Linux Virtual Machine for Windows Bitcoin Users

[matt.collier]

Windows is not a secure environment for running the Bitcoin client.  Malware has already been crafted to steal the target's bitcoin wallet.  By running the bitcoin client inside a Virtual Machine, malware will have a very difficult time accessing your wallet file.

I have created a VirtualBox Virtual Machine (VM) image designed for Windows users of Bitcoin.  The VM is based on Tiny Core Linux and the Bitcoin client version 0.3.21.

This project is now part of the Bitcoin Commons.  Please refer to the project page for up-to-date information.

http://bitcoinvm.bitcoincommons.org

Forum:

http://bitcoincommons.org/phpBB3/viewforum.php?f=11

[1714056043]

1714056043

[1714056043]

1714056043

[mcqueenorama]

Resize it and republish it.  It sounds like it would be very good to have around.

[PLATO]

Why should I trust your VM? For all I know you included a cron job to send my coins to your address.

edit: also heads up recent news says Dropbox doesn't securely encrypt anything

[error]

Why should I trust your VM? For all I know you included a cron job to send my coins to your address.

Such a thing would be very easy to spot.

[PLATO]

Sure. But I imagine that there is a lot of room in a VM to hide a nefarious program that's less detectable than a cron job.

[error]

Sure. But I imagine that there is a lot of room in a VM to hide a nefarious program that's less detectable than a cron job.

The last time I built a virtual machine I also provided instructions (provided by a third party!) on how to verify the integrity of the installed software.

[PLATO]

Nice. I should point out that I'm just playing devils advocate here, there are many forum members who are more trusting than they probably should be, and we will (eventually) see targeted attacks on these gullible ones.

[matt.collier]

The image for tinyCore Bitcoin v 0.1.2 is now online.

@Plato, I certainly appreciate the point of view you have expressed.  My intention is to provide a construction kit for those who are interested in building their own environment.  Anybody want to help with this?

My number one priority at the moment is to get the encrypted file system working.  I'm using cryptosetup using these instructions.  I've successfully created the partition and encrypted file system, but so far I haven't been able to figure out how to get it to mount on boot.  Anybody want to help with this?

[cypherdoc]

Why should I trust your VM? For all I know you included a cron job to send my coins to your address.

edit: also heads up recent news says Dropbox doesn't securely encrypt anything

link please.

[foo]

Why should I trust your VM? For all I know you included a cron job to send my coins to your address.

edit: also heads up recent news says Dropbox doesn't securely encrypt anything

link please.

http://tirania.org/blog/archive/2011/Apr-19.html

[matt.collier]

Great information!  Here is the Dropbox Security Overview included with the terms of service.

Note this relevant suggestion:

How to Add Your Own Layer of Encryption to Dropbox
Dropbox does not discriminate between the types of files stored in your Dropbox nor the applications used to open those files. This means you can use your own software encryption methods, such as third-party encryption software, to keep your files secure on your terms.

[matt.collier]

This project is now part of the Bitcoin Commons.  Please refer to the project page for up-to-date information.

http://bitcoinvm.bitcoincommons.org

Forum:

http://bitcoincommons.org/phpBB3/viewforum.php?f=11

[luv2drnkbr]

Meh all this is too complicated.  I'm just going to write a batch script to unrar my wallet and then a few seconds after the bitcoin client is closed, re-rar (with a password) the wallet file.  I'm not a programmer, but I think I can make something like that that would work behind the scenes without me even noticing.  I still have the bulk of my btc in a "savings account" wallet that is encrypted with TC and in multiple locations.  But you're right, I should still have my main use wallet encrypted, just in case.

[Alex Beckenham]

Sure. But I imagine that there is a lot of room in a VM to hide a nefarious program that's less detectable than a cron job.

In addition, regular Windows users may never have even heard of cron jobs.

[matt.collier]

This project is now part of the Bitcoin Commons.  Please refer to the project page for up-to-date information.

http://bitcoinvm.bitcoincommons.org

Forum:

http://bitcoincommons.org/phpBB3/viewforum.php?f=11

[kloinko1n]

I have created a VirtualBox Virtual Machine (VM) image designed for Windows users of Bitcoin.  The VM is based on Tiny Core Linux and the Bitcoin client version 0.3.21.

Wow, very nice!
Do you have a list of instructions to set up an identical copy of this Tiny Core Linux Bitcoin client?
I would like to install one for my QEMU Virtual Machine Manager.
When finished, I can also upload a copy.

[kloinko1n]

Oops sorry, I read past that passage where you said that instructions to set up our own are forthcoming.

[matt.collier]

This project is now part of the Bitcoin Commons.  Please refer to the project page for up-to-date information.

http://bitcoinvm.bitcoincommons.org

Forum:

http://bitcoincommons.org/phpBB3/viewforum.php?f=11

[kloinko1n]

...Here's what I did:
Code:

Wow, thanks for the update! I had already finished installing a tinycore linux in a KVM VM and was going to study the install process of bitcoin.
Now I will just follow your script and see what comes out.
Great! 

[kloinko1n]

Code:

sudo nano chmod +x bitcoin
sudo nano chmod +x bitcoind

I am quite sure you meant:

Code:

sudo chmod +x bitcoin
sudo chmod +x bitcoind

[matt.collier]

You are correct!  Just seeing if you were paying attention.  Thank you, I'll correct the original.

[kloinko1n]

Just seeing if you were paying attention.

Yeah, right! 

Next, alter the xorg.conf for use with VirtualBox

Code:

sudo nano /etc/X11/xorg.conf

Following your steps, in my setup there is no /etc/X11/ , let alone a /etc/X11/xorg.conf .
But that doesn't matter, it seems to work: At startup the bitcoin window opened and an address (bitcoin account) was already generated.

That option 'generate bitcoins', does it use a possible graphics card, if available? (Let me guess: NO)

[matt.collier]

This project is now part of the Bitcoin Commons

http://bitcoinvm.bitcoincommons.org

Forum:

http://bitcoincommons.org/phpBB3/viewforum.php?f=11

[matt.collier]

Following your steps, in my setup there is no /etc/X11/ , let alone a /etc/X11/xorg.conf .
But that doesn't matter, it seems to work: At startup the bitcoin window opened and an address (bitcoin account) was already generated.

That option 'generate bitcoins', does it use a possible graphics card, if available? (Let me guess: NO)

That doesn't sound good.  Let's continue this discussion on the new forum: http://bitcoincommons.org/phpBB3/viewforum.php?f=11

Regarding 'generate bitcoins', that feature does not support GPUs and that option is being removed from the GUI in the next release.

[kloinko1n]

Let's continue this discussion on the new forum: http://bitcoincommons.org/phpBB3/viewforum.php?f=11

Ok, so I follow that link, then click on 'Jump to BitcoinVM' and get: "The forum you selected does not exist." 

[kloinko1n]

Let's continue this discussion on the new forum: http://bitcoincommons.org/phpBB3/viewforum.php?f=11

Ok, so I follow that link, then click on 'Jump to BitcoinVM' and get: "The forum you selected does not exist." 

Oops, forget that, following the other link, then click on the 'forum' tab, brings me there. 

[box0211]

what ever happen to this project? is there a newer VM image out there for this kind of setup?

[TheFootMan]

what ever happen to this project? is there a newer VM image out there for this kind of setup?

I think it could be smart to set up your own, or install a linux installation from scratch. After all, you would need to trust the individual that created the VM-image if you were to run it and using bitcoin on it.

On the other hand, you'd have to trust that the OS you install is safe in itself as well..

Personally I'd go for the last option (fresh install).

[ArticMine]

How does this deal with key logging malware on the Windows host? The malware will have access to the the login credentials of the GNU/Linux guest so encrypting the /home partition on the GNU/Linux guest will not help. The malware will also have access to any passwords typed into the guest for example to decrypt a Bitcoin wallet.

The proper solution here is to run GNU/Linux as the host and Windows as the guest. This avoids the risk above but also has the advantage of minimizing the risk of the Windows guest getting infected as high risk activities such as email, web browsing etc can be run on the much less vulnerable, by several orders of magnitude, GNU/Linux host or for the truly paranoid on a separate GNU/Linux VM.

[joesmoe2012]

It only takes literally 10 minutes to install ubuntu on a VM and setup bitcoind, you'd probably be much better doing that tthan using a pre-made VM unless someone has audited the code.

[TheFootMan]

How does this deal with key logging malware on the Windows host? The malware will have access to the the login credentials of the GNU/Linux guest so encrypting the /home partition on the GNU/Linux guest will not help. The malware will also have access to any passwords typed into the guest for example to decrypt a Bitcoin wallet.

The proper solution here is to run GNU/Linux as the host and Windows as the guest. This avoids the risk above but also has the advantage of minimizing the risk of the Windows guest getting infected as high risk activities such as email, web browsing etc can be run on the much less vulnerable, by several orders of magnitude, GNU/Linux host or for the truly paranoid on a separate GNU/Linux VM.

Most malware won't be able to get into a VM by default. When typing in a password, you could also use cut and paste for instance. If you cut and paste from keypassx within the VM for instance, there's no keylogger that will catch that. Another confusion techniques could be to use a virtual keyboard on screen, or mixup the typing:

This is^b^b^b is the45^b^b pa55phrase^left^left^left^left^left^left^left^left^left[del][del]s^bss

You get the idea.

[wolverine5pl]

I got hacked yesterday.  Hope you burn in hell.  But as noobie was matter of time.  So now I'm either thinking about using mac os as wallet holder as i have spare one or use vm with linux which is easy to do from scratch.  Or raspberry pi.

[Error404]

I agree that bitcoin was making it software that can be installed in windows because using browser may it hacks by people who had a bad intention about gaining money using hacking others account But it not be a simple because making a software was too hard they need a programmer