bitcoin
bitcoin copied to clipboard
Add warnings or discontinue zip files for Windows and maOS
-
One issue was shared in https://github.com/bitcoin/bitcoin/pull/27099#issuecomment-1610800583
Example URL: https://bitcoincore.org∕bin∕bitcoin-core-27.0∕@bitcoin-27.0-win64.zip this will open attackers domain which in this case is
bitcoin-27.0-win64.zip -
Other issue: https://www.bleepingcomputer.com/news/security/github-comments-abused-to-push-malware-via-microsoft-repo-urls/
Example URL: https://github.com/bitcoin/bitcoin/files/15049876/bitcoin-27.0-arm64-apple-darwin.zip makes it seem like this zip file is present in this repository
The @ is pretty obvious to me. But regardless what can bitcoin core do to protect users who download software from links they find anywhere outside bitcoincore.org ?
Bitcoin core could stop serving releases altogether and replace the entire website with a warning, this .zip attack would be just as effective.
I don't have a good solution for this. Maybe warnings or not using zip would have helped.