Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

MS Security Essentials reporting false positives in the Bitcoin blockchain

answers.microsoft.com

Post reply on HN
Print view View original

41–50 of 85 posts

Re: MS Security Essentials reporting false positives in the Bitcoin blockchain

#41

Post by Inversechi »

nivla wrote: post #23
ghshephard wrote: post #16

Earlier quoted context omitted.

You forgot the top two other pieces of advice - Make sure you have a decent adaptive firewall, and run anything even slightly worrisome in a virtual machine, never on your main operating system.

You are right, those too. I would also recommend Sandboxie[1], not sure on its effectiveness but the convenience to just right click and run apps in its own sandbox is huge. Does anyone know an open source alternative to it? [1] http://www.sandboxie.com/

I saw this a few years ago but never got round to trying it. Does anyone know how effective this actually is?

Re: MS Security Essentials reporting false positives in the Bitcoin blockchain

#42

Post by cjg »

nwh wrote: post #2

So a joker decided to embed some Anti Virus bait in the blockchain, just a few bytes is enough to make the software go nuts deleting a whole lot of files the Bitcoin client needs. The solution the Bitcoin developers suggest is pure old-school malware style, XOR the blocks to hide it from the Anti Virus suites. Classic. https://github.com/bitcoin/bitcoin/issues/4069

In one of the comments in that article: "I can't wait until someone legally changes their name to one of these sequences and we find out that all sorts of government databases didn't have functioning backups..."

Re: MS Security Essentials reporting false positives in the Bitcoin blockchain

#43

Post by frik »

simcop2387 wrote: post #27
bobbles wrote: post #7

I seem to remember just having some text copy+pasted into IRC channels used to send peoples anti virus software into meltdown.. but this was sometime like 2000-2001

DCC SEND LOLLERCOPTER There were a few others, but that's the one i remember. the part after DCC SEND doesn't matter as long as it was longer than 8 characters i think it was.

It was a bug in Linksys, Netgear routers that rebooted the device.

bug report e.g. http://colloquy.info/project/ticket/531

Re: MS Security Essentials reporting false positives in the Bitcoin blockchain

#44

Post by VMG »

sliverstorm wrote: post #39
pmorici wrote: post #14

Earlier quoted context omitted.

Those are probably 'full nodes' to participate in the network as a miner or casual user you don't need to run a full node.

Yeah, but if there are just 8,000 nodes, suddenly it seems like it wouldn't be all that hard to hijack the network. It's possible I misunderstand, and overestimate the value of full nodes.

You're basically right though, there are regular calls on /r/bitcoin for people to run a full node because the number has gone down recently. I decided set one up on my dedicated host due to one of these.

Re: MS Security Essentials reporting false positives in the Bitcoin blockchain

#45

Post by VMG »

nullc wrote: post #36
windsurfer wrote: post #25

Earlier quoted context omitted.

Isn't this just an arms race, though? What's to stop people from doing this again?

Every host would have a unique mask.

Doesn't this make it slightly more difficult bootstrap a new node when you can't just copy an existing installation?

Re: MS Security Essentials reporting false positives in the Bitcoin blockchain

#46

Post by etiam »

We actually received advance warning of this some time ago: https://news.ycombinator.com/item?id=7542920

After some consideration and the feedback here https://news.ycombinator.com/item?id=7543196 I decided to inform one major antivirus vendor about it. They offered their thanks for the warning, but also the opinion that false alerts would be strongly limited since the virus signatures are in files that would generally not be scanned. The scope of this remains to be seen, but apparently at least Microsoft Security Essentials doesn't handle this entirely without problems.

Re: MS Security Essentials reporting false positives in the Bitcoin blockchain

#47

Post by thelsdj »

simcop2387 wrote: post #27
bobbles wrote: post #7

I seem to remember just having some text copy+pasted into IRC channels used to send peoples anti virus software into meltdown.. but this was sometime like 2000-2001

DCC SEND LOLLERCOPTER There were a few others, but that's the one i remember. the part after DCC SEND doesn't matter as long as it was longer than 8 characters i think it was.

I had a modem that would disconnect if someone typed: ATH0++ in IRC.

Re: MS Security Essentials reporting false positives in the Bitcoin blockchain

#48

Post by JimDabell »

bobbles wrote: post #7

I seem to remember just having some text copy+pasted into IRC channels used to send peoples anti virus software into meltdown.. but this was sometime like 2000-2001

If I remember correctly, it used to be the case that if you could get the string +++ATH0 transmitted to somebody in the clear, you could hang up their dialup connection because it was a control code for Hayes modems that ended up being standardised on. Badly written firmware in modems meant that this was often interpreted even when it wasn't transmitted in a control code context.

Re: MS Security Essentials reporting false positives in the Bitcoin blockchain

#49

Post by mahdavi »

nwh wrote: post #2

So a joker decided to embed some Anti Virus bait in the blockchain, just a few bytes is enough to make the software go nuts deleting a whole lot of files the Bitcoin client needs. The solution the Bitcoin developers suggest is pure old-school malware style, XOR the blocks to hide it from the Anti Virus suites. Classic. https://github.com/bitcoin/bitcoin/issues/4069

it won't solve the problem, the joker can simply inject a string that becomes a virus signature after XOR.

Re: MS Security Essentials reporting false positives in the Bitcoin blockchain

#50

Post by tom- »

afreak wrote: post #3

The simple solution is to not allow your anti-virus software to scan anything that cannot malware. There are exceptions to the rule of course such as MP3s that had executable code, but why does it need to scan every single file on your system? Full disclosure: I used to work for an AV software company and personally think that AV is a dead technology.

It's visibles that you used to work for an AV company and haven't followed the advances of the industry. As you don't mention any of the modern day technologies like heuristics and file reputation in cloud.

It's true that the world is full of auto morphing malwares, but you can still detect them new variants through heuristics. Which in turn delivers the results to what is generally known as some sort of Antivirus Cloud Lookup or File Reputation Lookup.

Also the AV industry shares information between them. So in the background you don't have anymore analysts looking at every sample file. Instead there's automation that analyses each incoming sample.

The old scan databases you prefer to are usually last line of defense now days if all the other technologies before haven't been able to show the file to be known good file or bad file.

Full disclosure: I currently work for computer security company.

Post reply on HN