9

Suddenly:

The Bitcoin Foundation is giving back to the community! We want to support our users who have helped us along the years. Send Bitcoin to this address, and we will send double the amount in return!

https://bitcoin.org/

Obvious scam. The main Bitcoin website has been compromised.

I'm immediately removing every single instance of "bitcoin.org" in my code, in particular the scripts that check for new updates of Bitcoin Core and AUTO DOWNLOAD/INSTALL them after verifying the signatures which it also gets from the same domain...

Sorry, but this is like a cold shower. I never thought that this of all sites would get compromised. Now I cannot trust anything or anyone. If they can host such an obvious scam message, they can host modified EXEs and cryptographic signature files... Sigh.

How is this possible? What happened to allow for this?

Improve this question
7
  • 4
    You're verifying signatures, right? Not just checking hashes like MD5 or SHA1?
    – Peter Cordes
    Commented Sep 24, 2021 at 1:17
  • 2
    If I tell you how bitcoin.org can be hacked, then you will be able to hack it so I'm not telling you ;p
    – akostadinov
    Commented Sep 24, 2021 at 10:10
  • That might be a joke? Looks a little too obvious. A more plausible scam attempt may've been something like a donation-request.
    – Nat
    Commented Sep 24, 2021 at 19:08
  • 2
    It's very confusing that this question states that "bitcoin.org" is the "main bitcoin website". It says right on the site: Bitcoin.org is not Bitcoin's official website
    – Fattie
    Commented Sep 25, 2021 at 15:02
  • 1
    FWIW, Stack Overflow were also hacked in 2019...
    – Andrew T.
    Commented Sep 25, 2021 at 15:41

4 Answers 4

Reset to default
23

How is this possible? What happened to allow for this?

The same way that any website can be hacked. Bitcoin.org isn't hosted in some special way that makes it unhackable, it's a website, like every other website. As such, it can be hacked in all of those ways, including, but not limited to: web server compromise, DNS server/account compromise, registrar account compromise, etc.

It is probably that either the server hosting the website was compromised in some form (weak password, compromised SSH key, etc.) or the cloudflare account which is providing DDoS protection was compromised (weak password, support social engineered, etc.) and the settings changed to point to the attacker's server.

in particular the scripts that check for new updates of Bitcoin Core and AUTO DOWNLOAD/INSTALL

Bitcoin Core is no longer being uploaded to bitcoin.org anyways, at least not by the release maintainer. Bitcoin Core's official website is https://bitcoincore.org and you should be getting your binaries from there. AFAIK, the owner of bitcoin.org still mirrors the binaries on bitcoin.org, but it is no longer the official place for Bitcoin Core binaries.

them after verifying the signatures which it also gets from the same domain...

As long as the signatures verify and were created with keys that you trust (presumably you got those keys from somewhere else and did some verification of them), then the binaries downloaded should be fine. This is, after all, the point of having signatures. An attacker who has taken over the website will be unable to create a valid signature with the release key(s) unless they have also compromised those.

For 22.0+, you can also check that the binary's hashes match what the guix builders have built by checking the hashes and signatures in https://github.com/bitcoin-core/guix.sigs (with the new guix process, the signatures over the hashes actually comes from the guix builders too). For 0.21 and earlier, you can do the same check with the gitian signatures: https://github.com/bitcoin-core/gitian.sigs.

Improve this answer
11

There are no websites that represent bitcoin, as bitcoin is decentralised.

bitcoin.org is owned by a person and is a site that gives information about bitcoin, as many other sites do, and there is no particular connection between the security of the bitcoin.org domain name and the security of bitcoin software clients.

Improve this answer
2
  • Specifically to address in the OP: "The main Bitcoin website has been compromised." However bitcoincore.org apparently is the "reference implementation"?
    – qwr
    Commented Sep 23, 2021 at 21:22
  • 2
    bitcoincore.org is the website that gives information about the Bitcoin Core client. Bitcoin Core is the most used implementation. There are other bitcoin implementations. The design of the other implementations may be different, however the consensus rules they abide by are the same (to stay in consensus). Other implementations are not more or less important. Personally, I think the term "reference implementation" that is suggesting that Bitcoin Core is the only "correct" client is an improper characterisation. All implementations that abide by the consensus rules are correct.
    – stackaccount
    Commented Sep 24, 2021 at 2:28
10

I'm immediately removing every single instance of "bitcoin.org" in my code, in particular the scripts that check for new updates of Bitcoin Core and AUTO DOWNLOAD/INSTALL them after verifying the signatures which it also gets from the same domain...

No version of Bitcoin Core has ever has any contact with bitcoin.org, no version checking, no manual or automatic updates. If you have made these tools yourself and decided to add it as a trusted source for anything in particular, that is your security risk to deal with and nobody else's.

If they can host such an obvious scam message, they can host modified EXEs and cryptographic signature files... Sigh.

Well no, the point of cryptographic signatures is expressly to prevent this situation. Someone replacing the binaries can not produce valid signatures for the keys used previously.

Improve this answer
0

Sometimes it's as easy as calling the registrar or host and pretending to be the owner of the domain, almost like how attackers do SIM swaps. Hopefully most hosts and registrars are better at protecting against this type of social engineering attack these days as it has become more common.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.