The Defunct Bitcoin SourceForge Project Was Hacked
A Phoronix reader reported in about this hack and also pointed to a Reddit thread about the Bitcoin SourceForge project being hijacked, which fortunately is no longer the project's main resource and was largely unused. Perhaps of more interest is the compromising of the original Satoshi GMX email account, where the hacker(s) are allegedly in possession of private emails and the IP addresses of Satoshi.
Here's the run-down commentary as reported by an anonymous Phoronix reader:
Bitcoin project page on SourceForge has been hacked and Satoshi's e-mail has been overtaked by hackers.
The root cause appears to be some hackers managed to get unauthorized access to [email protected] e-mail. This includes some private mails, etc. Supposedly, attackers managed to get some real IP address of Satoshi and detect person who can be actually in charge of this account.
As proof, there is screen of hacked mailbox floats around: http://i.imgur.com/lfCJeBI.png
Note that it appears that hackers were not so good at hiding data - you can actually recover order details using graphic editor, see some attempt of unknown author at http://i4.minus.com/irnGKpHut0KQu.png.
Mitigation:
1) Downloads of BitCoin clients should only be made from bitcoin.org - SourceForge page still being controlled by hackers, users should not trust content from SF.net page of Bitcoin project! Page has been vandalized already - see http://mineforeman.com/2014/09/09/warning-do-not-download-bitcoin-from-sourceforge/ and it is possible downloads could be eventually replaced by some malware.
2) Messages from Satoshi should only considered to be valid if they have proper digital signature. Otherwise it is possible mail has been sent by impostors controlling satoshi mailbox.
3) bitcointalk.org, bitcoin.org and GitHub were not related to [email protected] and therefore were not affected by this break-in.
9 Comments
