3

Bitcoin QT, being a Linux application, is updated regularly when the application in the repository is being updated (For example, apt-get upgrade on Debian).

Theoretically, if a hacker could get into some Linux repository, he could replace the application with a malicious one that steals both the private key and the wallet file and send it to a remote server (effectively stealing all the Bitcoins from most the users). If possible, even through social engineering, the incentive for such hack is enormous.

How likely/unlikely that to happen?

Improve this question
2

Software distributors typically have authentication mechanisms to prevent an attacker from inserting malicious versions of their software.

In the case of Debian and its derivatives, there are two steps.

  • The binaries and data for bitcoin-qt are distributed as a .deb file. A cryptographic hash (currently md5, sha1 and sha256) of this file is contained in the Packages list that apt-get uses to determine which packages are available. If an attacker modifies the .deb file, say by breaking into one of the Debian mirror servers, the hash will not match and apt-get will refuse to install the package.

  • The Packages file is also distributed by the same servers, so an attacker could modify it so that the hash listed there matches the malicious .deb. However, the Packages file is accompanied by a signature produced with Debian's master private key, so this signature would not match and apt-get would refuse to proceed.

Thus in order to pull this off, the attacker would not only have to get access to a Debian mirror server, but also to the Debian master signing key, which should be well protected.

Improve this answer
2
  • What if the bitcoin-qt package manager is the attacker? – unor Dec 4 '13 at 17:52
  • @unor: Then you're in trouble. Part of using a distribution is trusting the people who distribute it. – Nate Eldredge Dec 4 '13 at 18:15
4

You know you don't have to trust the repo. The developers of Bitcoin-QT actually recommend using their binaries rather than the distro's. So you can just keep up to date with those. Official binaries are signed with a Bitcoin-QT developer's PGP keys.

Improve this answer
0

You need ONLY private key to steal the money - you don't need wallet.dat file

Yes it's possible to do BUT it's easier and most profitable to break in any exchange or pool site and steal a loot more in one go

Improve this answer
1
  • When Bitcoins are in an exchange people usually understand that there is a certain risk. However, I believe that most people assume that their Bitcoins are safe when stored on their local machine. – Elad Dec 1 '13 at 12:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.