Live data from Hacker News

MS Security Essentials reporting false positives in the Bitcoin blockchain

answers.microsoft.com

51–60 of 85 posts

Re: MS Security Essentials reporting false positives in the Bitcoin blockchain

#51
The part I prefer:

> It appears to be a joke or prank, simply because this particular virus does nothing more than periodically show "YOUR COMPUTER HAS BEEN STONED" on one out of every eight computer boot-ups, and is over 25 years old.

When viruses were mainly jokes...

Re: MS Security Essentials reporting false positives in the Bitcoin blockchain

#52
post #7

I seem to remember just having some text copy+pasted into IRC channels used to send peoples anti virus software into meltdown.. but this was sometime like 2000-2001

For a while, some security suites would freak out and terminate an IRC connection if they saw the text "start keylogger" show up. You could get people to drop by saying it in a channel, for instance.

Or, more sneakily, by embedding it in your hostmask.

Re: MS Security Essentials reporting false positives in the Bitcoin blockchain

#53
post #14

Earlier quoted context omitted.

Those are probably 'full nodes' to participate in the network as a miner or casual user you don't need to run a full node.

Yeah, but if there are just 8,000 nodes, suddenly it seems like it wouldn't be all that hard to hijack the network. It's possible I misunderstand, and overestimate the value of full nodes.

Non-mining nodes just hold and relay validated blocks, they don't do anything that can be hijacked.

Re: MS Security Essentials reporting false positives in the Bitcoin blockchain

#54
post #7

I seem to remember just having some text copy+pasted into IRC channels used to send peoples anti virus software into meltdown.. but this was sometime like 2000-2001

If I remember correctly, it used to be the case that if you could get the string +++ATH0 transmitted to somebody in the clear, you could hang up their dialup connection because it was a control code for Hayes modems that ended up being standardised on. Badly written firmware in modems meant that this was often interpreted even when it wasn't transmitted in a control code context.

There wasn't really a "control code context" - it was (2 second silence)+++(1 second silence) to switch to command mode, and then ATH to disconnect.

Bad firmwares would also accept same from remote side, although supposedly it should only have come from the local side.

Re: MS Security Essentials reporting false positives in the Bitcoin blockchain

#55
post #44

Earlier quoted context omitted.

Yeah, but if there are just 8,000 nodes, suddenly it seems like it wouldn't be all that hard to hijack the network. It's possible I misunderstand, and overestimate the value of full nodes.

You're basically right though, there are regular calls on /r/bitcoin for people to run a full node because the number has gone down recently. I decided set one up on my dedicated host due to one of these.

Interesting - I have been meaning to look into how the blockchain works (I missed the get-rich-quick rush and dismissed it all until heard Andreessen explain the reasons)

Anyway - what does being a full node entail?

Re: MS Security Essentials reporting false positives in the Bitcoin blockchain

#56
post #49
post #2

So a joker decided to embed some Anti Virus bait in the blockchain, just a few bytes is enough to make the software go nuts deleting a whole lot of files the Bitcoin client needs. The solution the Bitcoin developers suggest is pure old-school malware style, XOR the blocks to hide it from the Anti Virus suites. Classic. https://github.com/bitcoin/bitcoin/issues/4069

it won't solve the problem, the joker can simply inject a string that becomes a virus signature after XOR.

If every client uses his own keystream, then not.

Re: MS Security Essentials reporting false positives in the Bitcoin blockchain

#57
post #7

I seem to remember just having some text copy+pasted into IRC channels used to send peoples anti virus software into meltdown.. but this was sometime like 2000-2001

DCC SEND LOLLERCOPTER There were a few others, but that's the one i remember. the part after DCC SEND doesn't matter as long as it was longer than 8 characters i think it was.

DCC SEND startkeylogger or such combined both exploits. Ah, I had quite a fun with that a couple of years back.

IIRC it still bites a couple of people on Freenode, but the most networks have auto-kick bots in place for these scriptkiddies.

Re: MS Security Essentials reporting false positives in the Bitcoin blockchain

#58

Earlier quoted context omitted.

Yeah, but if there are just 8,000 nodes, suddenly it seems like it wouldn't be all that hard to hijack the network. It's possible I misunderstand, and overestimate the value of full nodes.

Non-mining nodes just hold and relay validated blocks, they don't do anything that can be hijacked.

Full nodes host the memory pool for the txid's - So they serve a purpose: Making transactions propagate over the network. And serve blocks to nodes that are not up-to-date (And clients).

Re: MS Security Essentials reporting false positives in the Bitcoin blockchain

#59
post #17

OR they could have just used the string from EICAR test file [1]. Since I don't use bitcoin, let me ask, does everyone have to download the whole blockchain to their computer in order to mine or receive/sent the coins? Wouldn't the blockchain be in XX GB size by now? [1] http://en.wikipedia.org/wiki/EICAR_test_file

You don't need the entire blockchain to send/receive. Only when running a "Full node". If you are not intending to keep your node online for 24/7 you can use a SPV style client like Electrum or Multibit. They are lightweight clients without a blockchain attached.

Re: MS Security Essentials reporting false positives in the Bitcoin blockchain

#60
post #35
post #17

OR they could have just used the string from EICAR test file [1]. Since I don't use bitcoin, let me ask, does everyone have to download the whole blockchain to their computer in order to mine or receive/sent the coins? Wouldn't the blockchain be in XX GB size by now? [1] http://en.wikipedia.org/wiki/EICAR_test_file

The string from the EICAR test file has been in the current testnet chain since the start in order to try to spot these issues before they bothered users. Unfortunately, it appears that AV software completely ignores files larger than 32 MBytes, so it won't notice them in the blockchain— just the chainstate. And so the grand idea of putting the triggers in coinbases didn't work there. The other fun thing is that the…

16 bytes is the limit?
Post reply on HN