Is the Large Bitcoin Collider malware?

Yesterday, /u/SopaXorzTaker submitted a post to r/Bitcoin suggesting the Large Bitcoin Collider (a.k.a. "LBC", not to be confused with Local Bitcoins) is probably malicious. He did a great service to the community by doing so.

This was the first I'd heard of LBC, although it has apparently received a lot of publicity lately.

I took a look through the source and wrote up my findings (most notably that LBC includes a remote code execution backdoor, but also that it explicitly disables hostname checking of the server's SSL certificate).

Eventually, the creator of LBC, /u/therico666, showed up to defend his software.

LBC attempts to brute-force Bitcoin keys by using a distributed "pool" of users running the software, and then distributing any funds among the pool participants. It is similar in concept to a mining pool except for 2 massive flaws:

1.) The search space is so overwhelmingly large that it will find nothing but weakly-generated keys.
2.) There is no way to do proof of work: it relies on honest clients.

To solve flaw number 2, LBC attempts to ensure that nobody can run a modified client. Part of this includes making the client run any arbitrary code the server sends it. This way the server can send some code snippets that MD5 the script, or do other arbitrary checkings, and if the client doesn't respond with the expected response, it gets blacklisted.

therico666 has remained anonymous. In itself, there is nothing wrong with this. Everybody has a right to remain anonymous online. But if you're shipping software that includes a remote code execution backdoor, and asking people to trust you, you really need to back that up with some reputation.

Given therico666's continued anonymity, and flaw number 1, many people believe that LBC was a trojan horse. That it was not actually trying to brute-force Bitcoin keys, it was just building up an installed base of users, until there is a large enough user base, and then the server would remote-deploy code to sweep up wallet files and send them off to the server. LBC would then steal as much money as it could from the wallet files, and may or may not distribute the funds to pool participants.

The LBC download page now gives lots of warnings about how LBC includes a remote code execution backdoor, although this was notably not present before yesterday's drama.

Also notable is that (despite claims to the contrary), LBC has still not fixed the trivially-easy-to-fix hostname verification vulnerability. At best, this is a level of sloppiness that is inexcusable alongside remote code execution. At worst, this might be a way to claim plausible deniability if LBC is ever shown to have executed malicious code on a user's computer (It wasn't us! It was just a security mistake!).

Finally, many of the techniques used in LBC are strongly reminiscent of techniques used in malware: Verifying the hash of the file. Automatically downloading and installing dependencies without asking for permission. Hiding code snippets in arrays of numbers disguised as "test data", which get decoded and executed later. At a minimum, I would suggest the developers of LBC have prior experience with malware development.

So I won't be running LBC. And neither should you.