Bitcoin Forum

If you are using the graphical version of 0.9.0 on any platform, you must update immediately. Download here (https://bitcoin.org/bin/0.9.1/). If you can't update immediately, shut down Bitcoin until you can. If you ever used the payment protocol (you clicked a bitcoin: link and saw a green box in Bitcoin Core's send dialog), then you should consider your wallet to be compromised. Carefully generate an entirely new wallet (not just a new address) and send all of your bitcoins there. Do not delete your old wallet.

If you are using any other version of Bitcoin-Qt/Bitcoin Core, including bitcoind 0.9.0, you are vulnerable only if the rpcssl command-line option is set. If it is not, then no immediate action is required. If it is, and if an attacker could have possibly communicated with the RPC port, then you should consider your wallet to be compromised.

This vulnerability is caused by a critical bug in the OpenSSL library used by Bitcoin Core. Successfully attacking Bitcoin Core by means of this bug seems to be difficult in most cases, and it seems at this point that even successful attacks may be limited, but I recommend taking the above actions just in case.

If you are using a binary version of Bitcoin Core obtained from bitcoin.org or SourceForge, then updating your system's version of OpenSSL will not help. OpenSSL is packaged with the binary on all platforms.

Download 0.9.1 (https://bitcoin.org/bin/0.9.1/)
Announcement (https://bitcoin.org/en/release/v0.9.1)

Other software (including other wallet software) may also be affected by this bug. OpenSSL is extremely common.

I shivered for a monent. Next time try mentioning the good news first.

Thanks for the heads up!

This is incredible... who found the bug ? Wladimir ?




_______________________________________________________________________________ _____________
www.CoinLearn.org - Learn and Earn Free Bitcoins

The article I read and this subsequent website states the Heart bleed bug has been around since 12-11.

http://heartbleed.com/

Does ever mean in the 0.9.0 version, or at any point of time?

Exactly, we're not talking about a few £ or $ here and there...LOL!

This applies to Multibit Bitcoin wallets? Multibit vs 0.5.17?

The payment protocol only exists in 0.9.

Do I need to uninstall 0.9.0?

https://bitcointalk.org/index.php?topic=561923.msg6133060#msg6133060


Nope.
Just QUIT NOW and
https://bitcointalk.org/index.php?topic=562388.msg6132859#msg6132859

Theymos -

I have a number of people I need to tell to update.

Can I tell them to just go to bitcoin.org and update yet?

(the front end website I mean)

Updte:  Looks like here has 0.9.1?  https://bitcoin.org/en/download

-B-

What about to use ALERT
https://en.bitcoin.it/wiki/Alerts

My exact thoughts. I think this is serious enough.

Maybe he's talking about non techincal users. To answer his original question, YES the website seems to have updated the download links to the latest version.

https://bitcoin.org/en/download

Exactly.  Thanks.

Sure. Thats good & OK.
But we should(??) alarm all users ASAP to at least shutdown bitcoin core and don't use it and upg. ASAP.

the new client crashes pretty nasty
ok found its my antivirus trying to avoid another bitcoin virus
people who use windows make sure when the program crashes to set any antivirus to allow the data
its a false positive

pls what OS do u use?
No crashes with 0.9.0??

Edit: using electrum is safe.

That's exactly what all those three letter organizations doing within the Bitcoin Foundation, introducing vulnerabilities to the protocol.

I did not had this issue with 0.90 i get and error when it checks the blockchain
The antivirus reports the block data check as containing Trojan: Win32/Malagent
And it also reports to have found DOS/Azusa

This is data being checked by bitcoin-qt in the check files

Which old clients (if any) are affected? I am still running v0.8.5-beta

Better shutdown NOW and upg. ASAP.
What I heard (and don't believe) only 0.9.0.

But I think 0.8.x (and all older) are affected - because OpenSSL contains this bug for 2 years.

Just upg. to 0.9.1

All versions of Bitcoin-Qt are affected by the rpcssl part of the vulnerability if they are linked with an affected OpenSSL version.

Where did u download this?

From given links in this topic i use the win x64 version on windows 8.1
I am pretty sure its false positive of the av programs

just to get this straight..

ALL bitcoint-qt versions have this bug, correct?

how does this bug get triggered? just by having the client running?

or do you need to click a payment link (or something external to the client).. in other words just initiating a transfer via copy/pasteing an address was safe?

Did you check control sums? Just offload bitcoin.org a little bit :D
By the way may this bug be used to empty gox and bitfunder?

Here
https://bitcointalk.org/index.php?topic=561923.msg6133060#msg6133060
I suggest every1 to change wallet.
And have more of them and have them OFFLINE!
Online wallets are just for daily spendings.
If u have 5K or 100mil - u still have only few in your wallet and some VISA maybe.
Same for BTC

Well to be sure i rescan now with eset/kapersky and a few others to see if any trojan/virus is found
My weekly scan with my 12 av products was overdue a few days so doing it now :D
The installer i downloaded from bitcoin.org does seem clean as wel
 

There is no reason to do this.
So grandmas dont get bad habits ;)

I was using Mac OS X Bitcoin-Qt 0.8.6. As far as I know, I've never used the rpcssl command line option.

So if this rpcssl option is not on by default, then this vulnerability could not have affected me, right?

I've already updated to 0.9.1. I just want to know if I have to go through the emergency measures of creating a new wallet and transferring everything to it.

That's kind of disruptive because it means updating all my miner configs as well. Unless I can preserve my old addresses in the new wallet. Never had to do that so I don't know if it works or not.

If i would be miner - I would create 3-10 OFFLINE wallets with 10+ adreses each. And then re-conf miners every few weeks with new addr.

New wallet form time to time is a good idea.

And they can still mine (for a time) to old wallet - u just can transfer every X days mined BTC to new wallet...
And slowly change your configs...

Just my 2 satoshis

SHA-256 checksum of the magnet link matches what I have from the bitcoin.org download.

On the other hand, it's a critical piece of software and only ~60MB; I would still only download from the official source.

I created 4 private keys offline in Bitcoin-QT 9.0 via TailsOS. My client never touched the internet, do I need to bring my cold storage online to create 4 new wallets in 9.1?

If wallets were 100% time offline - I think they can't be abused by this bug.

+1
I want to know as well.

I hate being forced into new updates. Like MoonShadow once said (and I am paraphrasing): "I like to wait until they have ironed out the bugs with new releases before I update". I've been following that same rule, and only update if it's absolutely necessary. Which is why I never even upgraded to v0.9

EDIT: Also, are the cold addresses generated from bitaddress.org safe? Most of my cold Bitcoins are stored on addresses (with their keys) generated from bitaddress.org (i.e. the "Bulk Wallet" option)

I'm also curios. I'd rather not update if not necessary.

If necessary, is a standard update ok? Or is an entirely new wallet required?

Yes alt-coin wallets are affected. Unless they switched out openssl.

It should depend does rpc accept connections from network by default config or not. If it does then wallets on such systems can be compromised and need a replacement. If it does not and user did not opened it to network then no reasons to worry.

Man I'm worried now, I guess I will bring my wallets online tomorrow and create 4 new wallets *sigh*

That's a good policy. I also do that. You don't need to update from versions older than 0.9.0 unless you're using rpcssl. Most people aren't.


bitaddress.org's HTTPS may have been compromised due to this OpenSSL bug, which could have allowed a man-in-the-middle to serve you malicious JavaScript.

I recommend not using JavaScript Bitcoin software for anything important.


No, but don't ever run your 0.9.0 installation. When you want to access your cold storage, update to the latest version first.

I'm using Armory 0.90-beta with bitcoind 0.9.0. I don't believe I've ever used rcpssl -- but I'm not sure. I have an encrypted online wallet, and an offline wallet. Could my wallets be compromised?

alert is like defcon 1 I think, Im trying to imagine the crypto equal of an impending nuclear winter

I think action first is probably wise, prevention before cure?


My noob question here is could gox claim this bug had any influence at all in their case


Do they do alpha beta test before then allowing a recommended update to the masses

If you know how to use (or can figure it out) Gitian you could always recompile your favourite version of Bitcoin-qt with the newer version of OpenSSL.

Third parties could do the same thing but obviously that would require a lot of trust.

Is there a quick guide to install this ?

I have just switched from windows to Ubuntu, Help!

I got 0.9.0 installed via PPA but the PPA is not updated yet ( + I would like to know how to do it without)

I have :-

Downloaded bitcoin-0.9.1-linux.tar.gz

Then tar xvzf bitcoin-0.9.1-linux.tar.gz


This gives me a folder with bin + src but no ./configure. src has but that  fails.

Obviously I just don't get it  ;D

How can you tell when you are using rpcssl? What activates/turns it on? I've never manually ran any RPC commands that had to do with SSL. Just importing privkeys.

When you run bitcoind, you can run it with a number of command-line switches such as -config=..., -connect=..., etc. If you run bitcoind with -rpcssl=1, then you're potentially vulnerable to this bug.

The downloaded bin directory contains a few executable files. Find the locations of those files already on your system and replace them with the new versions. Maybe they're in /usr/bin?

Yup, pretty easy stuff.

Shameful quote, I need to know :(

just downloaded 0.9.1 win64 bit and i get this error: Assertion Failed! Program C:\Program Files\Bitcoin\bitcoin-qt.exe
File ../../src/serialize.h, Line1013

Expression: nSize >=0

For Windows users, if you are using a vulnerable OpenSSL version and want to update it to the latest, non-vulnerable one:
http://slproweb.com/products/Win32OpenSSL.html (linked from http://www.openssl.org/related/binaries.html (http://www.openssl.org/related/binaries.html))

Memorized private keys, the safest way to own bitcoin.
Encrypted paper wallets, almost as safe.

Paper wallets without encryption could be physicly stolen then claimed.
Bitcoin clients have the possibility of security vulnerabilities and are targeted by bitcoin related malware.
Physical digital wallets are subject to theft just as unencrypted paper wallets are.

Almost everyone should be pretty safe especially you. Unless they're not telling us something yet.

How do I install this for Linux Mint? On the previous version there was just a bitcoin-qt file which I could click on and run. Now the extracted folder contains several files, none of which are executable. I am stupid and know almost nothing about using the terminal, compiling libraries, etc. Can someone give me a simple explanation please?

Go to bin 64

Even if you are using RPC you would have had to manually create a SSL private key and SSL cert using openssl and then manually install those by setting params in the bitcoin.conf in order to be be exectuing those RPC calls over SSL.

If all of those sounds foreign the simple answer is unless you already knew you were using RPC over SSL you weren't using it.

I have done that and clicked bitcoin-qt. I get the following error:

Could not display "/home/robert/Programs/bitcoin-0.9.1-linux/bin/64/bitcoin-qt". There is no application installed for shared library files. Do you want to search...

That's right they made the resources static. I don't know any more. Try 32?

Tried both. Thanks anyway.

Was scared shitless , until I saw this.

If you guys are worried, transfer everything to a paper wallet you made offline and let this blow over.

I was running Bitcoin_qt 9.0. I downloaded the Bitcoin qt 9.1 setup.exe file and ran it. Am I good?


EDIT: I did't uninstall anything prior to installing 9.1 is that ok?

I have 0.8.5 version. Should I upgrade too? Backup before upgrade?

What about Mycelium - is it safe?

Good double check about version

You don't have to but yes and yes

Safe just check their site for updates

If you don't use RPC over SSL then there is no need to upgrade, of course an upgrade won't hurt.

As for "backup before upgrade"?  ALWAYS backup before upgrade, every single upgrade and periodically between upgrades.  You never need to ask that question again because there is never a scenario where if you are deciding if you should make a backup that it would be a bad idea to do so.  Always use dates in the names of backups so you don't write over previous versions.

Thanks. I already update my wallet regularly with timestamps. I mean will backup process and old backups affected for this? I use vanity addresses I created. Should I create new normal addresses?
I upgraded to 0.9.1 without a problem.

Reusing addresses is bad anyway, I say start fresh. Don't lose old wallets tho.

Okay, I'm using (According to the debug screen):

v0.8.6-beta
Which has
OpenSSL 1.0.1c 10 May 2012


Never clicked on any "payment" thingys and I've only received BTC and sent BTC from it.
My bitcoin.conf is empty.

Never heard of this "rpcssl" option so I've never used it.
Am I good? Or must I update to 0.9.1?
Thanks guys  ;D

Sounds good then. Just running with whatever default settings comes when you install it. Minus the "-detachdb" and "-datadir" (to download the blockchain to a different hard drive) commands. I don't even have the "bitcoin.conf" file, so nothing to worry about. Thanks! (off topic: i'm enjoying your RNG thread btw)




+1
I cannot stress this enough! ALWAYS backup before doing anything with your wallet. Between upgrades, when you import keys, etc... And keep the backups in multiple secure places.

The HeartBleed vulnerability has been around ~2 years.
OpenSSL is the program effected. The OpenSSL team has only discovered this vulnerability yesterday.
It is not specific to bitcoin-qt.
Anytime you have bitcoin-qt open you are potentially at risk.

Please.

Almost sounds like you've downloaded a source archive. Are you sure you've downloaded https://bitcoin.org/bin/0.9.1/bitcoin-0.9.1-linux.tar.gz , 36MB in size?

I had a quick look at this archive and the executables appear to be there:

bin/32/bitcoin-qt
bin/64/bitcoin-qt

Armory offline and online are both safe right?

I'm using Armory 0.8.x

Yes because it doesn't bitcoind rpcssl.

So glad my balance is still there, after the update.

Why don't the devs send an update notice with the emergency key?

Can really the CLIENT KEYs be compromised by this bug?

What I have understand, its a bug in the OpenSSL Implementation of Heartbeat protocol of TLS 1.2, causing OpenSSL to leak contents of RAM in the server.
This means, the attack vector would be limited to:
impersonating a server and replacing a bitcoin adress in the payment protocol, by stealing the SERVER KEYs.

Thus any client-side wallets should be safe since those private keys are never transmitted or kept by the server? (except for webshops and online services running a server-side bitcoin client relying on a vulnerable OpenSSL)

The bitcoin core protocol (port 8333) is not using any form of SSL at all what I know?



If what the Bitcoin devs say is correct (that client keys can be compromised), would also mean that any website using SSL can steal RAM contents of client computers, which would mean my site can get my visitor's bank details, and that would make the security hole way more critical than it is today.

The file I downloaded from your link and the previous link is 47.5 MB. I tried it again with your link, but same result. Bitcoin-qt is not an executable, it is a "shared library (application/x-sharedlib)". I have no program that can execute this file. Fuck. Why didn't they just make an "executable (application/x-executable)" file like version 0.8.5?

Bitcoin Core is considered a server / creates what would be considered a server in at least one of the cases highlighted by theymos.

And, even if it acted as a client in the other: This vulnerability also affects clients, which is basically why, if a browser you use uses OpenSSL (Android Browser, for example), the server itself can attack you this way.

So yes, what you say in your final sentence is true (at least for browsers using OpenSSL).

I bet the CIA was exploiting this bug for years.


Do I sound like a conspiracy nut?

I think that it's probably more secure to use an old linux at this point...

Running bitcoind.static I got:


Solution https://www.foresightlinux.se/what-localefacet_s_create_c_locale-name-not-valid/ (https://www.foresightlinux.se/what-localefacet_s_create_c_locale-name-not-valid/)

Bitcoin 0.9.1 in NOT working with russian version of windows!

Did that glibc problem for linux users get auto-fixed with the 0.9.1 release? Yay! I feared we might be still stuck with 0.9.0's glibc headache:

 https://bitcointalk.org/index.php?topic=522014.msg5795604#msg5795604

... but I just ran the vanilla 0.9.1 in bash in debian wheezy without any trouble at all. Good work devs. :)

If you are using packages from your Linux distro (Ubuntu PPA included), 0.9.1 has no changes for you.
Instead, you must upgrade to a fixed OpenSSL version.

another reason for new investors to avoid bitcoin :(

Memorized private keys are in fact one of the least secure ways to own bitcoin.

The vulnerability is bidirectional. The server (or anyone MITMing it!) can get the client to leak information too, which could include private wallet data.

So if libssl1.0.0 has been updated then all is good and we can still use 0.9.0 ?   8)

Just be sure it's updated to a fixed version.

Could somebody describe how the attack would work when somebody had been using Bitcoin Core 0.9.0 and clicked on a "bitcoin:" link?

Would the wallet be considered compromised even if I generated the "bitcoin:" link myself and clicked it just to see how the new payment function worked? In that case, how the private keys would have been exposed?

Would the wallet be considered compromised if I clicked on a "bitcoin:" link but didn't go through the payment, and thus I did not sign any transaction?

I just cannot wrap my head around it yet.

Looks good  :)
link for others :-   http://www.ubuntu.com/usn/usn-2165-1/ (http://www.ubuntu.com/usn/usn-2165-1/)

In this case, the risk is only if you were MITM'd...

But who could have MITM'd me? A malicious node? How can my priv keys be exposed just by clicking a "bitcoin:" link that I generated myself, especially if I did not go through the transaction and thus I didn't sign and broadcasted it?

Thanks for info. Is electrum compromised as well?

If your on Ubuntu Saucy you can type,

apt-cache showpkg --names-only openssl

in a terminal to find out what version you have installed.

Package: openssl
Versions:
1.0.1e-3ubuntu1.2

more info here http://www.ubuntu.com/usn/usn-2165-1/

Does this only apply only for Bitcoin QT? Just wondering because I use BlockChain online wallet and MultiBit.

Thank you for the info and the update. All best!

+1
I would like to know this as well

I've opened a dedicated thread (https://bitcointalk.org/index.php?topic=563048.msg6138709#msg6138709) in Technical Discussion for this purpose.

i am using QT v8.0.6 beta, need to upgrade or i am safe and sound?

0.8.6 is only vulnerable if you use the -rpcssl options and expose RPC to the internet - which is vulnerable to other attacks even with this fixed.
So probably not.

Ok thank you :)

On Linux Mint 14 you can still launch your bitcoin-qt if you go to terminal and type "./bitcoin-qt". If you want to start it without having it tied to your terminal window then type "(./bitcoin-qt -min &> /dev/null &)"

At least two dozen people (and I was nowhere near the first one) told the devs that using the OpenSSL CA infrastructure for their "payment protocol" coin-tracking fantasies was a (a) crazy, (b) stupid, and (c) risky scheme that involved an utterly massive expansion of the attack surface to include all of SSL and the entire certificate authority ponzi-scheme.

What did they do?  They ignored common sense.

The bitcoin dev responsible for this idiocy is totally incompetent and should step down effective immediately.  Oh wait, that happened.

Carry on.

It's easy to cry "I told you so" in retrospect. But there could have been an exploit in any of the other dependencies. Or in the Bitcoin P2P or RPC network code itself. By no means is OpenSSL the only software that has bugs.

The only long-term sustainable solution to key theft would be to isolate the private keys and signing from the wallet in either a separate process, a trusted computing module or even a seperate device (in order of increased security).

I really like this new update. It has better functions then 0.9.0. I can't wait for the 1.0 release.

Grate. About 2 hours before this showed up I lost 1,6 something BTC to this... And it took only about 2 hours of running application... So it is not that impossible... Well I think it was this since I have no clue what else could it be... Is there any trace left so I can be sure?

I guess wallet stealing trojans exists almost as long as Bitcoin, so your loss could have many (other) causes.

First, scan your computer. Second, did you click on any "bitcoin:"-link?

0.9 introduced a bunch of bullshit. How the hell can bitcoin magnet link be vulnerable?! If they continue introducing unwanted bullshit features, bloating the bitcoin official client then bitcoin will be dead for me. This has already gone too far. The protocol specifies flawless security (except quantum computing vulnerability). WHY on earth has this flawless security be ruined by eager developers adding features that are not essential to bitcoin protocol?

Yeah that's a risk that should not be disregarded lightly.

As far as I understand the main vulnerability was introduced in Bitcoin Core 0.9.0 by the payment protocol's reliance on OpenSSL. If I understand correctly the payment protocol was first introduced with Core 0.9.0 (I think Gavin was doing this).

I think (and mentioned this in the past) that the payment protocol is an entirely optional feature that is not essential for Bitcoin and should not be included. It can be substituted by third parties. The added security risk by reliance on (more) external libraries is much more relevant than providing a somehow useful, but non-essential feature.

+1

Funny... you posted this.. while I was still typing my reply.

It runs only wallet and no I just installed it... I used Ufasoft coin till now but it really runs bad with current blockchain size so I migrate keys.

I do have antivirus and malware bits on... So I don't think it is that. It also has own firewalled subnet...

EDIT: Scan completed. Noting found by AVG or Malwarebits

Right, in principle, wallet functionality isn't needed at all to maintain the Bitcoin P2P network, the reason for Bitcoin Core's existence.

This is why --disable-wallet mode was introduced in 0.9.0. It allows you to build without the wallet, which removes quite a few dependencies (OpenSSL however is still required as we also use it for ECDSA at this point, and for RPC SSL support, but this could change after merging sipa's ECDSA library).

In the long run there are two options: either we remove the wallet, or we keep it and try to keep up with features of other wallets. Keeping up includes the payment protocol. If payment protocol was not supported people would be complaining about lack of support for the new merchant integration methods.

Who did complain?

If payment protocol is distributed with Core, it should be an optional thing, which the user can decide to activate (by checkbox, whatever). Security is much more important.


Edit. imho the dialog introduced in 0.9.0 which replaced the receiving addresses field is not an improvement. It makes things more awkward. (An example of a really good improvement is coincontrol and wallet file selection.)

Dang it! I was sitting here trying to memorize private keys!

When the ppa version will be ready?  >:(

what will happen if i will run the Linux version, with the Current version of qt (ppa)
Is it possible to  "switch" between versions at any given time, consider the block chain is updating sometimes from the linux version and some times from the pp version?

Everyone should keep in mind at all times that Bitcoin is still an experiment, Bitcoin technology (consensus systems) is still a very new field of computer science, and the whole thing could fall apart overnight.

Of all the possible security flaws... OpenSSL, a security-oriented library, having a vulnerability in the most fundamental security feature used by virtually everything... is the LAST thing anyone would have reasonably considered to be a risk to security.

It's much less confusing and makes it easier to use Bitcoin correctly.
Coin Control is handy, but inevitably a power user tool that is likely to give newbies the wrong idea.
Multiwallet support is unfortunately lagging behind since CodeShark went and made his own wallet instead. :(

Never, it's not affected (although your OS probably is...)

Luke,
what will happen if i will run the Linux version and then switch back to the ppa version, will the wallet will sync properly?

It should, but there's no point.

Well, as for the openssl, what i did is this :

aptitude show libssl1.0.0 | grep Version

and it show this-

Version: 1.0.1-4ubuntu5.12

which seems to be the latest for ubuntu 12.04 LTS

I am still not sure i am protected..

http://www.ubuntu.com/usn/usn-2165-1/

No one yet. But that would happen soon enough after the new BIP007x features are rolled out by other (BitcoinJ) based wallets.

In any case the plan is to split the wallet off to a different repository, so that it can be maintained separately. This means you can create a fork with your own (subset of) features, without forking the entire node implementation as well.

This can happen only after SPV functionality has been implemented though. This would also isolate the wallet from potential bugs in the P2P network code (and vice versa), and also means that even if you run a full node, you don't have to have your wallet always online.

Any reliance on external libraries is added security risk. Because Core is financial software the most paranoid security approach should be in place. So where external libraries are not essential they should be avoided.


This is Bitcoin Core. You do not need to hide all complexity from the user. I'm accustomed to initiate all payments by myself - I dislike direct debit and similar things, because it gives me less feeling of control. Maybe this is also a question of cultural socialisation, so preference maybe different across countries - I don't know. Regardless, I think a Bitcoin Core user can be expected to know how to copy and paste Bitcoin addresses and type in the correct amount - there is no need for simplification.
There can be third party wallets which are "easier" to use.

This is encouraging.

With the rename to "Bitcoin Core", you would think it would be just that, the CORE p2p network/functionality.

IMO the foundation has no business competing with other clients and features, be responsible for the core, let others build on it.

At the very least separate out all "features" that are not required by the core as a separate application.

I'm not sure I follow you. In the post that you reply to, I talk about splitting off the wallet functionality. I don't see why you still feel that you need to rant. This can't be done in one day (unless we get a lot of knowledgeable new contributors), but it is the planned direction.

Nor does the Foundation have any relationship to Bitcoin Core.

That includes the wallet.

Re-reading my post, it does come off as a rant, that is not how it is intended....

I just believe that the "core" should be just that, the minimum code required to participate in and contribute to the network.

I think the planned direction to split out the wallet  is great, and appreciate you taking it.

I'm not sure I understand, this is from the foundation site:


Is this not a "relationship" to the core and its development?  ???

The Foundation contributes financially to Bitcoin development in general.
It doesn't (or at least, isn't supposed to) favour or control any given implementation.

It would be interesting if the authors of other* (SPV) wallets made it possible to run and manage a walletless bitcoind in the background, so that their users can optionally contribute to the network by running a full node.

*Armory does this, but only because it needs to, it cannot work in SPV mode

update the binary (i don't touch the folder) is the right choice ?
(openssl is in binary file bitcoin-qt.exe, no ?)

I'm sorry, and I'm sure I'm not the first to point this out, when you have a board comprised of people running businesses based on Bitcoin it becomes very difficult to assert that their own positions and goals do not drive decision making about the core.

I honestly don't know any members of the board personally, and am not trying to throw anyone under the bus here, but I think we need to be realistic about "how it works"....


100% agreed, I run 2 full nodes. 1 on my day-to-day computer (with Armory), and a second on a dedicated server that we pull data from for our site (http://162.242.245.151/).

I feel both obligated and proud to support the network, and can't see a reason that anyone involved with Bitcoin would not, would be nice if all wallet software had this option.

Should we change our wallet password too?

Not really. There are two scenarios:

1) Your private keys are not compromised. Either you never used a bitcoin: URI with a payment request, or, at least never from a compromised server. No need to change your password or do anything.

2) Your private keys are compromised. You clicked on a bitcoin: URI in your browser that fetched a payment request from a malicious SSL server. By an unlikely fluke, memory was leaked to the server that contained private keys. Send your coins to a new wallet while you can, before the attacker abuses your keys. Changing the password is not enough as a precaution in this case.

 I just upgraded to 0.91 since I was using 0.9.  I've never input my password using 0.9 but I have with prior versions, is there any reason for me to start a new wallet and transfer funds?  As I understand, my bitcoin wallet password should be secure if I haven't entered the password into the 0.9 client?

My wallet is version 0.8.6 beta.
Can I continue to use it?
If I upgrade to 0.9.1 version I have to download all blockchain?

yes

no

no, no reason to do that

Any update there?

I keep small amounts in my pc wallet for casual spending. I applied the 0.9.0->0.9.1 update and once done syncing, the client told me that my database was corrupt and wanted to reindex it. I allowed it to, and sometime during the sync, 1.3 BTC went from confirmed to unconfirmed and hasn't moved since (24 hours or so I'd guess). Any ideas/suggestions?

https://i.imgur.com/KxeaFrr.jpg

Thanks for the quick fix.

It appears to me that you have a few unconfirmed transactions that hold up inputs.
Have you perhaps set "spend unconfirmed change" in options to false (or passed -spendzeroconfchange=0)?

thanks for that fast action! very good.

If you look in the transaction list do you see any tx which are unconfirmed?  If so check another source (blockr.io or blockchain.info) to determine if the tx is indeed unconfirmed.

Nope.

No, but i just noticed that it reverted me to 0.8.6.... How is this possible? All tx before 7/30/2013 are gone, and those coins are still unconfirmed. I was at version 0.9.0 prior to updating..

https://i.imgur.com/NHdFqRH.jpg

Updated to 0.9.1 again, ran it, and now those coins are out of unconfirmed balance and listed as 'conflicted' in transaction log and I don't recognize the address they were sent to.

https://i.imgur.com/egeHtNI.jpg

I got the message "Corrupted block database detected.

Do you want to rebuild the block database now?" then when it was almost entirely rebuilt I got the message again and it is rebuilding again now-I updated to 0.9.1 between the rebuilt and it  didn't change anytging; can someone help me explain?

After having read this:


   ...and then this:



   ...could someone tell me which one is correct please ?
   What's the way to follow in order to have it fixed when one has got Bitcoin Core 0.9.0 from Ubuntu PPA ?
   Plain English without discrepancies will be much appreciated. Thank you.

Why isn't 0.9.1 on SourceForge, and what is its checksum?

You should be verifying the PGP sigs from https://github.com/bitcoin/gitian.sigs

Yes I think separate the core and wallet should be a good thing, but this might require some effort and time, modularization usually take years to achieve

Anyone have information on whether this affects multi bit or not?

"@MultiBitOrg Does the OpenSSL bug affect Multibit?"

"-@QuadraQ As MultiBit is installed on your machine you interact with it directly so no."
https://twitter.com/MultiBitOrg

Good to know, thanks for posting!  But it's always better to be safe than sorry.

cd bin - change directory to the bin folder you just unzipped
cd 64 (or 32 depending on your processor) - change directory again to one of two directories inside /bitcoin-blahblahblah/bin/
./bitcoin-qt - execute the binary file

you don't need anything in the src directory, because you want to run a pre-compiled binary (kind of the linux equivalent to a windows .exe file). everything in the src directory is for that.

http://www.devtome.com/doku.php?id=making_a_qt_wallet_work_in_ubuntu_12.04

Rawted,

Have you tried running bitcoin-qt with -rescan flag?

right click on bitcoin icon. go to properties, and where it says C:\Windows\Program Files(x86)\Bitcoin\bitcoin-blahblahblah.exe (or whatever yours says) add -rescan, run it, and let the blockchain resync.

then go back and remove the flag because you wont want to resync after everytime you run the client.

Thanks, I had resolved the issue by moving bitcoin-qt to the correct directory however this was really helpful in my understanding.  ;D

thanks

Well, one good side effect of this release is that a lot of people will upgrade. Which means more nodes to relay my 0.00001 transaction fee transaction.

I'm not very happy about the information system. A notification integration that there is a new version available would be the least in the Bitcoin Core.
I wouldn't force the users to upgrade their Bitcoin Core, but at least an Integrated Info-System would be highly apreciated.

That I have to go to the Bitcointalk Forum to read about it, is terrible in my eyes.

It exists. It just wasn't used for 0.9.1.

Does anyone know if this affects Armory wallets? if so, how do we upgrade safely?

Probably, Armory uses the bitcoin daemon.
Just upgrade the bitcoin daemon(packaged with bitcoin-qt/core.)

In reality, I've not seen any evidence to prove this vulnerability could effect a average end bitcoin user behind a router.

EDIT:
Modern routers do more than route network traffic.
They block incoming connections.
My understanding of the heartbleed venerability leads me to believe it would require a open port to request the memory dumps.

I felt I should probably elaborate on my above statement.

New like these make me wonder if people should avoid new updates if they are not critical. Like an update to 0.9.0 - I did not read changelog and thought, why bother updating...

It's perfectly reasonable to wait a while after a release, and not jump on every update. This is the reason that automatic updates aren't implemented.

Can someone tell me why the bitcoin-qt file isn't executable in linux?

That makes only sense, if it is no hardfork. Otherwise you'd be on the wrong fork, missing coins that were send to you from the new fork and vice versa.

Still missing those coins. It really is quite perplexing. The dates of the transactions with those coins are all from the june/july 2013 range and up until 0.9.1 were valid confirmed coins, and are now conflicted transactions and missing coins. Does this mean I was passed bad transactions previously and it's only now showing up? If so, how were those coins spendable prior?

Do one thing, import wallet on blockchain.info then make a new wallet and send coins to your qt wallet. (Make sure to send a test amount first)

I use a very simple workaround. I created a shortcut on the desktop and pointed it to the bitcoin-qt file. That's it.

Sorry it's all Greek to me I only use Linux for Bitcoin-QT. Can you explain me step by step how I can bitcoin-qt get running. At version 0.8.6. the bitcoin-qt file was executable but in the new version it is a shared libary. I opened the context menu and tried to open the file with "run application" but nothing happens.

This is extra bad OpenSSL bug. With Certificate Patrol extension installed on Firefox I see almost every site changing SSL keys. Already changed all my important passwords on websites.

But Bitcoin is not that badly affected. Deep web are changing .onion addresses, people changing TorChat identities. It is chaos there right now and recent attack on Hidden Wiki by some Anonymous moron does not help.

Maybe The Hidden Wiki got it's legendary .onion key leaked because of this OpenSSL vulnerability? This key leaking is exactly what the vulnerability will allow to do. Previously I thought that the hidden wiki's VPS host was broken by password reset.

1. Use instructions from this link: http://xmodulo.com/2013/11/create-desktop-shortcut-launcher-linux.html (http://xmodulo.com/2013/11/create-desktop-shortcut-launcher-linux.html) (or google linux+desktop+shortcut)
2. In the “command” field put the correct path to your “bitcoin-qt” file, i.e. “/home/user/bitcoin-0.9.1-linux/bin/64/bitcoin-qt” (without quotes) for example.
3. Uncheck “run in terminal” and check “is executable”, if those checkboxes exist.
4. Use new shortcut (or launcher).

How do you compile this on openSUSE? There are no instructions inside this build that explain how to compile/make Bitcoin-Qt/Bitcoind on any version of Linux and what dependencies are needed too. There seems to be a lot of assumptions being made...

Thanks,

Maybe that's how all the darkweb marketplaces and forums got shut down? Utopia was butchered at birth, Black Market Reloaded Forum was also shut down by police.

It is only speculation. The exploit cannot deanonymize hidden service. I can be used to steal private key for .onion address and then impersonate the service. I think the black markets got shut down because of different security issues.

What if I have my blockchain on f drive? How do I update?

The instructions are in src/doc/build-unix.md. For bitcoind, you only need OpenSSL (the fixed version), Boost, and Berkeley DB.

So if the possibility exists, but was not used. For what do you use it then?
I like to get infos about a new client-version before the last "Sorry all your Bitcoins are stolen" message...

If you talk about the "Alert" function, then Gavin is responsable for the lack of not using it.

I understand that you don't wana use it for bullshit rumors, but the Hardbleed bug is a serious one.

I recommend to use it for all new Bitcoin Core releases. If you don't call it URGENT, then it's just a feature upgrade.
But in this case I think URGENT would have been the right naming for it.

IMHO the risk is being overstated and it probably doesn't warrant the use of the alert key. 

Is Ubuntu ppa:bitcoin/bitcoin going to get updated soon?

Are you going to release ~trusty debs anytime soon?

Thanks a lot. I will try.

Yes sir, and thanks for your help. I replied to your PM. It seems to be almost 2.7btc I am missing now, however only 1.3 btc is showing as unconfirmed in 0.8.6-0.8.9, whereas it's showing as conflicted in 0.9.1. Nothing to the address in question, and none of the tx ids pop up on blockchain.info.

we need the Bitcoin PPA to be updated to 0.9.1.

unless someone could publish a clear, coherent way to compile the Bitcoin tar.gz

Luke-Jr has already addressed this issue:


And bitcoin-0.9.1-linux.tar.gz is compiled. A little uncooperative maybe :) but compiled.

what does this heartbleed thing do. i ask because i updated my bitcoin wallet to 0.0.1 and on the same day i was not able to unlock my blackcoin wallet anymore. it says incorrect password. even though i know it's the right one

I hope that they dont drop ppa support for bitcoin and they will update the package asap.

There is no reason to update the PPA, you need to update OpenSSL on your server, the Bitcoin PPA relies on it....

ubuntu has update OpenSSL with the latest bug free version.

The Windows version of Bitcoin Core 0.9.0 introduced a bug which affects data paths that contain non-ASCII characters. These are no longer recognised correctly (it's a new bug, Bitcoin-qt 0.8.* was fine with non-ASCII characters in paths). Since the data directory in Windows is C:\Users\[username]\AppData\Roaming\Bitcoin, the problem on a Russian system is likely to be the user name. My guess is that you have a Russian user name and the program is choking on the data path. Try copying the data directory to a path that contains only Latin letters and then change the path in the options accordingly, and it will probably work.

I get the same issue with Avast AV.

Paper wallets generated before 0.9 are also vulnerable if they found the public key?

Greetings.

Public Key? No.  Private Key probably although the risk of getting private key this way is academic at best.  Still if the paper wallet is funded and nobody stole the coins that is a very good canary in the coal mine.  If you have unfunded paper wallets well although the risk is very low I would just trash them and print new ones.

I downloaded it, and update very slow

Does other Bitcoin clients also afected?

So basically, if you had 0.9.0, but you neither have enabled manually rpcssl from the console, nor clicked on any bitcoin link, then your wallet has always been safe and no private keys could have been leaked.

This is a relief if you have several addresses linked to shares.

How can I Upgrade my Bitcoin QT?

I use Linux Ubunto and I don't know what to do.

Being a noob myself I asked the same question (https://bitcointalk.org/index.php?topic=562400.msg6146151#msg6146151) and got no answer here. Just to have it clear I was using bitcoin 0.9.0 from Ubuntu PPA and
had my libssl1.0.0 updated however in the debug window it still showed old/insecure version of OpenSSL.

So here is what I did:

-First thing first back up ur wallet.
-Shut down your client.
-Now make a backup of your current bitcoin-qt executable/shared library which should be in /usr/bin
-Download and verify bitcoin-0.9.1-linux.tar.gz (https://bitcoin.org/bin/0.9.1/bitcoin-0.9.1-linux.tar.gz)
-Navigate to your Home directory
-and then to Downloads
-unzip what you've downloaded
-Navigate to just unzipped directory
-and then depending on whether your system is 32 or 64 do
-copy bitcoin-qt from this directory to /usr/bin

-start your client the usual way.

Hope it helps...
 :) :) :)

nice. thank you.

how do i turn this into an icon executable seen in Dashboard?

Is anyone else having an issue with multi-sig transactions. It seems that bitcoin 0.9.1 can't find the proper private key for the public key when using signrawtransaction. I tried on two different computers. I had to manually redo the transaction and insert the private key myself.

very good，i will try it

It is Very Important that you update you Client to combat against the Open SSL Bug known as HeartBleed.com More information at the following link

Hi, I'm a newbie for sure.

I downloaded the new version v0.9.1.0-g026a939-beta (32-bit) and it appears to be communicating by the looks of the network traffic graph.  When I started it, days ago, it said "12 days behind" and now it says "2 weeks behind".  It also says:

 "Warning: The network does not appear to fully agree! Some miners appear to be experiencing issues.",

Should I just wait and see what happens?  Should I be concerned?

Thanks.

I have 0.9.1 version now, does it mean I'm safe?
Do I also have to delete my previous version?

Verifying the SHA1 checksum of the bitaddress.org HTML that you download locally is the way to be sure you are safe.

You should be able to lock it to the launcher when its running aye

Quick guide for Ubuntu

1. Download https://bitcoin.org/bin/0.9.1/bitcoin-0.9.1-linux.tar.gz
2. Open file, then click 'Extract'-button. Extract the files in your home folder.
3. Open terminal, enter:


Done.

Do I need to uninstall 0.9.0? ???

I am not using bicoin-qt but i installed it and using multibit. It is necessary to update it or uninstall it?

No.

If you don't use it you should be fine.


https://multibit.org/blog/2014/04/10/multibit-and-heartbleed.html
 (https://multibit.org/blog/2014/04/10/multibit-and-heartbleed.html)

Dam I'm still using 8.6 QT. It seems like there needs to be constant updates. What if one were to take a break from bitcoin for 5 years? There has to be a better way to not have vulnerable wallets during this time.

If you aren't using Bitcoin you wouldn't be vulnerable.  When you decide to start using Bitcoin after your five year break you would download and install the current software.

"Never" took only 10 days which is good result IMO.
0.9.1 available now at Ubuntu PPA (https://launchpad.net/~bitcoin/+archive/bitcoin).

Big thank you for Matt Corallo and “Bitcoin” team
and Happy Easter everyone.

what about old versions like 0.8.6 etc also compromised ?

Maybe. In any case you should upgrade it to 0.9.1. I never upgrade to 0.9.0, I've waited feedbacks, then this Heartbleed bug found. Then I upgrade it from 0.8.6 to 0.9.1 and I have no problem at all.

Those coins are still missing for me, and the addy only showed up on the blockchain after sending it some dust. Anything else I should try before writing off these coins? Anyone have ANY idea how this could happen?

updated normally

Could someone help out please?

When I start bitcoin core, I get "error opening block database, Do you want to rebuild the block database now?"  If I press "OK", I get "error opening block database"

What can I do to get my wallet working again?

Thanks.

Manually Delete then re-download the block chain.
It should be in .bitcoin folder in your user app data folder(%appdata%).
Your location may vary depending on the version of windoze you run.

You really should've created a new topic, You revived a dead thread.

I closed and restarted it and it seems fine. I think it was definitely downloading the first time because my network was going crazy.

thank you for your reply.  It's sorted out. I had to reinstall. But It's all good.

If you use Bitcoin Core, then this poll matters to you:
https://bitcointalk.org/index.php?topic=598082.0

Bitcoin Core users can vote about a change in Bitcoin Core!


(I posted this to the Bitcoin Core update thread because it would directly affect Bitcoin Core users.)