▲ 100 points
back
77 comments
So a joker decided to embed some Anti Virus bait in the blockchain, just a few bytes is enough to make the software go nuts deleting a whole lot of files the Bitcoin client needs. The solution the Bitcoin developers suggest is pure old-school malware style, XOR the blocks to hide it from the Anti Virus suites. Classic.
In one of the comments in that article: "I can't wait until someone legally changes their name to one of these sequences and we find out that all sorts of government databases didn't have functioning backups..."
I think you could put the "EICAR Test String" easily in a lot of databases, maybe as the answer to a security question, a special "delivery instruction"...
http://www.eicar.org/86-0-Intended-use.html
It's detected by almost any antivirus product, on my work computer the corporate antivirus immediately quarantines a file with this content.
X 5 O ! P % @ A P [ 4 \ P Z X 5 (...)
From a comment on that issue:
>Just for fun, there's about 8000 reachable nodes on the network at the time of writing. Assuming that a large portion of the network is unreachable (NAT, filtering, intermittent, just not listening), it's probably safe to assume there's probably at least 50,000 nodes with the complete blockchain. If we XOR just the chainstate, we cause 50000 * 430 MB of disk writes, 50000 * 430 * 2 MB read and write combined, somewhere in the region of 43TB. If we XOR the entire blockchain on disk we cause 50000 * 21000 * 2 MB of IO, around 1.95PB of RW across the wider Bitcoin network. Incredible.
Just 8000 bitcoin nodes? So much for the People's Distributed Currency.
This is an old trick. A little while ago someone was putting the EICAR test string in email subject lines, headers, inside PDF files, in mime headers, and in other random places. He managed to crash a lot of enterprise level AV solutions and email servers. If you want to be a dick, just copy and paste that string everywhere you can. The AV will treat it like a real threat.
That somewhat reminds me of this: http://en.wikipedia.org/wiki/BLIT_(short_story)
Isn't this just an arms race, though? What's to stop people from doing this again?
Every host would have a unique mask.
it won't solve the problem, the joker can simply inject a string that becomes a virus signature after XOR.
If every client uses his own keystream, then not.
MSE was top-notch when it was first released. It aced all the malware detection benchmarks, not to mention it was completely ad-free and extremely lightweight, which was unheard of in the free antivirus market. The high detection rate and low performance impact made lots of Windows users flock to MSE, myself included.
Nowadays, MSE is still lightweight, but it sits at the bottom of every malware detection benchmark. I've been recommending MSE to everyone around me, but recently they started getting all sorts of malware despite keeping MSE up to date. All of these were easily detected and removed by avast!, BitDefender, and Malwarebytes, but MSE just sat there like a cow, oblivious to the malware's presence.
Why has Microsoft let MSE rot like this? Now that MSE is built into Windows 8, are they afraid of getting slapped with antitrust fines if they shipped an antivirus that can actually compete with third-party offerings?
This year, I'm moving my family off of MSE. So long, it was good while it lasted. But third-party antiviruses have caught up in the meantime, and now they're just as lightweight as MSE.
Nah I will stick with MSE because the alternative for me is not to use an antivirus. If you ever want to know how to bring a 8-core i7 to its knees, install Norton. MSE is the only antivirus that is lightweight, stays out of your way and the least annoying of everything out there and not to mention its free with no ads. Sure, it doesn't have an heuristic scanning but it did once do a good job of detecting a malware that both Avast and Norton missed, which is good enough trust for me. The best feature is that it doesn't have a girl screaming "Avast, Your database have been updated." or "Your license is about to expire in 90days unless you pay $$$" every 4 hours.
Don't download anything sketchy, keep an updated version of your browser, don't run yourself as root and your should be fine for 99.9% infections out there. For the rest just keep MSE around.
You forgot the top two other pieces of advice - Make sure you have a decent adaptive firewall, and run anything even slightly worrisome in a virtual machine, never on your main operating system.
It's sad. However instead of ditching it entirely I have moved to a combination of MSE for real-time protection and Malwarebytes as backup, which I run every month or so to get anything that might manage to slip through.
I've been doing exactly that, but by the time Malwarebytes catches the virus, the damage might already be done. So even if you use Malwarebytes for occasional scans, there is legitimate need for better realtime protection.
Maybe I should get the paid version of Malwarebytes that can also do realtime scans?
I noticed the same. MSE is generally great, but it feels like IE 6 back in 2005 (no investment in years)... :(
Running a multi GB backup with Microsoft's robocopy cmd utility crashes the MSE service. That's really annoying.
Given that "Microsoft Forefront" is a rebranded MSE (it can be controlled over the network), I wonder why its real-time scanner can't handle ~100MB/s IO for several hours.
IE6 is a really great analogy based on what happened inside of microsoft on this team over the past few years.[1]
[1] I helped start up this team in 2004
I seem to remember just having some text copy+pasted into IRC channels used to send peoples anti virus software into meltdown.. but this was sometime like 2000-2001
For a while, some security suites would freak out and terminate an IRC connection if they saw the text "start keylogger" show up. You could get people to drop by saying it in a channel, for instance.
http://bash.org/?13213
Like this?
Or, more sneakily, by embedding it in your hostmask.
If I remember correctly, it used to be the case that if you could get the string +++ATH0 transmitted to somebody in the clear, you could hang up their dialup connection because it was a control code for Hayes modems that ended up being standardised on. Badly written firmware in modems meant that this was often interpreted even when it wasn't transmitted in a control code context.
BitCom, a trashy DOS based terminal program, would lower the signal on the DTR pin, which would hang up the modem instantly, when it saw the text, "NO CARRIER" on a line by itself. Obviously, that line got dropped in forums and chat rooms as the "word of the day for BitCom users" on a regular basis.
Actually, it wasn't "badly written firmware". Hayes modems actually looked for "+++", then a second or so of no traffic, before they would switch into command-mode, and that delay was patented. So "Hayes-compatible" modems would implement the system without the delay, and as a result were vulnerable to remote DoS.
There wasn't really a "control code context" - it was (2 second silence)+++(1 second silence) to switch to command mode, and then ATH to disconnect.
Bad firmwares would also accept same from remote side, although supposedly it should only have come from the local side.
This reminds me how the string %English% transferred via SMS crashed some old Siemens phones and GSM modules because of error in detection of embedded images.
And how recently string سمَـَّوُوُحخ ̷̴̐خ ̷̴̐خ ̷̴̐خ امارتيخ ̷̴̐خ could crash some versions of iOS and OS X.
DCC SEND LOLLERCOPTER
There were a few others, but that's the one i remember. the part after DCC SEND doesn't matter as long as it was longer than 8 characters i think it was.
It was a bug in Linksys, Netgear routers that rebooted the device.
bug report e.g. http://colloquy.info/project/ticket/531
DCC SEND startkeylogger or such combined both exploits. Ah, I had quite a fun with that a couple of years back.
IIRC it still bites a couple of people on Freenode, but the most networks have auto-kick bots in place for these scriptkiddies.
I had a modem that would disconnect if someone typed: ATH0++ in IRC.
I think this is another great example of how modern AV software can be used as a tool of mass censorship. They can simply add signatures for any file contents they disagree with (or some other organisation with the appropriate power requests to do so), and it will disappear from their user's computers under the pretense of being malicious. Users will trust them in order to "stay safe".
That's why I believe in behavioural monitoring rather than signature-based approaches, since what's malicious is really the activity itself.
The simple solution is to not allow your anti-virus software to scan anything that cannot malware. There are exceptions to the rule of course such as MP3s that had executable code, but why does it need to scan every single file on your system?
Full disclosure: I used to work for an AV software company and personally think that AV is a dead technology.
It's visibles that you used to work for an AV company and haven't followed the advances of the industry.
As you don't mention any of the modern day technologies like heuristics and file reputation in cloud.
It's true that the world is full of auto morphing malwares, but you can still detect them new variants through heuristics. Which in turn delivers the results to what is generally known as some sort of Antivirus Cloud Lookup or File Reputation Lookup.
Also the AV industry shares information between them. So in the background you don't have anymore analysts looking at every sample file. Instead there's automation that analyses each incoming sample.
The old scan databases you prefer to are usually last line of defense now days if all the other technologies before haven't been able to show the file to be known good file or bad file.
Full disclosure: I currently work for computer security company.
Given your background it's surprising you don't realize how many file formats are Turing-complete and thus capable of mischief.
Errrrr, anything can contain malware. For exampe if software that uses the blockchain file has a vulnerability that can be exploited by writing stuff into the blockchain.
Could you elaborate on why you think it's a dead technology?
OR they could have just used the string from EICAR test file [1].
Since I don't use bitcoin, let me ask, does everyone have to download the whole blockchain to their computer in order to mine or receive/sent the coins? Wouldn't the blockchain be in XX GB size by now?
The string from the EICAR test file has been in the current testnet chain since the start in order to try to spot these issues before they bothered users.
Unfortunately, it appears that AV software completely ignores files larger than 32 MBytes, so it won't notice them in the blockchain— just the chainstate. And so the grand idea of putting the triggers in coinbases didn't work there.
The other fun thing is that the EICAR test trigger is too long to easily stuff in a transaction. Unfortunately there are other "signatures" which are as short as 16 bytes.
Not sure about mining, but I would assume yes the blockchain is needed.
In order to have a wallet and just use bitcoin no the user does not need to download the whole blockchain depending on the wallet software. There are wallets that use public shared remote servers to access the blockchain that are reputable in the community.
https://darkwallet.unsystem.net/ (don't use yet, alpha)
You don't need the entire blockchain to send/receive. Only when running a "Full node". If you are not intending to keep your node online for 24/7 you can use a SPV style client like Electrum or Multibit. They are lightweight clients without a blockchain attached.
Yes, they do. And yes its quite large! Over 10 GB.
We actually received advance warning of this some time ago: https://news.ycombinator.com/item?id=7542920
After some consideration and the feedback here https://news.ycombinator.com/item?id=7543196 I decided to inform one major antivirus vendor about it. They offered their thanks for the warning, but also the opinion that false alerts would be strongly limited since the virus signatures are in files that would generally not be scanned. The scope of this remains to be seen, but apparently at least Microsoft Security Essentials doesn't handle this entirely without problems.
The part I prefer:
> It appears to be a joke or prank, simply because this particular virus does nothing more than periodically show "YOUR COMPUTER HAS BEEN STONED" on one out of every eight computer boot-ups, and is over 25 years old.
When viruses were mainly jokes...
The Xkcd would go "We thought we sanitised our input but we still lost this years student records.
Did you really name your son Little Bobby Drop [DOS/STONED]{16 byte malware Signature}?"