kramerc

Not for "GitHub Pages sites created after June 15, 2016 and using a github.io domain."[1]

[1] https://help.github.com/articles/securing-your-github-pages-...

I have used Titanium Backup to restore Google Authenticator and Battle.net Mobile Authenticator onto a different device and both apps have retained my accounts with no problem at all. So yes, you are correct in assuming that you can restore OTP generators from backups.

The code is written in LiveCode. According to the documentation, those "on" blocks appear to be message handlers. [1] They do appear to act like functions as "sW" and "sC" are called from the "doSearch" message handler block. These blocks also are what contain the malicious code.

Basically, the code is searching for bitcoin.conf and wallet.dat in the typical storage place Bitcoin-Qt stores its data. If it manages to find these files, it reads them and sends the contents of them off to two different web addresses, effectively stealing the Bitcoin wallet. The paths and filenames the code uses to find this data are Base64 encoded in the source code so a text search through the code will come up with nothing unless the strings used for searching are Base64 encoded first.

[1] http://livecode.com/developers/api/6.0.2//on/

ultra0 on Reddit [1] posted the source code, which was dumped from memory, of TibanneBackOffice.exe [2] that shows it is stealing Bitcoin-Qt wallets.

The analysis on Securelist the TechCrunch post is referring to is located at [3].

[1] http://www.reddit.com/r/Bitcoin/comments/200k30/the_tibanneb...

[2] https://3d3.ca/ijKOh.vbs#eV7i3HIliI93y+UR

[3] http://www.securelist.com/en/blog/8196/Analysis_of_Malware_f...

I didn't realize that "France", "USA", and "anywhere else" were links until you mentioned so right here. You should make these links distinctive from the rest of the text without the need of having to hover over them so that they are more obvious.

According to http://git.io/top when it last updated last week, it states michalbe currently has the longest streak. They have a streak of 561 days as of today according to their profile: https://github.com/michalbe