I think you people are missing the point...

This post contains a destructive virus.  You can execute it by following these malicious instructions:

Smash your computer with a hammer.

I could also burn these instructions onto a wall in the BitShares blockchain, but that wouldn't give me any way to make people execute it.

Quote from: merockstar on May 10, 2015, 09:24:26 PM
i dont understand.

you're saying that code can be run from a blockchain just by downloading it from a legit client?

if it's not a legit client, then whats to stop it from being a bitcoin wallet or a paypal phish site or something?

it seems like a general computing problem thats been known for decades...

The issue is if you write a client which parses unstructured data from the blockchain and interprets it in then you can exploit bugs in the software interpreting it.

Yes I'll throw in 10,000 BTS towards bounty. This is an issue that should be taken care of, if not already addressed....and not taken lightly. If we are going to ask people to put in their hard earned money and wealth into this system, it better be damn well secured from something as trivial as this. Obviously the wallet/client is the weak link, not something embedded in the block chain.


Sent from my iPhone using Tapatalk

i dont understand.

you're saying that code can be run from a blockchain just by downloading it from a legit client?

if it's not a legit client, then whats to stop it from being a bitcoin wallet or a paypal phish site or something?

it seems like a general computing problem thats been known for decades...

Ok, so just to make my paranoid ass feel better..
Can we at least add a simple trap for a few characters that all executables would require to be run?

We used to trap for slashes (\), quotes (" and ') and certain sql stmnts (INSERT INTO, DROP TABLE, etc) back in the day. Just disallow the few characters that all scripts would require if someone was to try the injection.

Governments and other malicious types would just love to snag our coin.

I take this stuff VERY seriously. Our hard earned money is at stake here. No matter how small it may seem, it never hurts to code another trap.
FAILsafe.

Edit: I'll throw in another 10,000 BTS bounty to have that trap coded in.
Get it done (and provable) within v0.10.0 and I'll make it a 30,000 BTS bounty. Anybody else wanna pitch in?

I think that can be compared to catching a virus over mail. In the past ou could be infected just by opening mails since javascript would execute automatically.

But now it doesn't so you don't get. It's the same thing. The malicious thing could be there, but doesn't execute so it shouldn't be a problem.

Quote from: kenCode on May 10, 2015, 08:12:32 PM
So, let's assume worst case scenario, someone downloads an infected BTS wallet from somewhere.

Assume someone downloads a virus. They could then use that to download a different virus and run it (this one happened to be stored on a blockchain instead of dropbox)

.. this leads to the old issue: can you trust the source that delivers software to not deliver malware instead ..

You can write arbitrary text and base64 encoded binary blobs on every account wall ..

If you have a client that executes that code you can do whatever you want .. i acctually sounds like a nice "feature" too

Quote from: toast on May 10, 2015, 07:56:54 PM
He describes how to put executable code into the blockchain but not how to execute it. In other news, you can send viruses over email..

The wallet or downloadable app can be instructed to execute anything.
So, let's assume worst case scenario, someone downloads an infected BTS wallet from somewhere.
It executes the rpc (or whatever) and BAMM! -there goes your BTS.

FOUND IT: http://bitcoinist.net/kaspersky-labs-interpol-blockchain-vulnerable/

He mentions that as a proof of concept, they injected the code, ran it, and just had it open up Notepad. But, they could have done something much more sinister.

Do we have the same 80byte hole?
Can we trap for malicious injections into it?

He describes how to put executable code into the blockchain but not how to execute it. In other news, you can send viruses over email..

Quote from: xeroc ¯\_(ツ)_/¯ on May 10, 2015, 07:50:07 PM
Whats the tl;dl; version of the "bug"?

I'm not sure, but fyrstikken is a smart guy and he doesn't put out bs. His quatloo trader is how I first discovered him.
Do you think that bug is legit? Does the BTS blockchain have this same 80bytes hole?
We need to code in a trap, or "sql-injection" style Else condition or something if what he says is legit.
Please advise, thanx-
ken

Whats the tl;dl; version of the "bug"?

fyrstikken has an interesting 6min post up- any validity to this?

URGENT! Bitcoin Flaws Malware & Viruses #Bitcoinbleed
https://www.youtube.com/watch?v=1XfXYiQQSlE