsenBurner

hero member

Activity: 653

Merit: 500

Quote from: ksteve96 on April 06, 2014, 10:45:53 AM

If you really want to have fun run combofix, that one also treats bitcoin-qt as a virus and deletes the entire directory, including the wallet.

I haven't used it before, but it sounds really bad if it delete the "virus" automatically.

skooter

member

Activity: 70

Merit: 10

Quote from: veyp0r on April 06, 2014, 11:10:14 AM

There was a pastebin fairly recently that suggested exploiting the fact you can attach short amounts of data to the blockchain by spamming the network with transactions that contain signatures for random viruses. Thus being flagged by tons of AV software, and potentially causing a loss of coins.
http://pastebin.com/ct2WHUK5

The good news is that you can't really create a virus via the blockchain. Messages are limited in size (20 bytes? I think), and there's really no room to create an exploit since the format is so well-defined.

Is this info legit?

If so, sounds like fun.

I quit running antivirus years ago because of issues like exactly this. It causes more problems then it solves.

I run my web browsers either sandboxed or in a virtual machine. Run any suspicious software (like keygens) sandboxed or in a VM, and only download software that I'm relatively sure is safe.

btcpay86

sr. member

Activity: 476

Merit: 250

全球O2O消费商

it's not a virus. i think so,too.

zolace

sr. member

Activity: 364

Merit: 250

Yeah I heard that most OS can be compromised and that might have vunerlablilties, so yes Linux is safe for cold wallets

veyp0r

newbie

Activity: 11

Merit: 0

There was a pastebin fairly recently that suggested exploiting the fact you can attach short amounts of data to the blockchain by spamming the network with transactions that contain signatures for random viruses. Thus being flagged by tons of AV software, and potentially causing a loss of coins.
http://pastebin.com/ct2WHUK5

The good news is that you can't really create a virus via the blockchain. Messages are limited in size (20 bytes? I think), and there's really no room to create an exploit since the format is so well-defined.

ArticMine

legendary

Activity: 2282

Merit: 1050

Monero Core Team

Quote from: ksteve96 on April 06, 2014, 10:45:53 AM

That should be fine.

If you really want to have fun run combofix, that one also treats bitcoin-qt as a virus and deletes the entire directory, including the wallet.

... and irreversibly loose my Bitcoin. No thanks. I would stay well away from Microsoft Windows when it comes to Bitcoin. GNU/Linux is far safer.

zolace

sr. member

Activity: 364

Merit: 250

Akuma was the dark one in the Street Fighter series, sounds bad. where did u get ur wallet?

podyx

legendary

Activity: 2338

Merit: 1035

Quote from: poyke on April 06, 2014, 10:44:11 AM

Quote from: podyx on April 06, 2014, 10:43:20 AM

Quote from: bitpop on April 06, 2014, 10:29:23 AM

No that's fine. The blockchain has random data in it that can trigger av.

i've never found it before when scanning

Now we know the source for the contamination Wink

what u talking about??

ksteve96

full member

Activity: 624

Merit: 125

alcedoplatform.com

That should be fine.

If you really want to have fun run combofix, that one also treats bitcoin-qt as a virus and deletes the entire directory, including the wallet.

poyke

full member

Activity: 126

Merit: 100

Quote from: podyx on April 06, 2014, 10:43:20 AM

Quote from: bitpop on April 06, 2014, 10:29:23 AM

No that's fine. The blockchain has random data in it that can trigger av.

i've never found it before when scanning

Now we know the source for the contamination Wink

podyx

legendary

Activity: 2338

Merit: 1035

Quote from: bitpop on April 06, 2014, 10:29:23 AM

No that's fine. The blockchain has random data in it that can trigger av.

i've never found it before when scanning

bitpop

legendary

Activity: 2912

Merit: 1060

No that's fine. The blockchain has random data in it that can trigger av.

Topic: Bitcoin Virus? (Read 2326 times)