Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

MS Security Essentials reporting false positives in the Bitcoin blockchain

answers.microsoft.com

Post reply on HN
Print view View original

61–70 of 85 posts

Re: MS Security Essentials reporting false positives in the Bitcoin blockchain

#61

Post by spacemanmatt »

JimDabell wrote: post #48
bobbles wrote: post #7

I seem to remember just having some text copy+pasted into IRC channels used to send peoples anti virus software into meltdown.. but this was sometime like 2000-2001

If I remember correctly, it used to be the case that if you could get the string +++ATH0 transmitted to somebody in the clear, you could hang up their dialup connection because it was a control code for Hayes modems that ended up being standardised on. Badly written firmware in modems meant that this was often interpreted even when it wasn't transmitted in a control code context.

BitCom, a trashy DOS based terminal program, would lower the signal on the DTR pin, which would hang up the modem instantly, when it saw the text, "NO CARRIER" on a line by itself. Obviously, that line got dropped in forums and chat rooms as the "word of the day for BitCom users" on a regular basis.

Re: MS Security Essentials reporting false positives in the Bitcoin blockchain

#62

Post by nwh »

VMG wrote: post #45
nullc wrote: post #36

Earlier quoted context omitted.

Every host would have a unique mask.

Doesn't this make it slightly more difficult bootstrap a new node when you can't just copy an existing installation?

You shouldn't use that anyway, that's a trust needing operation. A bootstrap.dat file is what you want, which wouldn't have the obfuscation applied.

Re: MS Security Essentials reporting false positives in the Bitcoin blockchain

#63

Post by cnvogel »

cjg wrote: post #42
nwh wrote: post #2

So a joker decided to embed some Anti Virus bait in the blockchain, just a few bytes is enough to make the software go nuts deleting a whole lot of files the Bitcoin client needs. The solution the Bitcoin developers suggest is pure old-school malware style, XOR the blocks to hide it from the Anti Virus suites. Classic. https://github.com/bitcoin/bitcoin/issues/4069

In one of the comments in that article: "I can't wait until someone legally changes their name to one of these sequences and we find out that all sorts of government databases didn't have functioning backups..."

I think you could put the "EICAR Test String" easily in a lot of databases, maybe as the answer to a security question, a special "delivery instruction"...

http://www.eicar.org/86-0-Intended-use.html

It's detected by almost any antivirus product, on my work computer the corporate antivirus immediately quarantines a file with this content.

X 5 O ! P % @ A P [ 4 \ P Z X 5 (...)

Re: MS Security Essentials reporting false positives in the Bitcoin blockchain

#64

Post by MichaelGG »

nivla wrote: post #23
ghshephard wrote: post #16

Earlier quoted context omitted.

You forgot the top two other pieces of advice - Make sure you have a decent adaptive firewall, and run anything even slightly worrisome in a virtual machine, never on your main operating system.

You are right, those too. I would also recommend Sandboxie[1], not sure on its effectiveness but the convenience to just right click and run apps in its own sandbox is huge. Does anyone know an open source alternative to it? [1] http://www.sandboxie.com/

Also on Windows, consider looking at Software Restriction Policies. For my host partition, I have things configured to deny execute for anything not in Windows (and excluding some temp/cache dirs). So if I step away for a minute and someone tries to download and run an exe, Windows should prevent it. Would also prevent me from drunkenly saving cute.jpg.exe to my desktop and running it.

Re: MS Security Essentials reporting false positives in the Bitcoin blockchain

#65

Post by reitanqild »

DerpDerpDerp wrote: post #9
afreak wrote: post #3

The simple solution is to not allow your anti-virus software to scan anything that cannot malware. There are exceptions to the rule of course such as MP3s that had executable code, but why does it need to scan every single file on your system? Full disclosure: I used to work for an AV software company and personally think that AV is a dead technology.

Could you elaborate on why you think it's a dead technology?

Because a kid can write a working trojan that escapes AV detection? (Two very young studends I know did, POC took less than 50 loc in AHK. That included a plausible "installer" as well as auto update feature).

Re: MS Security Essentials reporting false positives in the Bitcoin blockchain

#66

Post by maaarghk »

cnvogel wrote: post #63
cjg wrote: post #42

Earlier quoted context omitted.

In one of the comments in that article: "I can't wait until someone legally changes their name to one of these sequences and we find out that all sorts of government databases didn't have functioning backups..."

I think you could put the "EICAR Test String" easily in a lot of databases, maybe as the answer to a security question, a special "delivery instruction"... http://www.eicar.org/86-0-Intended-use.html It's detected by almost any antivirus product, on my work computer the corporate antivirus immediately quarantines a file with this content. X 5 O ! P % @ A P [ 4 \ P Z X 5 (...)

Not EICAR because that has to be at the start of the file. But some other signature, sure.

Re: MS Security Essentials reporting false positives in the Bitcoin blockchain

#67

Post by TazeTSchnitzel »

duskwuff wrote: post #24
bobbles wrote: post #7

I seem to remember just having some text copy+pasted into IRC channels used to send peoples anti virus software into meltdown.. but this was sometime like 2000-2001

For a while, some security suites would freak out and terminate an IRC connection if they saw the text "start keylogger" show up. You could get people to drop by saying it in a channel, for instance.

http://bash.org/?13213

Like this?

Re: MS Security Essentials reporting false positives in the Bitcoin blockchain

#68

Post by jnbiche »

lifeisstillgood wrote: post #55
VMG wrote: post #44

Earlier quoted context omitted.

You're basically right though, there are regular calls on /r/bitcoin for people to run a full node because the number has gone down recently. I decided set one up on my dedicated host due to one of these.

Interesting - I have been meaning to look into how the blockchain works (I missed the get-rich-quick rush and dismissed it all until heard Andreessen explain the reasons) Anyway - what does being a full node entail?

Simply run bitcoin-qt or bitcoind all the time and make sure that you have port 8333 open to the outside world (if you have a router, this usually means forwarding 8333).

It takes a few hours to a half day for the node to catch up, depending on your bandwidth and CPU, but after that it requires relatively little processing time. But you do need ~20 GB of free hard drive space for the blockchain.

Re: MS Security Essentials reporting false positives in the Bitcoin blockchain

#70

Post by thristian »

JimDabell wrote: post #48
bobbles wrote: post #7

I seem to remember just having some text copy+pasted into IRC channels used to send peoples anti virus software into meltdown.. but this was sometime like 2000-2001

If I remember correctly, it used to be the case that if you could get the string +++ATH0 transmitted to somebody in the clear, you could hang up their dialup connection because it was a control code for Hayes modems that ended up being standardised on. Badly written firmware in modems meant that this was often interpreted even when it wasn't transmitted in a control code context.

Actually, it wasn't "badly written firmware". Hayes modems actually looked for "+++", then a second or so of no traffic, before they would switch into command-mode, and that delay was patented. So "Hayes-compatible" modems would implement the system without the delay, and as a result were vulnerable to remote DoS.
Post reply on HN