Is it dangerous to load other people's wallet files in the Bitcoin client?

[walletrecovery]

Hello everybody!

Wallets are sent to us to check the availability of private keys inside,
so we can confirm whether this wallet is real or not, but we are worried about our wallets.
Can an attacker send us such a wallet that will harm us and one day, we suddenly lose all our coins?
If this is the "wallet.dat" file format, is it possible to inject malicious code into this file?

Thanks!

[ranochigo]

Wallet.dat can be modified to show fake addresses to show to the user without the actual private keys being inside. Sending someone your wallet.dat, encrypted or not is never a good idea. It is very much possible for someone to be able to copy your private keys and sipon the funds from your addresses in the future. Whilst there is currently no known vulnerabilities that allows for code execution within the wallet.dat file, I wouldn't trust it too much.

[walletrecovery]

Most importantly, you said that it is impossible to integrate malicious or virus code into the wallet.dat file,
because we were recently sent a wallet that the Bitcoin client program could not open and there was some kind of error.
Therefore, we had a suspicion that this file was sent by a person who wanted to attack us. But now it’s clear that this cannot be done in this way.
Thank you for answering the question. If someone has a different opinion, let me know, please.

[bob123]

Most importantly, you said that it is impossible to integrate malicious or virus code into the wallet.dat file,

No, he didn't say that.
What he actually said was:

Whilst there is currently no known vulnerabilities that allows for code execution within the wallet.dat file, I wouldn't trust it too much.

And this actually is the only correct answer to that question.
Currently, there are no known vulnerabilities. This does NOT mean that there are no vulnerabilities. This just means that there is no vulnerability publicly known.
Every Software has bugs, and bitcoin core most probably too. Whether someone can inject malicious code to be executed, can not be answered with an definite yes or no.

If you are opening a lot of wallet files from different (not trustworthy) people, what you in fact should be doing is to sandbox the application you are opening them with (in this case: bitcoin core).

[walletrecovery]

Yes, for experiments with client files, we need another computer. Now it’s clear, thanks!

[bob123]

Yes, for experiments with client files, we need another computer. Now it’s clear, thanks!

Please not that using another computer doesn't completely solves this problem in case of such a vulnerability in the application.

If (and this is a very big if) it is possible to run code injected through a bitcoin core wallet file, it could compromise your second computer.
The possibility of private keys being stolen from wallets being recovered afterwards on that computer does exist, but is very unlikely.

However, if someone can compromise your computer he might also compromise your whole network.


If you really deal with lots of wallet files in a professional manner, use virtual machines or at least sandbox the application (core).

[walletrecovery]

Yes, but a virus cannot infect a given blockchain database?
If the second computer does not have Internet connection,
and we will connect blockchain database from another HDD?

[ranochigo]

Yes, but a virus cannot infect a given blockchain database?
If the second computer does not have Internet connection,
and we will connect blockchain database from another HDD?

It really doesn't matter where you are running the Bitcoin client. No matter where you load the wallet from, the virus can infect files in another disk even if they are being run from different drives. The best practice is really to santize your computer by reinstalling the OS everytime after you handle a file. It is possible for malware to operate even if its offline.

Just to reiterate my point; it is not foolproof to see if the wallet.dat contains private key to a given address just by loading it into the client. It is still possible to modify the wallet.dat for it to display different addresses without a corresponding private key.

[walletrecovery]

OMG!
Well, if we don’t download wallet.dat to the Bitcoin client, but just upload the data using pywallet.py, can it be that even if we passively read from the file, our computer could be infected?

[bob123]

Well, if we don’t download wallet.dat to the Bitcoin client, but just upload the data using pywallet.py, can it be that even if we passively read from the file, our computer could be infected?

I don't really understand what you are trying to say, but.. if you are not executing the file, you are fine.

What OS are you using?
If you are using linux, as long as you don't execute the file or load it into an application which parses the content, you are fine.
For windows, thats a little bit more tricky. But a general rule is that if you don't actively do stuff with it, you are fine.

Whether or not you are vulnerable using a python script depends on what the script is doing. And in this case the attacker would have to actually target you and the script instead of bitcoin core.


The easiest method is to use a virtual machine. Set it up once, load the file into it, do whatever you want with it, reset the virtual machine. As easy as that.

[walletrecovery]

you all gave very detailed answers, but they are not based on the knowledge of whether there was at least 1 case in 10 years
that someone infected his computer and lost bitcoins only because he opened the wallet.dat wallet file in the client program,
which was contagious. If the answer to this question is zero such cases, then it is still impossible to infect a computer and steal coins in this way.

[Csmiami]

---

But you've already been answered to that; there is no known case YET. A lack of precedent does not mean a lack of vulnerability, so if you fear for your safety, act as if it was possible every time you handle a wallet from unknown sources (aka clients)

[walletrecovery]

Yes, but this does not mean that you need to bring behavior to the point of absurdity.

If you apply your logic, then a brick has never fallen on your head, but this does not mean that this is impossible,
therefore you now always look at the sky every day!

This is absurd, why write about it.

There are principles of working the bitcoin client’s program, and if there’s not a single person who knows the principles "how it's works",
then no one will answer my question the way I need.

Does nobody really know what the wallet client program does with the "wallet.dat" file.

It’s elementary, Watson!

Wallet file is not an executable file type and in principle it cannot infect a computer and steal bitcoins, why doesn’t anyone write about it?

Are there no file system specialists here?

This is just funny guys!

[bob123]

If you apply your logic, then a brick has never fallen on your head, but this does not mean that this is impossible,
therefore you now always look at the sky every day!


This is absurd, why write about it.

Just because you didn't have a car accident yet, it doesn't mean that it is impossible,
therefore you always drive carefully!

You are absurd.

This is absurd, why write about it.

You asked, we answered.

There are principles of working the bitcoin client’s program, and if there’s not a single person who knows the principles "how it's works",
then no one will answer my question the way I need.

If "the way you need" is someone stating "this is impossible", then you will either never find this answer or someone who doesn't know what he is talking about will give you that "answer".
Look it up, how it works. You can find the source code on github.

Wallet file is not an executable file type and in principle it cannot infect a computer and steal bitcoins, why doesn’t anyone write about it?

No one writes that, because it is not true.
PDF files are no executable files, therefore they can't infect your system! (warning: sarcasm)
Image files are no executable files, therefore they can't infect your system! (warning: sarcasm)

Are there no file system specialists here?

What a given software does with a given filetype has nothing to do with the file system.

I wonder how you even dare to call yourself "walletrecovery" with little to no technical knowledge at all.

[LoyceV]

I read the answer to your question a year and a half ago:

As an aside, it is not safe to use potentially malicious wallet.dat files.  Anyone who gets sent a wallet.dat from a third party should take great care in using it. I would not be shocked if it were possible to get arbitrary code execution from a wallet.dat file.  If a bad guy found a way to do that the best way to exploit that discovery would be to pose as someone who corrupted their wallet and encourages people to try to 'scam' them by getting a copy of their wallet or help them with a promise of an outsized reward.

Gmaxwell is a Bitcoin core developer so I assume he knows what he's talking about.

My advice: use a Virtual Machine for this, on an offline system, and "undo" all changes made to the VM after each wallet.

[walletrecovery]

I wonder how you even dare to call yourself "walletrecovery" with little to no technical knowledge at all.
[/quote]

we have a very simple job
we listen to the client and instruct the machine to find the password using the program and video cards.
Now the conversation is not about this and not about philosophy or about accidents when driving a car or crossing a street at a pedestrian crossing or elsewhere.
Be specific in your statements and speak only on the subject matter.
You give an example files with the extension JPG and PDF
Why are you doing this?
We are talking specifically about the wallet program and the wallet.dat file
If you don’t know what the wallet program does with the file, then you don’t have to say everything that comes to your mind, just keep quiet and read what smart people write.

[bob123]

Now the conversation is not about this and not about philosophy or about accidents when driving a car or crossing a street at a pedestrian crossing or elsewhere.

Oh, i forgot. Obviously the conversation is about bricks falling from the sky:

If you apply your logic, then a brick has never fallen on your head, but this does not mean that this is impossible,
therefore you now always look at the sky every day!

You give an example files with the extension JPG and PDF
Why are you doing this?

Because of your (retarded) statement:

Wallet file is not an executable file type and in principle it cannot infect a computer and steal bitcoins

This statement is simply wrong.
Instead of telling you, that you obviously don't have any clue at all, i tried to be sarcastic since almost everyone knows that JPG and PDF files can get your computer compromised.

I apologize for assuming you would be able to do the mental task, understanding that wallet.dat files can do the same - yourself.

So, i'll repeat it for you:
Non-executable files, can get your computer compromised if they are being parsed or otherwise worked with.

[walletrecovery]

Thanks to all.
Let's wait for the person who answers what the wallet program does with the file "wallet.dat" such that it can lead to the loss of coins.
Or if the program is safe and such a scenario is impossible, regardless of what is inside the "wallet.dat" file, then let the smart uncle write about it.
So far, no one has answered this question.

[DaveF]

This statement is simply wrong.
Instead of telling you, that you obviously don't have any clue at all, i tried to be sarcastic since almost everyone knows that JPG and PDF files can get your computer compromised.

I apologize for assuming you would be able to do the mental task, understanding that wallet.dat files can do the same - yourself.

So, i'll repeat it for you:
Non-executable files, can get your computer compromised if they are being parsed or otherwise worked with.

As can word, excel, and others.
However, the flip side of that coin is that it's not the file that is doing the infecting. It's the application running the file.

Yeah, it's a small point but as an example if you send me an infected PDF adobe reader will probably be the target, as will the Microsoft reader. SlimPDF and FoxitPDF Reader will probably not allow the malware to do it's thing. This is not to say that you can't get infected running one of those PDF readers but if the system hooks that the malware authors are looking for are not there then it will not work.

Same with a doc file in Microsoft Word vs. OpenOffice.

You do need both the infected file and the targeted application. Opening up an infected wallet.dat in notepad is not going to cause an issue. If a compromise was found in core it might do something bad.

-Dave

[bob123]

Since walletrecovery seemed quite sketchy to me, i did 5 minutes of research.

It turned out that he is an alt of percenter who has negative trust ratings and a valid flag open against him.

Check this post for more information.


I advise anyone to not deal with this user in any way.