bitcoin icon indicating copy to clipboard operation
bitcoin copied to clipboard

Add warnings or discontinue zip files for Windows and maOS

Open 1440000bytes opened this issue 1 year ago • 1 comments

  1. One issue was shared in https://github.com/bitcoin/bitcoin/pull/27099#issuecomment-1610800583

    Example URL: https://bitcoincore.org∕bin∕bitcoin-core-27.0∕@bitcoin-27.0-win64.zip this will open attackers domain which in this case is bitcoin-27.0-win64.zip

  2. Other issue: https://www.bleepingcomputer.com/news/security/github-comments-abused-to-push-malware-via-microsoft-repo-urls/

    Example URL: https://github.com/bitcoin/bitcoin/files/15049876/bitcoin-27.0-arm64-apple-darwin.zip makes it seem like this zip file is present in this repository

1440000bytes avatar Apr 20 '24 22:04 1440000bytes

  1. Example URL: https://bitcoincore.org∕bin∕bitcoin-core-27.0∕@bitcoin-27.0-win64.zip

The @ is pretty obvious to me. But regardless what can bitcoin core do to protect users who download software from links they find anywhere outside bitcoincore.org ?

Bitcoin core could stop serving releases altogether and replace the entire website with a warning, this .zip attack would be just as effective.

pinheadmz avatar Apr 20 '24 22:04 pinheadmz

I don't have a good solution for this. Maybe warnings or not using zip would have helped.

1440000bytes avatar Apr 21 '24 04:04 1440000bytes