Lauda (OP)
Legendary
Offline
Activity: 2674
Merit: 2965
Terminated.
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
August 17, 2016, 10:58:00 PM |
|
Summary
Bitcoin.org has reason to suspect that the binaries for the upcoming Bitcoin Core release will likely be targeted by state sponsored attackers. As a website, Bitcoin.org does not have the necessary technical resources to guarantee that we can defend ourselves from attackers of this calibre. We ask the Bitcoin community, and in particular the Chinese Bitcoin community to be extra vigilant when downloading binaries from our website.
In such a situation, not being careful before you download binaries could cause you to lose all your coins. This malicious software might also cause your computer to participate in attacks against the Bitcoin network. We believe Chinese services such as pools and exchanges are most at risk here due to the origin of the attackers.
Mitigation
The hashes of Bitcoin Core binaries are cryptographically signed with this key.
We strongly recommend that you download that key, which should have a fingerprint of 01EA5486DE18A882D4C2684590C8019E36C2E964. You should securely verify the signature and hashes before running any Bitcoin Core binaries. This is the safest and most secure way of being confident that the binaries you’re running are the same ones created by the Core Developers.
Currently found on Bitcoin.org. There seems to be a lack of information regarding this. Any information (speculative posts are likely to be removed due to be insubstantial)?
|
"The Times 03/Jan/2009 Chancellor on brink of second bailout for banks" 😼 Bitcoin Core ( onion)
|
|
|
Carlton Banks
Legendary
Offline
Activity: 3430
Merit: 3079
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
August 17, 2016, 11:14:22 PM |
|
Currently found on Bitcoin.org. There seems to be a lack of information regarding this. Any information (speculative posts are likely to be removed due to be insubstantial)? I find it a little odd that Core team (who presumably control Bitcoin.org?) could be at all certain about the origin or target of such a threat. If the threat itself is public, a simple hyperlink to the threat would suffice. If the threat is private, it depends a great deal on the status (and therefore also the identity) of the menace. Maybe the reference to China is only a reference to China's majority hashrate, and not to anything specific about the known threat.
|
Vires in numeris
|
|
|
Lauda (OP)
Legendary
Offline
Activity: 2674
Merit: 2965
Terminated.
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
August 17, 2016, 11:18:25 PM |
|
I find it a little odd that Core team (who presumably control Bitcoin.org?) could be at all certain about the origin or target of such a threat.
No. The people who have commit access/contribute to Bitcoin Core do not control Bitcoin.org. The people who work (or have commit access) on Bitcoin.org are Cobra, saivan, harding, etc. They are usually quite different from the Bitcoin Core team. From what I can understand so far, Cobra skipped the peer-review process around 2 hours ago and pushed this commit. Bitcoin-core-dev:
|
"The Times 03/Jan/2009 Chancellor on brink of second bailout for banks" 😼 Bitcoin Core ( onion)
|
|
|
Carlton Banks
Legendary
Offline
Activity: 3430
Merit: 3079
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
August 17, 2016, 11:26:41 PM |
|
I find it a little odd that Core team (who presumably control Bitcoin.org?) could be at all certain about the origin or target of such a threat.
No. The people who have commit access/contribute to Bitcoin Core do not control Bitcoin.org. The people who work (or have commit access) on Bitcoin.org are Cobra, saivan, harding, etc. Not sure I have heard of those characters, with the possible exception of harding (if it's the harding from this forum, I haven't seen that user here in a while). Interesting. Sipa is way too involved to be unaware of such issues, so I smell potential drama.
|
Vires in numeris
|
|
|
Lauda (OP)
Legendary
Offline
Activity: 2674
Merit: 2965
Terminated.
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
August 17, 2016, 11:33:59 PM |
|
Not sure I have heard of those characters, with the possible exception of harding (if it's the harding from this forum, I haven't seen that user here in a while).
Well, they generally are only involved in website related work. As far as Cobra is concerned, they're anonymous (i.e. nobody really knows who they are - I don't remember who gave them commit access). I've added a Github link for the contributors. Interesting. Sipa is way too involved to be unaware of such issues, so I smell potential drama.
From what I can gather on the public communication channels, nobody really knows what the reason behind this is. You can see the commit was pushed here: ![](https://ip.bitcointalk.org/?u=https%3A%2F%2Fi.imgur.com%2FfTNfG9F.png&t=665&c=ejC2di7eL1C3GQ)
Interesting information that may be relevant: https://lists.gnupg.org/pipermail/gnupg-announce/2016q3/000395.htmlThe GnuPG Project is pleased to announce the availability of new Libgcrypt and GnuPG versions to fix a critical security problem. Felix Dörre and Vladimir Klebanov from the Karlsruhe Institute of Technology found a bug in the mixing functions of Libgcrypt's random number generator: An attacker who obtains 4640 bits from the RNG can trivially predict the next 160 bits of output. This bug exists since 1998 in all GnuPG and Libgcrypt versions.
Impact: All Libgcrypt and GnuPG versions released before 2016-08-17 are affected on all platforms. A first analysis on the impact of this bug in GnuPG shows that existing RSA keys are not weakened. For DSA and Elgamal keys it is also unlikely that the private key can be predicted from other public information. This needs more research and I would suggest not to overhasty revoke keys.
|
"The Times 03/Jan/2009 Chancellor on brink of second bailout for banks" 😼 Bitcoin Core ( onion)
|
|
|
MyBTT
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
August 17, 2016, 11:40:11 PM |
|
I currently have a backup 0.12.1 wallet in case my primary ledger wallet fails. Because of this, should I not download the next version of qt until this problem is solved? Or should I download from github and compile it myself?
|
▄████▄ ▄████████▄ ▄████████████▄ ▄████████████████▄ ████████████████████ ▄█▄ ▄███▄ ▄███▄ ▄████████████████▀ ▄██████████ ▄▄▄▀█████▀▄▄▄▄▀█████▀▄▄▄ ▀██▄ ▄██▀ ▀██▄ ▄██▀ ▀██▄ ▄██▀ ██ ▄█████▄▀▀▀▄██████▄▀▀▀▄█████▄ ▀██▄ ▄██▀ ▀██▄ ▄██▀ ▀██▄ ▄██▀ ▄█▄ ▀██████████████▄ ████████████████████████████ ▀██▄ ▄██▀ ▀██▄ ▄██▀ ▀██▄ ▄██▀ ▀█▀ ██ ▀████████████████████████▀ ▀██▄ ▄██▀ ▀██▄ ▄██▀ ▄█▄ ▀██▄ ▄██▀ ██ ▀████████████████████▀ ▀███▀ ▀███▀ ▀█▀ ▀███▀ ▄███████████████████████████████████▀ ▀████████████████▀ ▀████████████▀ ▀████████▀ ▀████▀
| ║║ ║█ ║█ ║║ | .
| .
║║ ██ ║║
| .
| .
║║ ██ ║║
| .
| ║║ █║ █║ ║║ | |
|
|
|
Lauda (OP)
Legendary
Offline
Activity: 2674
Merit: 2965
Terminated.
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
August 17, 2016, 11:42:28 PM |
|
Because of this, should I not download the next version of qt until this problem is solved?
You shouldn't download the next version from the website until this resolves just to be sure. However, Bitcoin Core 0.13.0 is not ready yet (currently RC3). Or should I download from github and compile it myself?
That's always the preferred option.
|
"The Times 03/Jan/2009 Chancellor on brink of second bailout for banks" 😼 Bitcoin Core ( onion)
|
|
|
bitkilo
Legendary
Offline
Activity: 1638
Merit: 1010
https://www.bitcoin.com/
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
August 17, 2016, 11:42:49 PM |
|
Summary
Bitcoin.org has reason to suspect that the binaries for the upcoming Bitcoin Core release will likely be targeted by state sponsored attackers. As a website, Bitcoin.org does not have the necessary technical resources to guarantee that we can defend ourselves from attackers of this calibre. We ask the Bitcoin community, and in particular the Chinese Bitcoin community to be extra vigilant when downloading binaries from our website.
In such a situation, not being careful before you download binaries could cause you to lose all your coins. This malicious software might also cause your computer to participate in attacks against the Bitcoin network. We believe Chinese services such as pools and exchanges are most at risk here due to the origin of the attackers.
Mitigation
The hashes of Bitcoin Core binaries are cryptographically signed with this key.
We strongly recommend that you download that key, which should have a fingerprint of 01EA5486DE18A882D4C2684590C8019E36C2E964. You should securely verify the signature and hashes before running any Bitcoin Core binaries. This is the safest and most secure way of being confident that the binaries you’re running are the same ones created by the Core Developers.
Currently found on Bitcoin.org. There seems to be a lack of information regarding this. Any information (speculative posts are likely to be removed due to be insubstantial)? By the way the above is written it seem as though they may have an idea who will be leading these "state sponsored attacks" They say they have a "reason to suspect" do we know what that reason is?
|
Not a paid signature, just added to promote Bitcoin.com ![Smiley](https://bitcointalk.org/Smileys/default/smiley.gif)
|
|
|
MyBTT
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
August 17, 2016, 11:45:21 PM |
|
Summary
Bitcoin.org has reason to suspect that the binaries for the upcoming Bitcoin Core release will likely be targeted by state sponsored attackers. As a website, Bitcoin.org does not have the necessary technical resources to guarantee that we can defend ourselves from attackers of this calibre. We ask the Bitcoin community, and in particular the Chinese Bitcoin community to be extra vigilant when downloading binaries from our website.
In such a situation, not being careful before you download binaries could cause you to lose all your coins. This malicious software might also cause your computer to participate in attacks against the Bitcoin network. We believe Chinese services such as pools and exchanges are most at risk here due to the origin of the attackers.
Mitigation
The hashes of Bitcoin Core binaries are cryptographically signed with this key.
We strongly recommend that you download that key, which should have a fingerprint of 01EA5486DE18A882D4C2684590C8019E36C2E964. You should securely verify the signature and hashes before running any Bitcoin Core binaries. This is the safest and most secure way of being confident that the binaries you’re running are the same ones created by the Core Developers.
Currently found on Bitcoin.org. There seems to be a lack of information regarding this. Any information (speculative posts are likely to be removed due to be insubstantial)? By the way the above is written it seem as though they may have an idea who will be leading these "state sponsored attacks" They say they have a "reason to suspect" do we know what that reason is? "State sponsored attacks"... From my understanding that would be implying that the bitcoin.org has info that a government has the intention to maliciously attack bitcoin, or are funding hackers? After doing a little search, I can't find anything on what the "reason" is.
|
▄████▄ ▄████████▄ ▄████████████▄ ▄████████████████▄ ████████████████████ ▄█▄ ▄███▄ ▄███▄ ▄████████████████▀ ▄██████████ ▄▄▄▀█████▀▄▄▄▄▀█████▀▄▄▄ ▀██▄ ▄██▀ ▀██▄ ▄██▀ ▀██▄ ▄██▀ ██ ▄█████▄▀▀▀▄██████▄▀▀▀▄█████▄ ▀██▄ ▄██▀ ▀██▄ ▄██▀ ▀██▄ ▄██▀ ▄█▄ ▀██████████████▄ ████████████████████████████ ▀██▄ ▄██▀ ▀██▄ ▄██▀ ▀██▄ ▄██▀ ▀█▀ ██ ▀████████████████████████▀ ▀██▄ ▄██▀ ▀██▄ ▄██▀ ▄█▄ ▀██▄ ▄██▀ ██ ▀████████████████████▀ ▀███▀ ▀███▀ ▀█▀ ▀███▀ ▄███████████████████████████████████▀ ▀████████████████▀ ▀████████████▀ ▀████████▀ ▀████▀
| ║║ ║█ ║█ ║║ | .
| .
║║ ██ ║║
| .
| .
║║ ██ ║║
| .
| ║║ █║ █║ ║║ | |
|
|
|
Lauda (OP)
Legendary
Offline
Activity: 2674
Merit: 2965
Terminated.
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
August 17, 2016, 11:48:40 PM |
|
They say they have a "reason to suspect" do we know what that reason is?
From what I know so far, the person who applied the change to the website has not provided (at least not public) an explanation. "State sponsored attacks"... From my understanding that would be implying that the bitcoin.org has info that a government has the intention to maliciously attack bitcoin, or are funding hackers?
No. We are talking about stuff in the lines of MITM attacks; there are a different number of approaches that could be attempted here (someone mentioned SSL MITM with rogue certificates).
|
"The Times 03/Jan/2009 Chancellor on brink of second bailout for banks" 😼 Bitcoin Core ( onion)
|
|
|
Carlton Banks
Legendary
Offline
Activity: 3430
Merit: 3079
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
August 17, 2016, 11:53:40 PM |
|
By the way the above is written it seem as though they may have an idea who will be leading these "state sponsored attacks" They say they have a "reason to suspect" do we know what that reason is?
The text is specific about "state-sponsored attacks", and implies knowledge about both the origin and target of the attack. Extraordinary claims (not saying the requisite extraordinary proof doesn't exist, but I would like to see that proof for myself nonetheless). RNG bugs in GPG don't tell that story (and what a curious bug: like the Bash bug from last year, it's been in Linux for decades. Revoke all the keys!!!)
|
Vires in numeris
|
|
|
unamis76
Legendary
Offline
Activity: 1512
Merit: 1012
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
August 18, 2016, 12:53:58 AM |
|
Saw the warning and came here to post, when I saw this thread. I am very concerned about this, pretty curious on who's threatening Bitcoin binary distribution and what does it have to win with this...
|
|
|
|
|
Quantus
Legendary
Offline
Activity: 883
Merit: 1005
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
August 18, 2016, 02:34:44 AM |
|
You should securely verify the signature and hashes before running any Bitcoin Core binaries.
So just checking the hash is insufficient?
|
(I am a 1MB block supporter who thinks all users should be using Full-Node clients) Avoid the XT shills, they only want to destroy bitcoin, their hubris and greed will destroy us. Know your adversary https://www.youtube.com/watch?v=BKorP55Aqvg
|
|
|
theymos
Administrator
Legendary
Offline
Activity: 5292
Merit: 13204
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
August 18, 2016, 03:04:02 AM |
|
That guide for verifying Bitcoin Core is also available here: https://bitcointalk.org/index.php?topic=1588906.0 . I added a news entry pointing there as well. I recommend taking this threat very seriously. It's possible that bitcoin.org has received bad info, or maybe the attackers will give up now that they've been outed, but it's better to assume that it is a real, serious threat. And it's not just bitcoin.org that could be targeted. bitcointalk.org, /r/Bitcoin, individual Core devs, etc. could also be targeted. Triple-check everything. If any major sites get taken over, try to spread the word as quickly and widely as you can. Of course, you should always be very careful and verify Bitcoin Core software (and other software!), but this is a reason to be especially careful. So just checking the hash is insufficient?
You have to check the hash against some reference hash. The most secure way to make sure that the reference hash is reliable is to check that it's signed by someone you trust.
|
1NXYoJ5xU91Jp83XfVMHwwTUyZFK64BoAD
|
|
|
AliceGored
Member
![*](https://bitcointalk.org/Themes/custom1/images/star.gif)
Offline
Activity: 117
Merit: 10
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
August 18, 2016, 03:43:05 AM |
|
Sounds like laying the groundwork for a disinfo campaign when Chinese miners fork to a larger max blocksize. Sowing the seeds now to favor an adversarial mindset when it comes to plans coming from China.
Nah, I’m probably just wish thinking… More likely that “cobra” is just acting like a petty tyrant again, similar to the last time he showed up, wanting to edit satoshi’s whitepaper.
|
|
|
|
Quickseller
Copper Member
Legendary
Offline
Activity: 2968
Merit: 2364
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
August 18, 2016, 03:59:13 AM |
|
I recommend taking this threat very seriously.
--snip--
And it's not just bitcoin.org that could be targeted. bitcointalk.org, /r/Bitcoin, individual Core devs, etc. could also be targeted. Triple-check everything. If any major sites get taken over, try to spread the word as quickly and widely as you can.
Based on the message on bitcoin.org, it looks like the Chinese government would be behind the attack; is this a correct assumption? Is the motive behind the (anticipated) attack known? How might this state sponsored agency attack the Bitcoin network? Why would they need to infect existing Bitcoin users to attack the network? I would assume that most state sponsored (hacking) agencies would have budgets exceeding that of the market cap of bitcoin, and as a result would be able to launch attacks against the network without the help of malware infected machines.
|
|
|
|
Bitcoinpro
Legendary
Offline
Activity: 1344
Merit: 1000
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
August 18, 2016, 04:38:00 AM |
|
I recommend taking this threat very seriously.
--snip--
And it's not just bitcoin.org that could be targeted. bitcointalk.org, /r/Bitcoin, individual Core devs, etc. could also be targeted. Triple-check everything. If any major sites get taken over, try to spread the word as quickly and widely as you can.
Based on the message on bitcoin.org, it looks like the Chinese government would be behind the attack; is this a correct assumption? Is the motive behind the (anticipated) attack known? How might this state sponsored agency attack the Bitcoin network? Why would they need to infect existing Bitcoin users to attack the network? I would assume that most state sponsored (hacking) agencies would have budgets exceeding that of the market cap of bitcoin, and as a result would be able to launch attacks against the network without the help of malware infected machines. Market cap could exceed these budgets within a matter of hours if the price jumped to say $5000 a coin and that's precisely what would happen if an attack like this occurred because all of a sudden it would mean Bitcoin is very special, which we know it already is ![Smiley](https://bitcointalk.org/Smileys/default/smiley.gif) also dont forget the amount of coins out their through exchange leverage means total coin numbers is in the 100's of millions,
|
WWW.FACEBOOK.COM
CRYPTOCURRENCY CENTRAL BANK
LTC: LP7bcFENVL9vdmUVea1M6FMyjSmUfsMVYf
|
|
|
Bitcoinpro
Legendary
Offline
Activity: 1344
Merit: 1000
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
August 18, 2016, 05:00:24 AM |
|
Can you explain this MIM attack more precisely, are you saying that data will be forged for a long time, would they need to attack both
sender and receiver at the same time, is this attack going after transactions or miners confirming transactions, and what kinds of alerts
will be prompted if the Binaries aren't correct,
|
WWW.FACEBOOK.COM
CRYPTOCURRENCY CENTRAL BANK
LTC: LP7bcFENVL9vdmUVea1M6FMyjSmUfsMVYf
|
|
|
Quickseller
Copper Member
Legendary
Offline
Activity: 2968
Merit: 2364
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
August 18, 2016, 05:04:30 AM |
|
I recommend taking this threat very seriously.
--snip--
And it's not just bitcoin.org that could be targeted. bitcointalk.org, /r/Bitcoin, individual Core devs, etc. could also be targeted. Triple-check everything. If any major sites get taken over, try to spread the word as quickly and widely as you can.
Based on the message on bitcoin.org, it looks like the Chinese government would be behind the attack; is this a correct assumption? Is the motive behind the (anticipated) attack known? How might this state sponsored agency attack the Bitcoin network? Why would they need to infect existing Bitcoin users to attack the network? I would assume that most state sponsored (hacking) agencies would have budgets exceeding that of the market cap of bitcoin, and as a result would be able to launch attacks against the network without the help of malware infected machines. Market cap could exceed these budgets within a matter of hours if the price jumped to say $5000 a coin and that's precisely what would happen if an attack like this occurred because all of a sudden it would mean Bitcoin is very special, which we know it already is ![Smiley](https://bitcointalk.org/Smileys/default/smiley.gif) also dont forget the amount of coins out their through exchange leverage means total coin numbers is in the 100's of millions, The point is that the absolute upper bound of the range of the cost of equipment that secures Bitcoin would be it's market cap (eg the value of all the miners, and the full nodes). I would think that a state sponsored actor could simply buy up their own mining equipment and full nodes if they wished to attack the network. I also do not think the value of bitcoin would increase if this kind of attack took place, I would think the price would dramatically fall, especially if any substantial number of users (especially large companies) were successfully attacked.
|
|
|
|
|