Probable Precautions using Electrum | Bitcointalksearch.org

RapTarX

hero member

Activity: 1358

Merit: 851

BUMP

crairezx20

legendary

Activity: 1638

Merit: 1046

Quote from: Stedsm on September 13, 2019, 11:28:54 AM

Quote from: crairezx20 on September 13, 2019, 07:42:46 AM

Why the Punycode attack is not listed or mention above?

This is one of the Electrum attacks before even you see the legit URL which is electrum.org we cant see if the site is fake or not but if you copy and paste the URL to notepad it will show the true URL.

I know you can disable Punycode in firefox but I don't know how for chrome.

For safety better use firefox instead and disable punnycode get more info from this post here https://bitcointalksearch.org/topic/host-file-to-deal-with-phishing-sites-5178198

Thanks for this, I never knew they could do this too. I guess Chrome doesn't have a security patch available yet after reading this article: https://superuser.com/questions/1421982/how-can-i-test-punycode-url-will-display-correctly-prior-to-purchase

So yeah, in those terms, I believe Firefox is good. What about other browsers? Are punycode attacks limited to these 2 browsers only? What about Tor browser? I didn't find anything related to this for Tor.

For now I didn't heard about Punycode in Tor browser. they mostly pointing it to two browser both chrome and firefox since more people use these two browser than the other browser I think other browsers too have this issue.

What do you think about the brave browser?

According to ethicalhacker almost all browser are vulnerable about puncycode "Chrome, Firefox, and Opera, though Internet Explorer, Microsoft Edge, Apple Safari, Brave, and Vivaldi."
But except to TOR browser, it means that tor browser is not affected by this issue.

Stedsm

legendary

Activity: 3052

Merit: 1273

Quote from: crairezx20 on September 13, 2019, 07:42:46 AM

Why the Punycode attack is not listed or mention above?

This is one of the Electrum attacks before even you see the legit URL which is electrum.org we cant see if the site is fake or not but if you copy and paste the URL to notepad it will show the true URL.

I know you can disable Punycode in firefox but I don't know how for chrome.

For safety better use firefox instead and disable punnycode get more info from this post here https://bitcointalksearch.org/topic/host-file-to-deal-with-phishing-sites-5178198

Thanks for this, I never knew they could do this too. I guess Chrome doesn't have a security patch available yet after reading this article: https://superuser.com/questions/1421982/how-can-i-test-punycode-url-will-display-correctly-prior-to-purchase

So yeah, in those terms, I believe Firefox is good. What about other browsers? Are punycode attacks limited to these 2 browsers only? What about Tor browser? I didn't find anything related to this for Tor.

crairezx20

legendary

Activity: 1638

Merit: 1046

Why the Punycode attack is not listed or mention above?

This is one of the Electrum attacks before even you see the legit URL which is electrum.org we cant see if the site is fake or not but if you copy and paste the URL to notepad it will show the true URL.

I know you can disable Punycode in firefox but I don't know how for chrome.

For safety better use firefox instead and disable punnycode get more info from this post here https://bitcointalksearch.org/topic/host-file-to-deal-with-phishing-sites-5178198

Lucius

legendary

Activity: 3234

Merit: 5637

Blackjack.fun-Free Raffle-Join&Win $50🎲

Baofeng, that fake 4.0.0 version is not new, it actually appeared almost at the beginning of that phishing attack. If we look at some old posts in Electrum board from late February, and maybe even from an earlier time, we could see that some members were complaining about downloading this version.

I guess the hacker was just changing number version and playing with potential victims.

Quote from: https://bitcointalksearch.org/topic/electrum-phishing-5114712

So I fell foul to the Electrum phishing scam (it had been awhile since i used it and I'm not on form atm,, don't say it Cry ) and downloaded and installed "version 4.0.0", and to no surprise within a jiffy lost about £100 in btc (all that was in the wallet) when trying to send it.

Baofeng

legendary

Activity: 2576

Merit: 1655

Quote from: Lucius on September 12, 2019, 04:16:40 AM

Quote from: RapTarX on September 11, 2019, 08:43:23 AM

I never face this situation. Until now, I thought Electrum doesn't push any pop-up for updating a wallet. How a user can identify if it's the fake link or the original wallet? What exactly will be the message from the official pop-up? How can we distinguish between both the fake one and the original one? Please share a little more information. Thank you.

.. snip ..

If you are interested in what a false message looks like it is displayed in theymos post 9+ months ago when he post warning about this Electrum vulnerability.

Electrum vulnerability allows arbitrary messages, phishing

Or this new updated warning, lol, Electrum 4.0? Hackers are very clever indeed:

Lucius

legendary

Activity: 3234

Merit: 5637

Blackjack.fun-Free Raffle-Join&Win $50🎲

Quote from: RapTarX on September 11, 2019, 08:43:23 AM

I never face this situation. Until now, I thought Electrum doesn't push any pop-up for updating a wallet. How a user can identify if it's the fake link or the original wallet? What exactly will be the message from the official pop-up? How can we distinguish between both the fake one and the original one? Please share a little more information. Thank you.

As I say you can only see this message if you use versions older then 3.3.4, so problem is solved long time ago. Some users who not update their wallets regularly are not aware that something like this exists, and some of them become victims even today.

The key thing is to never update Electrum in any way other than by downloading it from official site, and to verify files before installing. These are the two most important steps that will prevent any attempt of hackers to scamming someone to install fake wallet.

If you are interested in what a false message looks like it is displayed in theymos post 9+ months ago when he post warning about this Electrum vulnerability.

Electrum vulnerability allows arbitrary messages, phishing

BrewMaster

legendary

Activity: 2128

Merit: 1293

There is trouble abrewing

Quote from: RapTarX on September 11, 2019, 08:43:23 AM

Quote from: Lucius on September 11, 2019, 08:29:31 AM

If user is using old version of Electrum (all version older then 3.3.4), it can happen to him to see pop-up window with message to update Electrum, including link to fake wallet. But that doesn't mean the user's computer is infected, it is just message displayed through legal software, so there is no need to format the disk and install new OS.

I never face this situation. Until now, I thought Electrum doesn't push any pop-up for updating a wallet. How a user can identify if it's the fake link or the original wallet? What exactly will be the message from the official pop-up? How can we distinguish between both the fake one and the original one? Please share a little more information. Thank you.

older versions of Electrum had an exploit where the node (server) you connect to could send you a well formatted text (any text) when you tried sending a transaction to inform you of the result after receiving the transaction. result such as "successfully broadcast", "wrong signature", ...
and your wallet would just show that message to you.
the problem was that this text could be anything. so someone exploited it and sent messages containing his malicious website link and a text telling users to upgrade their wallet using THAT link.
it should be mentioned that if the users paid attention to the link or even if they verified the signature after downloading those malicious installers they would have never lost anything!

new versions don't have this problem anymore.

RapTarX

hero member

Activity: 1358

Merit: 851

Quote from: Lucius on September 11, 2019, 08:29:31 AM

If user is using old version of Electrum (all version older then 3.3.4), it can happen to him to see pop-up window with message to update Electrum, including link to fake wallet. But that doesn't mean the user's computer is infected, it is just message displayed through legal software, so there is no need to format the disk and install new OS.

I never face this situation. Until now, I thought Electrum doesn't push any pop-up for updating a wallet. How a user can identify if it's the fake link or the original wallet? What exactly will be the message from the official pop-up? How can we distinguish between both the fake one and the original one? Please share a little more information. Thank you.

Lucius

legendary

Activity: 3234

Merit: 5637

Blackjack.fun-Free Raffle-Join&Win $50🎲

Quote from: RapTarX on September 11, 2019, 05:24:56 AM

2. Don't Update if You Get a Pop-up
You may get a pop-up notification to update your electrum, if you get that pop-up, avoid that and try to have fresh windows because the hacker may have access to your wallet. And, if you click on update and update electrum, you will find yourself hacked. May look like the below image or may differ from it.

If user is using old version of Electrum (all version older then 3.3.4), it can happen to him to see pop-up window with message to update Electrum, including link to fake wallet. But that doesn't mean the user's computer is infected, it is just message displayed through legal software, so there is no need to format the disk and install new OS.

In case user is install fake wallet, the assumption is that the operating system is considered compromised, although it has not been established with certainty that there is any danger after user is remove fake wallet.

NeuroticFish

legendary

Activity: 3668

Merit: 6382

Looking for campaign manager? Contact icopress!

I think that a good precaution can also be to make a backup of the seed (if not done yet) and maybe the wallet file too before an upgrade, since the system (and the antiviruses too) may cause surprises.
If only the seed is backed up, writing somewhere a few addresses should help finding out what kind of wallet the user had (Legacy 1* , 3*, native bc1*) if a restore is necessary.

AB de Royse777

legendary

Activity: 2464

Merit: 3878

Hire Bitcointalk Camp. Manager @ r7promotions.com

Before installing the Electrum software one need to make sure that it's an original copy. Here is a tutorial that will help the users to learn the steps to verify the signature: https://bitcoinelectrum.com/how-to-verify-your-electrum-download/

This is very important step for Electrum users. This will help to avoid any risk in the future.

Public key of ThomasV

Code:

bob123

legendary

Activity: 1624

Merit: 2481

It might be worthy to expand the "Check URL Before Downloading" part by verification of the signature.
Just verifying the URL is not enough to be secured against all attack vectors.

For example:
DNS-/ARP spoofing.
If your computer is clean and secure, but your network is compromised your DNS request to electrum.org could be resolved to a different IP address.
This would result in visiting a fake-website by entering the original URL.
You would basically download malware from a fake electrum site without noticing it on the first sight.

Verifying the signature is the best way of making sure you are installing the legitimate software you intend to install. And this is a necessary step to be safe.

Additional similar attack vectors exist, which would all be prevented by simply verifying the signature of the file.

RapTarX

hero member

Activity: 1358

Merit: 851

Electrum is one of the best software for users who don't want to download the whole blockchain with hundreds of Gigabytes. You can run a bitcoin core wallet without storing the whole blockchain with prune mode, however, you are still required to download (synchronize or get up-to-date) from the beginning till now.
Running an Electrum wallet is as easy as one, two, three. But-
It includes a lot of threats, risks unless you are enough aware of all the possible threats. Here I will include some of the probable threats of using Electrum so that you don't have to be a victim of the hacker.

1. Check URL Before Downloading
Before you download the Electrum software, make sure you are downloading from the official website--> electrum.org, don't download from any other site. A list of known fake phishing electrum sites can be found here-

2. Don't Update if You Get a Pop-up, Applied for version 3.3.4 and lower
You may get a pop-up notification to update your electrum, if you get that pop-up, avoid that and try to have fresh windows because the hacker may have access to your wallet. And, if you click on update and update electrum, you will find yourself hacked. May look like the below image or may differ from it.

3. Check Sending Address Twice
This applies for both Electrum users or non-Electrum users, however, in case of Electrum, hackers ask you to update electrum, when you update and paste an address for transferring BTC, your paste address will automatically replaced by the hackers one, that's saying, check the address before sending.

Additional Recommendation- Important

Quote from: bob123 on September 11, 2019, 05:31:57 AM

It might be worthy to expand the "Check URL Before Downloading" part by verification of the signature.
Just verifying the URL is not enough to be secured against all attack vectors.

For example:
DNS-/ARP spoofing.
If your computer is clean and secure, but your network is compromised your DNS request to electrum.org could be resolved to a different IP address.
This would result in visiting a fake-website by entering the original URL.
You would basically download malware from a fake electrum site without noticing it on the first sight.

Verifying the signature is the best way of making sure you are installing the legitimate software you intend to install. And this is a necessary step to be safe.

Additional similar attack vectors exist, which would all be prevented by simply verifying the signature of the file.

Quote from: AB de Royse777 on September 11, 2019, 05:33:16 AM

Before installing the Electrum software one need to make sure that it's an original copy. Here is a tutorial that will help the users to learn the steps to verify the signature: https://bitcoinelectrum.com/how-to-verify-your-electrum-download/

This is very important step for Electrum users. This will help to avoid any risk in the future.
Public key of ThomasV

Quote from: NeuroticFish on September 11, 2019, 05:40:10 AM

I think that a good precaution can also be to make a backup of the seed (if not done yet) and maybe the wallet file too before an upgrade, since the system (and the antiviruses too) may cause surprises.
If only the seed is backed up, writing somewhere a few addresses should help finding out what kind of wallet the user had (Legacy 1* , 3*, native bc1*) if a restore is necessary.

Note: Don't blame Electrum like this, for your info, Electrum is an open source software.

If there are some more probable risks using Electrum, please share. I will update so that newbies don't get aware.

Topic: Probable Precautions using Electrum (Read 275 times)