Are virus signatures a serious threat to the bitcoin network?

5

I read this in a forum post on another site. Here's my recap. But by "I" I mean me, not the original poster.

All transactions over the bitcoin network is stored as raw data forever in the distributed database (all bitcoin clients has the same copy of the database .. and if they lose by, e.g. by reinstalling the client, they'll synchronize with the distributed one again).

You can "inject" whatever 20 byte binary strings you want into the flat files (described here http://pastebin.com/ct2WHUK5 ). I'm pretty sure there are other ways to do it as well (apparently you can add text messages to transactions?.. I don't really know).

Now, here's my question. What'd happen if the bitcoin database were flooded with virus signatures? Is this a serious matter or just a "Meh"?

user3493746

Posted 2014-04-03T13:41:18.117

Reputation: 71

1An interesting question. I don't think it would be a "threat to the network" as such, but could be an annoyance and something to discourage new users. It also highlights the shortcomings of signature-based virus scanning. – Nate Eldredge – 2014-04-03T14:11:30.040

This is interesting, but looking into blockchain.info, it seems that nobody sent anything to these addresses (yet). And these could just be perfectly valid bitcoin addresses belonging to the author of the post. I wouldn't try it with my BTC anyway. – G B – 2014-04-03T14:58:50.200

check the blockchain. its quite disturbing what you will find. anything from pedofilia links, death threats, virus signatures, spam etc. – r3wt – 2014-04-03T16:10:44.950

But how would the author be able to 'own' zero-padded virus signatures as his/her own? – user3493746 – 2014-04-03T16:15:08.457

http://www.reddit.com/r/Bitcoin/comments/22a1te/alert_windows_defender_detects_dakuma1935_virus/ – John T – 2014-04-05T17:21:39.390

Answers

2

The pastebin you linked describes the harm caused as follows:

What'll happen is that that will trigger the anti-virus program for every bitcoin client user that has an anti-virus program installed (and this won't go away ever.. you can't clean the database). Those virus signatures are harmless in their own, but they are something that anti-virus program use to recognize viruses. The anti-virus programs will think that the local bitcoin database is infected.

If a transaction manages to trigger an anti-virus alert for someone, I'd blame it on the anti-virus program being badly designed.

Yes it will probably be annoying for a bunch of users but Bitcoin already has a strict enough rule set to make this hard to happen. 20 bytes isn't a lot, for most computers, a single standard word character is 1 byte. If a virus program goes around looking for suspicious data that is 20 bytes long they will run into a lot of false positives. And I doubt that there is any seriously dangerous virus that is under 20 bytes in size.

TL;DR

It's very hard to pull off anything harmful, you will need to develop a virus that only takes up <20 bytes and can destroy a system. Otherwise anti-virus programs would show you a warning that you can possibly close/ignore, it's up to the anti-virus programs to be smart enough to discern.

John T

Posted 2014-04-03T13:41:18.117

Reputation: 2 759

Asked: 2014-04-03T13:41:18.117

Viewed: 179 times

Active: 2014-05-05T19:49:28.693