BitShares Forum

Main => General Discussion => Topic started by: toast on October 26, 2014, 08:22:22 pm

Title: WARNING: Do not download BTSX client from non-https website.
Post by: toast on October 26, 2014, 08:22:22 pm
edit:   False alarm. But warnings in this post are still true of course.

I've been warning DSL about this and it looks like it might have happened...

We have reason to suspect that there is a malicious BTSX client being injected when people try to download from the the non-https version of bitshares-x.info.

Legit versions with hashes (still not signed by DSL but w/e at least github should be secure):  https://github.com/dacsunlimited/bitsharesx/releases

Until DSL fixes it to automatically use https, always type it explicitly:
https://bitshares-x.info

Will update when I have more info.
Title: Re: WARNING: Do not download BTSX client from non-https website.
Post by: xeroc on October 26, 2014, 08:32:23 pm
At least we have a confirmation that BitShares is worth hacking malware into the code .. nice and sad at the same time
Title: Re: WARNING: Do not download BTSX client from non-https website.
Post by: arhag on October 26, 2014, 08:37:21 pm
Quote from: toast on October 26, 2014, 08:22:22 pm
We have reason to suspect that there is a malicious BTSX client being injected when people try to download from the the non-https version of bitshares-x.info.

Wow! That would require someone to actually be attempting man-in-the-middle attacks on the users who are downloading from bitshares-x.info. That is pretty amazing if true, since it would be quite a bit of effort for someone to go through to attack BitShares users (BitShares is getting people's attention :) ).


I don't know how much you guys are prioritizing security features internally, but I think they are really important. We still don't have:

These three features are more important to me than voting, on-ramps, or even lightweight clients.
Title: Re: WARNING: Do not download BTSX client from non-https website.
Post by: toast on October 26, 2014, 08:48:10 pm
False alarm. But warnings in OP are still true of course.
Title: Re: WARNING: Do not download BTSX client from non-https website.
Post by: mf-tzo on October 26, 2014, 08:57:37 pm
Quote
don't know how much you guys are prioritizing security features internally, but I think they are really important. We still don't have:
Ability to sign and verify messages using TITAN accounts from the GUI client.
Cold storage with offline transaction signing. I should be able to create a transaction and generate the bundle of all data necessary from my hot client, store it on a flash drive, move it over to another offline computer running a live Linux environment, get the cold client to sign the transaction and store it back on the flash drive, take it back to the hot client and have it broadcast the transaction to the network.
Usable multisig. Not just escrows, but also something like this and this.

These three features are more important to me than voting, on-ramps, or even lightweight clients.

Security for me is as well the most important thing than anything else...
Title: Re: WARNING: Do not download BTSX client from non-https website.
Post by: sudo on October 27, 2014, 03:09:34 am
if it's possible to   embedd the bts  client HASHcode to the BTS blockchain & selftest when it runs?
Title: Re: WARNING: Do not download BTSX client from non-https website.
Post by: bytemaster on October 27, 2014, 03:40:12 am
Quote from: sudo on October 27, 2014, 03:09:34 am
if it's possible to   embedd the bts  client HASHcode to the BTS blockchain & selftest when it runs?

The attacker binary would skip the self test and report it success.
Title: Re: WARNING: Do not download BTSX client from non-https website.
Post by: DACSunlimited on October 27, 2014, 07:29:26 am
Quote from: toast on October 26, 2014, 08:22:22 pm
edit:   False alarm. But warnings in this post are still true of course.

I've been warning DSL about this and it looks like it might have happened...

We have reason to suspect that there is a malicious BTSX client being injected when people try to download from the the non-https version of bitshares-x.info.

Legit versions with hashes (still not signed by DSL but w/e at least github should be secure):  https://github.com/dacsunlimited/bitsharesx/releases

Until DSL fixes it to automatically use https, always type it explicitly:
https://bitshares-x.info

Will update when I have more info.

Fixed automatically rewrite to https.
Drop us a mail will be the fastest way if emergency, thanks.