Topic: Warning: electrum-ltc source downloads (from electrum-ltc.org) were tampered (Read 560 times)

what are the checksums ?
and is it just electrum litecoin or regular electrum as well?

What about electron cash ?

so many questions

Simply look up the checksums and check if they are matching your downloaded version. If they don't match you probably got infected...

I downloaded the Windows version at 17:28 UTC yesterday.  How can I find out if I have been infected?

I don't know which of the mentioned days you meant. I don't know if the deployed script was changed (it is not available anymore) but the version I've seen did care for ~/.electrum but not for Viaelectrum

Seems like you don't need to be worried anymore. They have posted a statement https://electrum-ltc.org/ that states the attack happened not before the 31st of July though.

And at best those come from a source not that easy to manipulate

Many thanks again for you help and providing the info!
And yes, I should definitely insist on signed checksum in the future.

Good for you , for your other machines, best of luck to you that they are not affected.

In fact, my LiteCoins stored in that wallet are already gone! 
 
But that's due to the fact that I changed my few Litecoins into BTC.
For some reasons, my primary wallet Jaxx refused to send them out. So I installed Electrum-Ltc on that day. 
The only worry I have now that both BTC-Electrum and Vialectrum on my Fedora-machine could be compromised.

Annoyingly enough, I do not have physical access to that workstation until next week. So I have to wait and see...

Well, from what I've read it is worse. This is effectively able to execute arbitrary code downloaded from that ip in the code snippet from the chat log he posted. But in short: yes, but worse.

But he already wrote how to check if you're infected, just search in the electrum file for "subprocess", this should not be there from what I can see from the official source code, so any occurance would indicate an infection.

Btw. I would guess that it is unlikely that you've got an infected version, as probably your coins would be already gone , but better check twice though.


Edit: and a suggestion to all of you: You should know that checking against checksums, like this is now stated on their site is no protection! They can be manipulated as well, what you should expect are gpg signed checksums instead from a trusted source. If someone takes over their site, which seems to just happened, those hashes and provided ascs and even the information of the signer fo their archives wont save you either, as the hackers just manipulate those too! Yes I know there is an additional signing, but I bet no one of you could make a difference out of it as you probably don't know who should have signed it and all the contents could be manipulated. But hey, you're downloading third party software outside of a controlled environment like your package manager don't you? So expect this to happen...

Many thanks for the info!

That's a serious issue which should not get overlooked.
I just realized I donloaded Unix Electrum-Ltc on July 22nd.
Version 2.8.3.5 was supposedly released one day later. Is there any definite information to narrow down the exact timeframe of that infection?

You just wrote
Would that mean my sensitive data from other clients, such as Bitcoin Electrum or Jaxx wallet could be endangered?

Thank you! I downloaded my Electrum Cash client (for windows) yesterday, i will check if i can trust it or if i need to download it again.

I know this account is new and the following will therefore may seem a bit like a smear campaign against the electrum-ltc dev. I can guarantee that the following statements are true and everything happened as described.

On July 30 I tried to install electrum-ltc but stopped in the process because the checksums were missing (404 Not Found).

On July 31 I tried again. This time the checksums (available in Electrum-LTC-2.8.3.5.tar.gz.DIGESTS.txt) were available. The checksums didn't match the downloaded archive!

Due to this mismatch I compared the download to the version available @ github.com.
My Result: Electrum-LTC-2.8.3.5.tar.gz (available at https://electrum-ltc.org/download/Electrum-LTC-2.8.3.5.tar.gz) was modified to download a shell script. This shell script proceeds to collect various files (wallet data for various wallets and ssh-keys) and sends them to a server. Additionally it installs a cronjob and a backdoor (based on socat).

As far as I know this issue only affects Unix/Mac users but I can't guarantee that there aren't payloads for other operating systems.

I've informed pooler (the electrum-ltc dev) at the irc and he confirmed that the files were tampered. Currently the downloads are restored to a clean state. Sadly it seems like the developer didn't see any reason to inform his users about the issue. It looks like there is now a new hint reading "Always verify the digital signatures of the files you download!" (it wasn't there before: Proof)

Affected (Linux/Mac) users should be able to identify the infected electrum file by searching for 'import subprocess' or identify infected systems by checking their cronjobs.

Please don't ignore this post because my account is newly created. Members of #electrum-ltc or affected users should be able to confirm this report.

IRC log: