Hello all,

The number of incidents involving malware targeting bitcoin users continues to 
rise.  One category of virus I find particularly nasty is when the bitcoin 
address you are trying to send money to is modified before the transaction is 
signed and recorded in the block chain.  This behaviour allows the malware to 
evade two-factor authentication by becoming active only when the bitcoin 
address is entered.  This is very similar to how man-in-the-browser malware 
attack online banking websites.

Out of band transaction verification/signing is one method used with online 
banking to help protect against this.  This can be done in a variety of ways 
with SMS, voice, mobile app or even security tokens.  This video demonstrates 
how HSBC uses a security token to verify transactions online.  

Many Bitcoin wallets and services already use Open Authentication (OATH) based 
one-time passwords (OTP).  Is there any interest (or existing work) in in the 
Bitcoin community adopting the OATH Challenge-Response Algorithm (OCRA) for 
verifying transactions?

I know there are other forms of malware, however, I want to get thoughts on 
this approach as it would involve the use of a decimal representation of the 
bitcoin address (depending on particular application).  In the HSBC example 
(see YouTube video above), this was the last 8 digits of the recipient’s 
account number.  Would it make sense to convert a bitcoin address to decimal 
and then truncate to 8 digits for this purpose?  I understand that truncating 
the number in some way only increases the likelihood for collisions… however, 
would this still be practical or could the malware generate a rogue bitcoin 
address that would produce the same 8 digits of the legitimate bitcoin address?

Brian Erdelyi

Attachment: signature.asc
Description: Message signed with OpenPGP using GPGMail

Dive into the World of Parallel Programming. The Go Parallel Website,
sponsored by Intel and developed in partnership with Slashdot Media, is your
hub for all things parallel software development, from weekly thought
leadership blogs to news, videos, case studies, tutorials and more. Take a
look and join the conversation now. http://goparallel.sourceforge.net/
Bitcoin-development mailing list

Reply via email to