Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

MS Security Essentials reporting false positives in the Bitcoin blockchain

answers.microsoft.com

Post reply on HN
Print view View original

21–30 of 85 posts

Re: MS Security Essentials reporting false positives in the Bitcoin blockchain

#21

Post by codystebbins »

nivla wrote: post #17

OR they could have just used the string from EICAR test file [1]. Since I don't use bitcoin, let me ask, does everyone have to download the whole blockchain to their computer in order to mine or receive/sent the coins? Wouldn't the blockchain be in XX GB size by now? [1] http://en.wikipedia.org/wiki/EICAR_test_file

Not sure about mining, but I would assume yes the blockchain is needed.

In order to have a wallet and just use bitcoin no the user does not need to download the whole blockchain depending on the wallet software. There are wallets that use public shared remote servers to access the blockchain that are reputable in the community.

https://electrum.org/

https://multibit.org/

https://darkwallet.unsystem.net/ (don't use yet, alpha)

Re: MS Security Essentials reporting false positives in the Bitcoin blockchain

#22

Post by andrewmunsell »

bowmessage wrote: post #19
nivla wrote: post #17

OR they could have just used the string from EICAR test file [1]. Since I don't use bitcoin, let me ask, does everyone have to download the whole blockchain to their computer in order to mine or receive/sent the coins? Wouldn't the blockchain be in XX GB size by now? [1] http://en.wikipedia.org/wiki/EICAR_test_file

Yes, they do. And yes its quite large! Over 10 GB.

If you use a client such as Electrum, it uses a server based model to index the Blockchain. The advantage of this is primarily "instant" start up time of the client.

https://electrum.org/

Re: MS Security Essentials reporting false positives in the Bitcoin blockchain

#23

Post by nivla »

ghshephard wrote: post #16
nivla wrote: post #12

Earlier quoted context omitted.

Nah I will stick with MSE because the alternative for me is not to use an antivirus. If you ever want to know how to bring a 8-core i7 to its knees, install Norton. MSE is the only antivirus that is lightweight, stays out of your way and the least annoying of everything out there and not to mention its free with no ads. Sure, it doesn't have an heuristic scanning but it did once do a good job of detecting a malware t…

You forgot the top two other pieces of advice - Make sure you have a decent adaptive firewall, and run anything even slightly worrisome in a virtual machine, never on your main operating system.

You are right, those too. I would also recommend Sandboxie[1], not sure on its effectiveness but the convenience to just right click and run apps in its own sandbox is huge. Does anyone know an open source alternative to it?

[1]http://www.sandboxie.com/

Re: MS Security Essentials reporting false positives in the Bitcoin blockchain

#24

Post by duskwuff »

bobbles wrote: post #7

I seem to remember just having some text copy+pasted into IRC channels used to send peoples anti virus software into meltdown.. but this was sometime like 2000-2001

For a while, some security suites would freak out and terminate an IRC connection if they saw the text "start keylogger" show up. You could get people to drop by saying it in a channel, for instance.

Re: MS Security Essentials reporting false positives in the Bitcoin blockchain

#25

Post by windsurfer »

nwh wrote: post #2

So a joker decided to embed some Anti Virus bait in the blockchain, just a few bytes is enough to make the software go nuts deleting a whole lot of files the Bitcoin client needs. The solution the Bitcoin developers suggest is pure old-school malware style, XOR the blocks to hide it from the Anti Virus suites. Classic. https://github.com/bitcoin/bitcoin/issues/4069

Isn't this just an arms race, though? What's to stop people from doing this again?

Re: MS Security Essentials reporting false positives in the Bitcoin blockchain

#26

Post by NhanH »

DerpDerpDerp wrote: post #9
afreak wrote: post #3

The simple solution is to not allow your anti-virus software to scan anything that cannot malware. There are exceptions to the rule of course such as MP3s that had executable code, but why does it need to scan every single file on your system? Full disclosure: I used to work for an AV software company and personally think that AV is a dead technology.

Could you elaborate on why you think it's a dead technology?

The idea of having a program that is allowed to scan and check every single files/ memory blocks seems to be, at the very least inefficient and against the principle of isolation to me.

May be because I'm just biased because the damn thing used to start running every time my gaming session is heating up ...

Re: MS Security Essentials reporting false positives in the Bitcoin blockchain

#27

Post by simcop2387 »

bobbles wrote: post #7

I seem to remember just having some text copy+pasted into IRC channels used to send peoples anti virus software into meltdown.. but this was sometime like 2000-2001

DCC SEND LOLLERCOPTER

There were a few others, but that's the one i remember. the part after DCC SEND doesn't matter as long as it was longer than 8 characters i think it was.

Re: MS Security Essentials reporting false positives in the Bitcoin blockchain

#28

Post by wmt »

afreak wrote: post #11
DerpDerpDerp wrote: post #9

Earlier quoted context omitted.

Could you elaborate on why you think it's a dead technology?

There are many articles describing why but really it comes down to this: malware authors can pump out so many copies of their software at once that signature-based detections in which the AV industry relies on are no longer reliable or effective. We're at a point now where what may have worked as a defence against stuff being found on floppy drives just isn't able to scale for today's modern infrastructure. AV is rea…

I'm not sure what should I not forget when I visit a hacked web forum which sends me to an exploit kit, that knows an unpatched, possible zero day, vulnerability from my browser?

You're oversimplifying modern AV by acting like it's just a signature based file scanner. That's just a one defence of many in a good AV product.

Re: MS Security Essentials reporting false positives in the Bitcoin blockchain

#29

Post by [deleted] »

sliverstorm wrote: post #10
voltagex_ wrote: post #8

Earlier quoted context omitted.

From a comment on that issue: >Just for fun, there's about 8000 reachable nodes on the network at the time of writing. Assuming that a large portion of the network is unreachable (NAT, filtering, intermittent, just not listening), it's probably safe to assume there's probably at least 50,000 nodes with the complete blockchain. If we XOR just the chainstate, we cause 50000 * 430 MB of disk writes, 50000 * 430 * 2 MB r…

Just 8000 bitcoin nodes? So much for the People's Distributed Currency.

[deleted]

Re: MS Security Essentials reporting false positives in the Bitcoin blockchain

#30

Post by maaku »

Jach wrote: post #20
bowmessage wrote: post #19

Earlier quoted context omitted.

Yes, they do. And yes its quite large! Over 10 GB.

No they don't. Mining software that connects to pools is independent of having a blockchain copy. There are also several bitcoin wallet implementations that don't require a full copy of the blockchain.

Strictly speaking, that is hashing software. Mining software is what runs on the pool, and it absolutely must download and verify the blockchain.
Post reply on HN