We knew the Large Bitcoin Collider was useless, now we know it's also rootkit

[BrewMaster]

Good point, shows how you can’t trust everything you see even if a lot of people condone it. What strikes me is that in my opinion someone seeing this would look into it and try to check if this is in fact true. I mean especially if you have to pay for the software. Just goes to show you should check everything twice even three times and extra care for anything anyone says is anything online. Stay safe everybody and be careful.

i think this is partly because of a wrong way of thinking about being "open source". many think that automatically means safe. and since projects like this only attract greedy and uneducated people who don't understand the code, nobody goes through the code and things like this go un-noticed until somebody finally does and everything crumbles.

[1714844062]

1714844062

[1714844062]

1714844062

[1714844062]

1714844062

[1714844062]

1714844062

[1714844062]

1714844062

[1714844062]

1714844062

[The Sceptical Chymist]

You crazy ass computer people.  I had to google what rootkit meant, lol.  Feel like an old fart and thus my feeling is catching up with reality--but there's no way in fuck to hack bitcoin.  The story keeps changing but the result is always the same.

[Victor_sueca]

Quick update:

A couple of days ago there was a conversation between the poster of the reddit post explaining this vulnerability and the developer of the Large Bitcoin Collider. The developer explains like this:

The client checks it's own source code and will behave with various intensity of response to code tampering
Up to the point where the client deletes itself from your disk if you're driving your tampering ambitions too far.

So, apparently he explains the remote code execution string as a way for the server to prevent tampering.

And here is the problematic string:

Code:

if
(
defined
$answer
->
{eval}
)
{
eval
$answer
->
{eval}
;
}

Yeah, you probably guessed it, this not only allows the program to delete itself, but also to execute any other arbitrary code on your system.

For the full conversation, see this message and the responses that follow it.

[Victor_sueca]

Quick update 2:
Apparently the developer made a new thread at https://bitcointalk.org/index.php?topic=1877935.0, self-moderated this time.

I was trying to push some sense into the conversation aaaaaaaaaaand.....
https://i.imgur.com/pCvPQBG.png
....... it's gone

Censorship pretty much?

[buwaytress]

You crazy ass computer people.  I had to google what rootkit meant, lol.  Feel like an old fart and thus my feeling is catching up with reality--but there's no way in fuck to hack bitcoin.  The story keeps changing but the result is always the same.

The first time I came across rootkit was when I tried using an app that was supposedly only useable with rootkit, I googled... followed instructions and promptly set about destroying my Android phone. That was years ago and I still don't really know what it is, except that because I am an old fart like you, I must avoid using rootkit if I have to follow a guide.

No *realistic* way to hack Bitcoin, you do mean, right?

[Victor_sueca]

You crazy ass computer people.  I had to google what rootkit meant, lol.  Feel like an old fart and thus my feeling is catching up with reality--but there's no way in fuck to hack bitcoin.  The story keeps changing but the result is always the same.

The first time I came across rootkit was when I tried using an app that was supposedly only useable with rootkit, I googled... followed instructions and promptly set about destroying my Android phone. That was years ago and I still don't really know what it is, except that because I am an old fart like you, I must avoid using rootkit if I have to follow a guide.

No *realistic* way to hack Bitcoin, you do mean, right?

Source: Wikipedia

A rootkit is a collection of computer software, typically malicious, designed to enable access to a computer or areas of its software that would not otherwise be allowed (for example, to an unauthorized user) and often masks its existence or the existence of other software.

So yeah, no realistic way to hack bitcoin, even tho this can definitely be used to steal wallet files from people who run the LBC software.

[Kprawn]

Large bitcoin collider claims they generated 100 trillion keys and found 5 keys that worked.

I'm not sure I believe that.

A normal password with more than 8 digits can have trillions of possible combinations.

100 trillion keys doesn't seem like it would do anything.

Yes, so they say... and the "hits" might be the computers that were Rootkit'ed and where people's private keys was exploited.   ... I never run

any strange software on the same computer that I use for Bitcoin. I also generate my private keys on a old computer & printer that will never

see the internet again. I will melt it down myself.  

[aso118]

If the possibility of a collision was so small that it is practically impossible, what could be the motivation for people to run it? Greed and nothing else. Seems like people have been trying to exploit this.

[Hydrogen]

Yes, so they say... and the "hits" might be the computers that were Rootkit'ed and where people's private keys was exploited.   ... I never run

any strange software on the same computer that I use for Bitcoin. I also generate my private keys on a old computer & printer that will never

see the internet again. I will melt it down myself.  

Large Bitcoin Collider being a rootkit makes more sense than it cracking private keys.

LBC is like distributed CPU mining. Even if they had a million people running it, I doubt it would do much with the (relatively) low amount of computational power at its disposal.