Received-SPF: pass (sog-mx-4.v43.ch3.sourceforge.com: domain of gmail.com
	designates 209.85.216.172 as permitted sender)
	client-ip=209.85.216.172; envelope-from=brian.erdelyi@gmail.com;
	helo=mail-qc0-f172.google.com; 
Content-Type: multipart/alternative;
	boundary="Apple-Mail=_4DDEA5CE-C5E8-4855-8FF4-4D678FA003D0"
Mime-Version: 1.0 (Mac OS X Mail 8.2 \(2070.6\))
From: Brian Erdelyi <brian.erdelyi@gmail.com>
In-Reply-To: <CAAt2M18kRgJeNGu9GeKabRpTKPX9rVeoYiKoanz99bmV2jaf4w@mail.gmail.com>
Date: Sat, 31 Jan 2015 19:04:57 -0400
Message-Id: <1348028F-26F8-42CB-9859-C9CB751BF0C9@gmail.com>
References: <27395C55-CF59-4E65-83CA-73F903272C5F@gmail.com>
	<CAAt2M18kRgJeNGu9GeKabRpTKPX9rVeoYiKoanz99bmV2jaf4w@mail.gmail.com>
To: Natanael <natanael.l@gmail.com>
Cc: bitcoin-development@lists.sourceforge.net
Subject: Re: [Bitcoin-development] Proposal to address Bitcoin malware
Precedence: list


--Apple-Mail=_4DDEA5CE-C5E8-4855-8FF4-4D678FA003D0
Content-Transfer-Encoding: quoted-printable
Content-Type: text/plain;
	charset=us-ascii

> See vanitygen. Yes, 8 characters can be brute forced.
>=20

Thank you for this reference.  Interesting to see that there is a tool =
to generate a vanity bitcoin address.

I am still researching viruses that are designed to manipulate a bitcoin =
address.  I suspect they are primitive in that they use a hardcoded =
rogue bitcoin address as opposed to dynamically generating one.

As a start, this would help protect against malware that uses a static =
rogue bitcoin address.  The next thing would be for the malware to =
brute-force the legitimate bitcoin address and generate a rogue bitcoin =
address that would produce the same 8 digit code.  Curious to know how =
long this brute force would take?  Or perhaps, before converting to 8 =
digits there is some other hashing function that is performed.

Brian Erdelyi=

--Apple-Mail=_4DDEA5CE-C5E8-4855-8FF4-4D678FA003D0
Content-Transfer-Encoding: quoted-printable
Content-Type: text/html;
	charset=us-ascii

<html><head><meta http-equiv=3D"Content-Type" content=3D"text/html =
charset=3Dus-ascii"></head><body style=3D"word-wrap: break-word; =
-webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" =
class=3D""><div class=3D""><div><blockquote type=3D"cite" class=3D""><p =
dir=3D"ltr" class=3D"">See vanitygen. Yes, 8 characters can be brute =
forced.</p></blockquote><div><br class=3D""></div><div>Thank you for =
this reference. &nbsp;Interesting to see that there is a tool to =
generate a vanity bitcoin address.</div><div><br class=3D""></div><div>I =
am still researching viruses that are designed to manipulate a bitcoin =
address. &nbsp;I suspect they are primitive in that they use a hardcoded =
rogue bitcoin address as opposed to dynamically generating =
one.</div><div><br class=3D""></div><div>As a start, this would help =
protect against malware that uses a static rogue bitcoin address. =
&nbsp;The next thing would be for the malware to brute-force the =
legitimate bitcoin address and generate a rogue bitcoin address that =
would produce the same 8 digit code. &nbsp;Curious to know how long this =
brute force would take? &nbsp;Or perhaps, before converting to 8 digits =
there is some other hashing function that is performed.</div><br =
class=3D""></div><div>Brian Erdelyi</div></div></body></html>=

--Apple-Mail=_4DDEA5CE-C5E8-4855-8FF4-4D678FA003D0--