Received-SPF: pass (sog-mx-1.v43.ch3.sourceforge.com: domain of gmail.com
	designates 209.85.216.43 as permitted sender)
	client-ip=209.85.216.43; envelope-from=brian.erdelyi@gmail.com;
	helo=mail-qa0-f43.google.com; 
From: Brian Erdelyi <brian.erdelyi@gmail.com>
Content-Type: multipart/signed;
	boundary="Apple-Mail=_C54F50CA-8B96-4AEA-951B-713510857F83";
	protocol="application/pgp-signature"; micalg=pgp-sha512
Date: Sat, 31 Jan 2015 18:15:53 -0400
Message-Id: <27395C55-CF59-4E65-83CA-73F903272C5F@gmail.com>
To: bitcoin-development@lists.sourceforge.net
Mime-Version: 1.0 (Mac OS X Mail 8.2 \(2070.6\))
Subject: [Bitcoin-development] Proposal to address Bitcoin malware
Precedence: list


--Apple-Mail=_C54F50CA-8B96-4AEA-951B-713510857F83
Content-Type: multipart/alternative;
	boundary="Apple-Mail=_8D6BCAAD-07BE-4D6B-8E28-5FDE3C76084F"


--Apple-Mail=_8D6BCAAD-07BE-4D6B-8E28-5FDE3C76084F
Content-Transfer-Encoding: quoted-printable
Content-Type: text/plain;
	charset=utf-8

Hello all,

The number of incidents involving malware targeting bitcoin users =
continues to rise.  One category of virus I find particularly nasty is =
when the bitcoin address you are trying to send money to is modified =
before the transaction is signed and recorded in the block chain.  This =
behaviour allows the malware to evade two-factor authentication by =
becoming active only when the bitcoin address is entered.  This is very =
similar to how man-in-the-browser malware attack online banking =
websites.

Out of band transaction verification/signing is one method used with =
online banking to help protect against this.  This can be done in a =
variety of ways with SMS, voice, mobile app or even security tokens.  =
This video demonstrates how HSBC uses a security token to verify =
transactions online.  https://www.youtube.com/watch?v=3DSh2Iha88agE =
<https://www.youtube.com/watch?v=3DSh2Iha88agE>.

Many Bitcoin wallets and services already use Open Authentication (OATH) =
based one-time passwords (OTP).  Is there any interest (or existing =
work) in in the Bitcoin community adopting the OATH Challenge-Response =
Algorithm (OCRA) for verifying transactions?

I know there are other forms of malware, however, I want to get thoughts =
on this approach as it would involve the use of a decimal representation =
of the bitcoin address (depending on particular application).  In the =
HSBC example (see YouTube video above), this was the last 8 digits of =
the recipient=E2=80=99s account number.  Would it make sense to convert =
a bitcoin address to decimal and then truncate to 8 digits for this =
purpose?  I understand that truncating the number in some way only =
increases the likelihood for collisions=E2=80=A6 however, would this =
still be practical or could the malware generate a rogue bitcoin address =
that would produce the same 8 digits of the legitimate bitcoin address?

Brian Erdelyi

--Apple-Mail=_8D6BCAAD-07BE-4D6B-8E28-5FDE3C76084F
Content-Transfer-Encoding: quoted-printable
Content-Type: text/html;
	charset=utf-8

<html><head><meta http-equiv=3D"Content-Type" content=3D"text/html =
charset=3Dutf-8"></head><body style=3D"word-wrap: break-word; =
-webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" =
class=3D"">Hello all,<div class=3D""><br class=3D""></div><div =
class=3D"">The number of incidents involving malware targeting bitcoin =
users continues to rise. &nbsp;One category of virus I find particularly =
nasty is when the bitcoin address you are trying to send money to is =
modified before the transaction is signed and recorded in the block =
chain. &nbsp;This behaviour allows the malware to evade two-factor =
authentication by becoming active only when the bitcoin address is =
entered. &nbsp;This is very similar to how man-in-the-browser malware =
attack online banking websites.</div><div class=3D""><br =
class=3D""></div><div class=3D"">Out of band transaction =
verification/signing is one method used with online banking to help =
protect against this. &nbsp;This can be done in a variety of ways with =
SMS, voice, mobile app or even security tokens. &nbsp;This video =
demonstrates how HSBC uses a security token to verify transactions =
online. &nbsp;<a href=3D"https://www.youtube.com/watch?v=3DSh2Iha88agE" =
class=3D"">https://www.youtube.com/watch?v=3DSh2Iha88agE</a>.</div><div =
class=3D""><br class=3D""></div><div class=3D"">Many Bitcoin wallets and =
services already use Open Authentication (OATH) based one-time passwords =
(OTP). &nbsp;Is there any interest (or existing work) in in the Bitcoin =
community adopting the OATH Challenge-Response Algorithm (OCRA) for =
verifying transactions?</div><div class=3D""><br class=3D""></div><div =
class=3D"">I know there are other forms of malware, however, I want to =
get thoughts on this approach as it would involve the use of a decimal =
representation of the bitcoin address (depending on particular =
application). &nbsp;In the HSBC example (see YouTube video above), this =
was the last 8 digits of the recipient=E2=80=99s account number. =
&nbsp;Would it make sense to convert a bitcoin address to decimal and =
then truncate to 8 digits for this purpose? &nbsp;I understand that =
truncating the number in some way only increases the likelihood for =
collisions=E2=80=A6 however, would this still be practical or could the =
malware generate a rogue bitcoin address that would produce the same 8 =
digits of the legitimate bitcoin address?</div><div class=3D""><br =
class=3D""></div><div class=3D"">Brian Erdelyi</div></body></html>=

--Apple-Mail=_8D6BCAAD-07BE-4D6B-8E28-5FDE3C76084F--

--Apple-Mail=_C54F50CA-8B96-4AEA-951B-713510857F83
Content-Transfer-Encoding: 7bit
Content-Disposition: attachment;
	filename=signature.asc
Content-Type: application/pgp-signature;
	name=signature.asc
Content-Description: Message signed with OpenPGP using GPGMail

-----BEGIN PGP SIGNATURE-----
Comment: GPGTools - https://gpgtools.org

iQIcBAEBCgAGBQJUzVQZAAoJEOU8U1lTQFC+2aoP/0Ku/SKhWe9+/BR9cUohee/V
k9j2n2qRkO9FvLdV7a26jVzn48qmK9S3ThCrAPAT8cUKHZMKemMJsB9WjSgMxTwF
nsrJx61TK5Ks+ACyUOd1U9YBWtCqteDwhHUZDCea9Fq90nY8Cx1nKTDp9BAzVRSh
7ZBXEebOM1yN8dsnt0AfS/FtIigBZqUCHWN1BZ8c800CTcTa9EwUsex6N9f9uM24
YXh4a+fl3g98MQjUriZd2MRswx/qTJpVbc25+vccP+2lcBnqAQ/j2Pj0xCDrCb0B
jmpyghocBsdWMAAtthW4Cm/MLUrDlunBzmFNyzltr/C3xig58zv1UaMgPkXUrjTc
7A1SXliGSTzEhKu6e/rD9O6NEaA2R1I6q6Wi8inyDkcxT8YV0D+kjSaSOF4OtksJ
3iAOvAT5b5vh+LNh1mOhfNF19nVjRIvObjjF+XBu1xAKeXuA5Ub3kVof4IWjmMJG
zXSj7Q0bs1loKRU2KhE09X3IHuJrImtAWAyXsHcu78Q9iAn6QhUSAK19IHVN9ra2
3jW57bjhKV1GcP2Lz5364YE/3sJubfjfUKPslgxVO1eZjqtT8lEBPuMuhyb9Mpjk
h+X9rGWgmlx+FNy7M0Kc/B+5jmaprnBP0Uw+b1sbpfVE7We15u6RN6IK84tFa6CG
XZoVRGKBU6kA7aZ2CCbK
=o89+
-----END PGP SIGNATURE-----

--Apple-Mail=_C54F50CA-8B96-4AEA-951B-713510857F83--