Title: Protect yourself from fake wallet software (guide) Post by: NotATether on October 23, 2023, 08:33:57 AM As you may know, downloading a fake wallet is one of the main causes of funds theft. So it is very important to be able to detect fake copies of legit wallet software and avoid them. This is my handbook on how to completely avoid running a fake wallet in the first place.
This guide mostly covers desktop wallets - you should not be storing large sums of money on a mobile wallet! As always, for best protection, buy a hardware wallet or use an airgapped computer. But I will not cover either of those in this post. How hackers fool people into downloading fake wallet software You should know one thing about the internet, and it's that nowadays, a domain name of a website can have any kind of characters in it from different languages, not just English. This means that you can go to a site like this (https://räksmörgås.josefsson.org/ <-- safe!) and it's actually takes you to this domain (xn--rksmrgs-5wao1o.josefsson.org [also safe!]) which is the punycode version of this name using only english characters. These domains are frequently abused by hackers to take you to copycat websites that have all kinds of malware on them. So it is important that they are all blocked for your own protection. We will get to how to do that in a minute. The other way hackers fool you into downloading malware is by using Google Search results. Anybody can place an ad on the top spots of Google search results if they pay Google some money. And unfortunately Google often does nothing - or at least not enough - about these things. So that means, the search result you are clicking on might actually be a fake. Now the solution for protecting yourself from both of these threats is two-fold. First, use an extension that blocks international domain names. Second, use an adblocker. For blocking international domain names, you can use IDN Safe: https://github.com/AykutCevik/IDN-Safe it is an open-source extension for Chrome/Firefox/Edge that blocks all funny-looking domain names like the two above, and it has a whitelist in case you do need to access a legitimate site. As for the adblocker, you should only use one that does not secretly allow other companies ads to be shown to you. I recommend uBlock Origin: https://ublockorigin.com/ another open-source adblocker for Chrome/Firefox et al. These two extensions should eliminate the vast majority of fake wallets that could be downloaded to your computer. But there are other ways someone can sneak malware in, using legitimate domains. Open source software, checksums and PGP If your wallet is open-source, any developer can view the source code to verify it is legit. But it also means that hackers can modify it slightly to perform a specific function, such as steal all bitcoins. These wallet software are often hosted on places like Github, with the fake copies being in different repository names that evade the content blockers above. (Note: Never use a closed-source wallet because there is no way to verify that it is not acting maliciously). For this reason, checksums were posted by the developers to ensure that users can verify that the downloaded file is the same as what they got from the internet. A checksum is a long string of text that you make by hashing all the bytes of a file together. When we want to verify a file, we look for the SHA-256 checksum online and then use a checksum program to independently calculate the checksum ourselves to verify it. PGP is a technology that lets you verify the authenticity of any software using a public key. It's important because a hacker can simply replace the checksums of the real file with checksums of the malicious file. When you download the public key listed on the website, and download the signature made by the developer of the program, you can verify the signature using a PGP program to check if it is signed by the developer. PGP signatures cannot be faked by a hacker because PGP uses public keys and private keys. The private key can be used to independently create the public key (which contains a fingerprint), but not the other way around. So, developers keep their private keys secret and create a PGP signature which they post online. The signature cannot be created without the private key, so a hacker has no chance of faking it. What hackers can do is create a completely different PGP key and try to fool unsuspecting users that this is the real key. That is why you must pay attention to the PGP key fingerprint of the signature you are verifying. If it is even slightly different from the real one, then the software is fake and most likely malicious. Some developers put their checksums inside the PGP signatures so that you can also verify that the files were not corrupted while downloading, but the PGP signature is usually enough. Here is how you can verify PGP signatures on Windows: https://bitcointalk.org/index.php?topic=5469280.0 MacOS: https://bitcointalk.org/index.php?topic=5105901.msg49695453#msg49695453 Linux (Ubuntu [uses gpg so install with appropriate package manager]): https://bitcointalk.org/index.php?topic=5105901.msg49694331#msg49694331 Another one for Windows, Mac and Linux: https://bitcointalk.org/index.php?topic=5240594.0 How to calculate SHA-256 checksums of any file: https://help.rublon.com/support/solutions/articles/1000308518-how-to-verify-sha-256-checksum- If any images are broken, just right-click and open in a new tab. In case the fake wallet might be running While I recommend you always verify the PGP signatures of wallets, some of them don't have PGP signatures and thus you can't use those as a line of defense. There is nothing stopping you from accidentally clicking on a fake wallet software to run it, unsuspectingly. They have the same file names, icon and possibly other metadata. So if you are not sure whether the wallet you are running is fake, follow these instructions: (Note: You can't modify the code of the program while it is running, so these instructions only have to be repeated when the wallet software is closed and re-opened.) First of all, you need to have a process manager software running somewhere so you can see where the programs are being ran from. Is it from a folder you've previously ran it from normally, like the programs folder? Or did it spawn somewhere in /tmp or C:\Temp? Granted, you are responsible for figuring out which folders in the OS contain the legit wallet software, and which ones might contain fake software you might have just downloaded. On Windows, Task Manager is not detailed enough so you should install Process Explorer from here https://learn.microsoft.com/en-us/sysinternals/downloads/process-explorer because it shows you the full command-line path of the program. You can also filter processes containing only the name of the wallet software - which task manager can't do. On Mac (using homebrew) and Linux, you can use htop command in the terminal, which you might have to install. Be sure that it's configured to show the full command-line path. You can use this configuration of mine to accomplish that (save it to $HOME/.config/htop/htoprc): Code: # Beware! This file is rewritten by htop when settings are changed in the interface. It contains a bunch of other unrelated stuff but it ensures the full command-line path is shown. For either software, it's helpful to run it in Tree mode to view the processes as a tree to make them easier to find (in the htop config I already did this). In case you leave your wallet opened - and locked (!) for long periods of time, make sure the Start Time column is also visible (again, in htop I already did this for you) so that you know when you started the wallet. Like I said earlier, You can't modify the code of the program while it is running, so this should give you extra confidence that the running wallet software is not compromised at this time and that it is safe to unlock it and make transactions. Also, the other thing you need to look into is you need to check the modification date of the program on the hard disk, to make sure nobody has tampered with the files by installing a fake version recently. You can accomplish this by simply opening a file manager and placing it in "list view" where the "date modified" or "modification time" column is completely visible. (If Windows Explorer keeps crashing and closing itself you can use another file manager like 7-Zip for this.) What ever you do, make sure the modification time is one that you recognize - you should be able to remember installing or updating your wallet software on that date. Decoy wallets Most malware simply drains all the bitcoins in your walllet files. But you can detect and mitigate this kind of attack by following either, or both, of these two simple procedures: 1. Create what I call a decoy wallet. This is a wallet that is password-protected - so that it is not swept immediately - contains a small amount of cryptocurrency such as $1 or $2. You will always open this wallet before you open your real, intended wallet. This will allow you to see whether your defenses have been breached and your wallet has been compromised (i.e. is it safe to use this computer or not?) 2. Copy your real wallet file(s) to removable storage, such as a USB disk. When you want to open your wallet, move it to the correct location where wallets are normally stored. After you close it, copy it back to the USB and delete it from the hard disk. Never take the USB anywhere unless you can guarantee that it will be physically secured. And don't leave it plugged into the computer when the wallet is not open. Mainly useful for wallets with no password or weak password, not as useful for wallets which already have a strong password. As always, use a strong password to protect your wallets because this will prevent anyone from stealing your money even if they swipe your wallet file. But keyloggers are a common threat - on Windows - that completely defeat password security, so make sure you're using anti-virus on Windows such as Malwarebytes. Title: Re: Protect yourself from fake wallet software (guide) Post by: Accardo on October 23, 2023, 12:28:03 PM Search engines contributes a lot in landing users in a phishing website by ranking some of the phishing sites on search results. That's why I'll recommend extension that blocks international domain names and Anti-phishing toolbars for chrome and Firefox. They work in line to stop users from accessing malicious sites and protects user's privacy. Also, it can stop suspicious wallet apps from being downloaded into the device. Additionally, keeping browsers up to date can reduce the rate of getting phished. Hence, it's important to update once the browser update is available. As it contains more security features which helps to protect users from accessing malicious sites. However, phishing techniques keep changing and Op has tried a great deal to enlighten us from falling prey to hackers by opening this discussion. But, no complete rule of avoiding phishing exists. We must keep our head up and follow up threads as this, to know when hackers devised a fresh technique. They know of the spreading warnings against their tricks, such as; mails, copycat websites etc. And they always work strides ahead to beat the current viral methods by coming up with crazy ideas that may not look fishy at anybody's slightest imagination. You also refreshed my memory on PGP regarding digital signature, it's quite a nice secure measure to follow, but the hacker's aim is mainly about the person's private keys, once it's imported on the fake wallet they'll sweep it. Do they have to bother about making it run? like a real wallet. Isn't it about the user opening the wallet app import keys and that will be enough to execute their attack.
For more, consistent phishing guides follow: https://www.phishing.org/10-ways-to-avoid-phishing-scams Title: Re: Protect yourself from fake wallet software (guide) Post by: Yamane_Keto on October 23, 2023, 05:40:12 PM I would like to add: You must obtain (Fingerprint) GPG public keys from an independent source or not linked to the domain from which you download the site, as hackers can place a phishing link or hack the domain and change the GPG public keys from the official domain.
I don't know if we can consider Github to be an independent source, but you can find BitcoinCore GPG keys https://github.com/bitcoin-core/guix.sigs/tree/main/builder-keys electrum ThomasV Fingerprint: 6694 D8DE 7BE8 EE56 31BE D950 2BD5 824B 7F94 70E6 Sparrow https://keybase.io/craigraw/pgp_keys.asc Title: Re: Protect yourself from fake wallet software (guide) Post by: Z-tight on October 23, 2023, 09:18:58 PM 1. Create what I call a decoy wallet. This is a wallet that is password-protected - so that it is not swept immediately - contains a small amount of cryptocurrency such as $1 or $2. You will always open this wallet before you open your real, intended wallet. This will allow you to see whether your defenses have been breached and your wallet has been compromised (i.e. is it safe to use this computer or not?) If an attacker manages to compromise your device, i don't think this is going to stop them, they would probably not even move the small funds that is in your decoy wallet until you import your main funds into the already compromised device. Anything online is prone to hacking and there is no way to be sure that your online device hasn't been infected by malware or compromised by an attacker that is waiting to attack. If you are moving your wallet from your USB drive to your device, it has to be airgapped and disconnected from the internet. Title: Re: Protect yourself from fake wallet software (guide) Post by: NotATether on October 24, 2023, 08:04:05 AM 1. Create what I call a decoy wallet. This is a wallet that is password-protected - so that it is not swept immediately - contains a small amount of cryptocurrency such as $1 or $2. You will always open this wallet before you open your real, intended wallet. This will allow you to see whether your defenses have been breached and your wallet has been compromised (i.e. is it safe to use this computer or not?) If an attacker manages to compromise your device, i don't think this is going to stop them, they would probably not even move the small funds that is in your decoy wallet until you import your main funds into the already compromised device. Sure, against a physical adversary this stands no chance, but it's more of a landmine to catch malware running amok on your system. I would like to add: You must obtain (Fingerprint) GPG public keys from an independent source or not linked to the domain from which you download the site, as hackers can place a phishing link or hack the domain and change the GPG public keys from the official domain. Yes, that is also correct, and is something that I forgot to add inside the OP. Quote I don't know if we can consider Github to be an independent source, but you can find BitcoinCore GPG keys https://github.com/bitcoin-core/guix.sigs/tree/main/builder-keys electrum ThomasV Fingerprint: 6694 D8DE 7BE8 EE56 31BE D950 2BD5 824B 7F94 70E6 Sparrow https://keybase.io/craigraw/pgp_keys.asc If the software is primarily distributed on Github, then it cannot be classified as an independent source. But when the software has a website which hosts the download links, then the Github repo can be used as an independent source because it's not likely that the two assets can be compromised at the same time. |