14 ms·

Exodus Bitcoin Wallet: $490k swindle

222 points by flexiondotorg 3y ago

fuddle 3y ago
Do we know how much was transferred to the attackers wallet in total from all attacks?
- laverya 3y ago
  Only if the attacker only transferred funds to one wallet. I could also see a sophisticated attacker holding off on draining wallets until the amount contained started to drop or increased past a threshold. Draining funds as soon as a user attempts to setup the app gets you a few suckers but also means you'll be reported quickly. Giving everyone a failure message while recording the recovery key might let you go significantly longer before discovery.
aaroninsf 3y ago
[flagged]
Jacquepagan080 3y ago
[dead]
Michaelhartnett 3y ago
[dead]
markd081711 3y ago
[dead]
GeorgeCaldwell 3y ago
[dead]
BirgitMeyer673 3y ago
[dead]
Jeremyiv 3y ago
[dead]
Jeremyiv2 3y ago
[dead]
Jeremyiv2 3y ago
[dead]
florieger 3y ago
[dead]
louwrentius 3y ago
[flagged]
- mhluongo 3y ago
  Clearly you didn't RTFA. This mistake was on Canonical / is due to a lack of vetting in the Ubuntu app store.
  - beachy 3y ago
    I don't know jack about crypto but surely we shouldn't expect a distro provider to be vetting financial instruments?
    - mhluongo 3y ago
      There was malware in the Snap store! This could've just as easily been a password manager and wiped out the guy's bank account.
      - KomoD 3y ago
        There's malware everywhere
- woah 3y ago
  Cryptocurrency is the only place where regular people use cryptography that they control in a way that matters enough for someone to attack it. Of course we will see mistakes being made. Covering your ears and singing "lalala crypto bad" instead of trying to learn how to make cryptography easier to use is boring.
  - nradov 3y ago
    Far more regular people use other cryptography tools and protocols like full disk encryption, TLS, end-to-end encrypted messaging, etc. All of those are secure and easy to use.
david4568 3y ago
[dead]
ceejayoz 3y ago
A rather hilariously appropriate app name.
redder23 3y ago
Even the real version is the app is a software wallet right? If you have almost 500k in BTC and do not have it on a hardware wallet and use their official software for it, I have to say it's at least partially on you if you lose it.
- ramijames 3y ago
  It wouldn't matter. If your seed phrase is exposed, you lose all funds.
  - redder23 3y ago
    You sound like you do not understand hardware wallets. The point of the hardware wallet is that you NEVER EVER expose your seed phase you basically hammer it in some metal or buy something that survives fire with your seed phase, and you NEVER EVER type it into any program, nor to you write it down from a computer screen but only directly from the wallet device. If anyone is dumb enough to go through the setup process of a hardware wallet and STILL end up typing their seed phase into some software wallet, then it's on them. So hell yeah, it would matter, because that setup process alone makes you understand crypto better and why it's isolated from your PC. As others mentioned, that person later realized this.
- reisse 3y ago
  Bitcoin "wallet" is just a pair of public and private keys. Honest question - what is the difference between a "hardware wallet" and a thumbdrive with the keys on it, except for the price tag?
  - jstanley 3y ago
    When you plug a hardware wallet into a computer it can't get the keys off the wallet. It can only ask the hardware wallet to sign a transaction, and the hardware wallet asks the user to confirm. When you plug a thumbdrive with keys on it into a computer the computer can just take the keys. It's the same as the difference between a YubiKey and a thumbdrive with GPG keys on it.
renewiltord 3y ago
Well, that's really unfortunate. I would never just go download a random crypto app, not even from the Apple App Store. But the "Safe" marker is a massive UI risk. It makes me think it was signed and verified in some way.
edent 3y ago
What I don't get about the Snap store is why there's no verified link back to a website? If you have the technical ability to create an app, you probably have the ability to upload something to /.well-known/ or to add a DNS TXT record. That way the Snap store could say "This app came from this website." OK, it doesn't help if someone goes to the trouble of registering a homograph address, but it would at least give normal users a chance to check out who the author is. That seems to be how Flathub works. It shows a verified domain, or prominently says that it is a community released app.
- popey 3y ago
  Back in the day, we had long internal conversations about doing verification 'properly' with government-issued IDs, third-party verification agencies and the like. But that never amounted to anything, sadly. They might consider it further if the store got to a decent scale (like the contemporaries like iOS, Play and Microsoft). But with "only" 6K applications published, and the money canon being pointed in other directions, I can't see it happening any time soon.
  - deleted 3y ago
    [deleted]
- KomoD 3y ago
  This assumes the user would actually pay attention to that. (spoiler: they won't) > OK, it doesn't help if someone goes to the trouble of registering a homograph address Doesn't even have to be homograph, it can just be something that has "exodus" in it (coming back to users not paying attention, this would work, and is also the reason phishing and other fake sites work), if "exodus-wallet.com" was verified then many people would still fall for it. The entire thing would've been avoided if users paid attention and going to the official website instead of blindly trusting the Snap Store (and following VERY common advice, such as don't enter your secret phrase or password anywhere)
- __MatrixMan__ 3y ago
  DNS isn't quite as adversary resistant as the crypto space likes to have things. I'm not sure what Bitcoiner's preference would be exactly, but I'm sure they've got something involving signed wallet hashes published on the chain. The hard part, as with anywhere else, is getting users to check it.
jstanley 3y ago
One point I would make: > it connects to some API at https://www.exchangerate-api.com/ https://www.exchangerate-api.com/ This is not necessarily right. The exchangerate-api.com site is hosted behind Cloudflare, so I don't know where it's actually hosted, but the IP addresses shown in bandwhich could be unrelated. You also said: > Visiting one of those IPs redirects to https://www.exchangerate-api.com/ https://www.exchangerate-api.com/ It is common for malicious sites to redirect to legitimate sites to help evade detection, so it is possible that exchangerate-api.com is an unrelated and legitimate site.
- popey 3y ago
  Sure, there was a bit of guesswork on my part. I could analyse the traffic in more detail, but when I wrote this all up, it was Sunday evening, and I wanted to do the minimum analysis to get a response to the unlucky rube. I still have the snap, and could test further, but I suspect the endpoint linode boxes will disappear and popup somewhere else sometime.
  - jstanley 3y ago
    What I mean was your wording implied that exchangerate-api.com was somehow implicated, but in my opinion that is too much of a leap to make. The only thing implicating that site is a redirect that you got from a site that you know you don't trust.
    - popey 3y ago
      Yes, I understood your point.
- zx76 3y ago
  I'm the developer of the ExchangeRate-API.com service. Obviously it's upsetting to have our API used by a scammer, but our service couldn't have been involved in this hack beyond fetching a JSON-formatted response of up-to-date exchange rates because that's the only functionality our service/domain provides. My guess is that the scammer implemented a call to our API to fetch up-to-date exchange rates in order to make their fake wallet seem more plausible & real. Interestingly my API doesn't even support any exchange rates involving cryptocurrencies and so the scammer would have had to additionally integrate with a different API to get something like the up-to-date exchange rate between BTC and USD. The API is a very simple service - it's just a few endpoints that supply JSON formatted exchange rates over HTTPS. Anyone with an email address can sign up to use the service for free and there are even some totally "open access" endpoints that don't require any authentication. One of these has been used in the GNU `units` converter software for a while. With regard to proving it's a legitimate service, this is the point where I wish I had made more progress with the landing page update that emphasizes social proof I've been working on recently! The API is used by ICs/teams at hundreds of recognizable companies. There are tens of thousands of free users including some that have used the API consistently for free for over a decade. I guess you could check many instances of the service being archived on the wayback machine? https://web.archive.org/web/20240000000000*/https://www.exchangerate-api.com/ https://web.archive.org/web/20240000000000*/https://www.exch... I'll definitely admit the domain does look a bit odd but back in 2010 when registering it the "Exact Match Domain" bonus was a big factor for SEO. The site has been a top 3 Google result for "exchange rate api" pretty consistently - presumably also how the scammer ended up using the service. I've used Cloudflare since approx. 2019 and their "cloudflared" tunnel infrastructure since approx. 2021 to secure servers against DDoS. I'll contact popey to see if we can get more details on the exact path/request they saw being made to our domain and if that leads to any further information or logging from our side.
codetrotter 3y ago
This is scary and even a hardware wallet might not help. When I create a transaction with Electrum on my computer, I use a hardware wallet to sign the transaction. When I sign the transaction, the hardware wallet shows the amounts, and the output addresses. But if my copy of Electrum was backdoored and smart about what it did, it could use an output address for the remaining amount that went to another wallet. And since I and most people mainly check the address we are sending to but don’t pay close attention to the change address, we could end up having our funds stolen that way. I’ve been thinking about moving to a multisig setup instead, that would have multiple computers independently used for checking and signing the transactions. So far I’ve been putting it off because a single wallet and being diligent about checking the output address that you send to seemed sufficient. But now I think moving to a multisig setup is something me and more people should do sooner rather than later.
- woah 3y ago
  So many of these exploits boil down to "hardware wallets not providing enough/the right information". The screen is tiny, and protocol devs don't usually put a lot of thought into making stuff easily human readable. Ideally a transaction can be fully understood and verified from the hardware wallet but we still have a ways to go.
  - npoc 3y ago
    I use a repurposed mobile running BlueWallet
- popol12 3y ago
  No, you're wrong. The issue you're describing can't be exploited on Ledger devices at least. (Source: I’m a contributor to their bitcoin transaction parsing code) Their hardware wallet checks if the provided change output's address is actually owned by the device owner: - if it does, then the change output is simply hidden from the user validation flow - if it doesn’t it will appear as a second bitcoin transfer to approve, which require a second physical approval on the device. this is highly unusual and should trigger the user's suspicion. I can’t say for other vendors but this is pretty standard security practice I’m sure, hardware wallets are fighting against attacks that are way more elaborate than this one.
hsbauauvhabzb 3y ago
‘ I’m writing this in the hope Canonical will fix its processes so reputation-damaging events like this don’t keep happening.’ That is such a poor attitude. Instead maybe hope that canonical may fix the lax vetting and security of their store, but to care directly about their reputation and not the user who was scammed due to their weak practices goes hand in hand with everything else I’ve seen from snap.
- popey 3y ago
  Maybe I could have worded that sentence better. Thanks for the feedback. It wasn't intended the way you took it. But I appreciate you mentioning it anyway.
neilv 3y ago
> They likely saw a button like this in the "App Centre", which gave them some confidence in the application. [...] Furthermore the title of the Snapcraft web frontend says "Snaps are containerised software packages that are simple to create and install. They auto-update and are safe to run." Sounds like assurances made by UX and Marketing, which engineering might've been able to tell them they can't make. If it ends up costing them $490K plus legal fees, that's still a relatively inexpensive way to learn this lesson.
- ElijahLynn 3y ago
  However, the app is already installed on many other devices, and likely affected many others too.
- loloquwowndueo 3y ago
  You assume sales and marketing listen to engineering. At Canonical, they do not. Source: I’m a former Canonical employee.
shuntress 3y ago
If only there were some kind of system or network of long-standing institutions with a deep commitment to paper-trails and accountability that was overseen by some kind of community-managed regulation to control this type of thing.
- ToucanLoucan 3y ago
  Glad I'm not the only one who is thoroughly tired of this second coming of the financial system except with bonus insane energy waste and an absolute obliteration of consumer protections at seemingly every tier. A security product built by people who have zero understanding of actual financial security and how financial crimes actually happen. Truly astonishing.
  - shuntress 3y ago
    It turns out that with "electronic cash", the same as with physical cash, you do actually still need the banking system. Wow! Who could have ever guessed?
- mistercheph 3y ago
  I feel the same exact way whenever I see a car crash: "If only there was a mode or system of human transportation backed by long-standing institutions with a deep commitment to dirt trails and rideability that occurred at speeds which were safe for this type of thing." *spits into spittoon*
  - shuntress 3y ago
    I don't know what dirt trails and slow speeds have to do with trains and trolleys but I agree with you that we could drastically reduce motor vehicle accidents by re-building our systems of public transportation and walkable neighborhoods.
lyu07282 3y ago
The takeaway is to avoid using Snap. In case you needed another reason to.
- diego_sandoval 3y ago
  And more generally, avoid installing apps from centralized repositories/ App stores. Go to the official source if available.
  - lyu07282 3y ago
    No actually, official distribution repositories are preferable if they are properly maintained. Debian for example has provided such centralized repositories that can absolutely be trusted for decades. Otherwise you'd have to update each application manually and/or trust each application's update mechanism (also bad). Snap is only bad because the people developing snap are incompetent. The idea itself isn't bad.
gjsman-1000 3y ago
I'm still not exactly sure, to be honest, why Snap exists. The desktop on Linux has gone Flatpak. If I'm running a server, why the heck would I trust Snap, a platform that until recently didn't even let me control updates, over Docker? If something goes wrong, who do I call? If I need a custom storage arrangement, who do I call? If I need a custom network arrangement, who do I call? If I need to scale up, who do I call? Why would I subject myself to this? Is it IoT? Maybe it has a market there - but why doesn't it focus on being the best it can be, solely for that market, then? One more note: Snap even allowing unapproved repackaging of apps was, in my opinion, a very bad idea in the first place. Case in point: Even the Snap homepage is advertising a community repackage of a password manager ("NordPass" - developer not verified). Why the heck should Snap be proud of that? (Edit: Apparently NordPass's website does point to it - but the developer remains unverified. What's the point of verification...)
- ladyanita22 3y ago
  For reference, I've checked the Flatpak app and can confirm that the Flatpak for Exodus is the correct Electron app. In Flathub it's as easy as going to the github of the store and looking at the package's instructions. You'll see what it does is basically downloading the ZIP from the offical Exodus website and run it.
codedokode 3y ago
Canonical should not have displayed a "safe" icon at scam app page. The proper text should be something like "Not verified. Review the code and check the publisher before using the app.". The same should be at Google Play and Apple Store. Scam apps and sanctioned apps are regularly passing through reviews.
- LelouBil 3y ago
  Or maybe just write "sandboxed" or "isolated" since it's actually what safe means here, not that the code is actually doing what it says.
  - 1oooqooq 3y ago
    maybe if icon-fonts shipped a sandbox with the poo emoji inside it would make it easier for lazy UX designers to communicate it. amazing how little effort goes into UX these days.
- yau8edq12i 3y ago
  If every single app has the same warning, the warning becomes useless too.
nntwozz 3y ago
On a tangent, my neighbor came to me about a month ago and asked if I was a "hacker"? He's around 75 and has known me for maybe 20 years, we're not close friends but we run into each other every now and then and he knows I work with IT; I'm about half his age. Long story short, I find out he needs help to retrieve his bitcoin wallet because he's lost $300k. I spend an hour looking around his devices and find out he's been buying bitcoin from a young hip instagram lady in Florida. Wait for it… …they shared access to the wallet. He had a chat log stretching back one year on whatsapp with her, he was now paying her smaller sums to cover the cost for some "hacker" to retrieve his wallet. ¯\_(ツ)_/¯
- yankaf 3y ago
  who the fuck told this poor guy about bitcoin, tell him to invest his money in some stocks, he will be taxed but wont be fucked.
  - damontal 3y ago
    Matt Damon
  - TimeBearingDown 3y ago
    Or just buy it with classic instruments - ETF.
  - mtnGoat 3y ago
    Probably the Instagram lady that is helping him. These scams are fairly common on IG these days.
    - yieldcrv 3y ago
      probably a trafficked person in Cambodia theyre put in labor camps and do cryptocurrency scams over social media
      - mtnGoat 3y ago
        Interesting I didn’t know that, I’ll have to learn more. I had heard about stuff like that in N. Korea but not Cambodia.
Pxtl 3y ago
Reminds me of this old Xkcd: https://xkcd.com/1200/ https://xkcd.com/1200/ when they said that these Snap packages were "safe" they probably meant from a "linux is secure" and "properly sandboxed" meaning, not "we've verified that this person isn't trying to scam you".
GoodUser77 3y ago
[dead]
GoodUser77 3y ago
[dead]
lxe 3y ago
App stores with stringent and restrictive policies do indeed help prevent this type of scams, unfortunately.
philipwhiuk 3y ago
By the standards of Web3, this is a very small theft. Case in point: https://www.web3isgoinggreat.com/?id=fixedfloat-hack https://www.web3isgoinggreat.com/?id=fixedfloat-hack
Devasta 3y ago
They shouldn't feel too bad. If they still had that 490k they'd just waste it on stupid bullshit like cryptocurrency.
- outside415 3y ago
  have fun staying poor.
  - Devasta 3y ago
    lol, cry more.
    - outside415 3y ago
      https://tenor.com/view/woody-harrelson-crying-money-wipe-tears-rich-gif-16201471 https://tenor.com/view/woody-harrelson-crying-money-wipe-tea...
      - Devasta 3y ago
        A gif of Woody Harrelson! Sure showed me! Look, I can do that too! https://tenor.com/view/uncle-scrooge-mcduck-money-rich-gif-14161225 https://tenor.com/view/uncle-scrooge-mcduck-money-rich-gif-1...
Saris 3y ago
The strangest part to me is that it shows it as "Safe", based on what? It doesn't seem like any checks were done at all to make sure this was a real app from Exodus.
- jis 3y ago
  I suspect that the definition of "Safe" in this context is that it has limited ability to mess with your computer. From what I have read, the application didn't violate the security of anyone's computer, it didn't need to! So we need to be careful with how we interpret "Safe!"
  - Saris 3y ago
    Yeah it's quite confusing for the less technical user. Hopefully they change that so it doesn't just say "safe" in such a generic way.
doubloon 3y ago
so they cut a bunch of people and abandoned the desktop, https://www.techradar.com/news/what-happened-at-canonical https://www.techradar.com/news/what-happened-at-canonical then tried to 'self checkout' the app store "One of the goals is to automate the whole Snapcraft publishing and review pipeline so there’s fewer (expensive and slow) humans in the loop." (from op article). automation should not replace human judgement, it should replace human drudgery.
Linda231 3y ago
[dead]
rsynnott 3y ago
In which being your own bank continues to be undesirable. (Never understood why ‘be your own bank’ was meant to be at all appealing. Being a bank is terrible. And still realistically less risky than this sort of thing; apart from truly bizarre edge cases (see the Citi/Revlon drama), this sort of thing simply can’t happen.)
- fragmede 3y ago
  Well, they have a lot of money, and if you're morally flexible, as anyone who's played the banker in a family game of Monopoly can tell you, you can just take some.
- kwar13 3y ago
  How is being a bank terrible? It's one of the most profitable businesses ever and continues to be.
  - rsynnott 3y ago
    … Wait, what? I mean, possibly if you’re a large investment bank , those can be quite profitable (until they’re abruptly not; see 2008). Retail banks (which the ‘be your own bank’ people are presumably referring to; if you want to be your own investment bank you can just skip the ‘bank’ bit) are generally not particularly profitable.
  - andruby 3y ago
    Being a stable working bank is really really hard. Most people don't have the knowledge, time or desire to do that. For 99+ % of the world's population using fiat currency is simple and the learning curve is basic school maths.
DerekRodriguez 3y ago
I founded a company that makes a distributed wallet that is immune to these types of problems. You might be scammed out of your specific keyshare, but the scam would need to compromise all nodes at once which is nearly impossible. It's called Gridlock.
achiang 3y ago
It has been 10 years since I left Canonical (on good terms), but what popey describes (hi popey) about the intentional lack of human review in the Snap store sounds very Canonical to me. I agree with all the recommendations - add human gates. Yes, it's expensive, but still far cheaper than the unbounded reputational damage that just occurred around the untrustworthiness of the store (hi Amazon).
- popey 3y ago
  Hi Alex!
kwar13 3y ago
The crypto industry has had a serious UI/UX problem, no doubt about that. I also presume this bitcoin holder wasn't a sophisticated one, because the main point of a cold wallet is NOT ever have your seed phrase (12-24 words) go online. That's the real exploit in here. Crypto has a long way to go and some improvements are being made but it definitely is one of the main pain points.
democracy 3y ago
Crypto is sooooo cringey in 2024...
vmoore 3y ago
The operational security measures one has to take these days to secure crypto is insane. You have to build your own mini intelligence agency just to protect your digital crypto assets. You have to do: - Principle of least privilege. - Zero Trust. - Compartmentation. - Hardened Operating Systems with no malware and strong endpoint defense. - Firewalls that whitelist only your IP and disavow everything else. - 2FA/MFA/Biometrics auth for everything. - Defense in Depth. - Use crytography tools vetted from the community surrounding it, and use tools which are battle hardened. Modern computing is very leaky and every node is malicious. You need extreme vigilance to safeguard crypto. Are people up to the task of doing all this? I'm asking because I lost crypto before, and now I'm more resilient and have better security posture.
- geek_at 3y ago
  If you just want to buy crypto currencies and check again in a few years, the procedure is much simpler: 1. Make a paper wallet, laminate it, put it in a safe location or maybe two 2. Use any exchange and send the coins to the wallet. Never leave any coins on the exchange When you want to get them out again, this is the safest approach: 1. Boot Tails from USB 2. Enter your private key in Electrum (it's preinstalled in Tails) 3. Send to exchange and convert to fiat If you want to do daytrading it's a whole other story
  - danbruc 3y ago
    This essentially boils down to not using Bitcoin. If Bitcoin ever wants to achieve its goal of becoming a usable currency, hiding pieces of paper in safes is not the way to go. But you can of course speculate that in a few years someone else is willing to pay more than you did to enjoy the fun of storing a piece of paper in a safe.
    - tainted_blood 3y ago
      Use a hardware-wallet like the Bitbox2 for your big stash. Use a lightning wallet like phoenix on your phone for smaller amounts which you could loose, like in a physical wallet.
lobito14 3y ago
https://www.exchangerate-api.com/ https://www.exchangerate-api.com/ isn't related to crypto, and it's probably also a fake website.
- 8organicbits 3y ago
  If you're posting a website you don't trust, try breaking the link so people don't misread and click through. A good approach is something like: http[://]example.com
- nerdbert 3y ago
  It's a real site, I've used it for at least 10 years.
nly 3y ago
Keeping your Bitcoin on your computer in any form is an extremely bad idea. Multiple laminated (real) paper wallets in a safety deposit box and multiple locations is the only way to go.
- akaiser 3y ago
  A wallet app like Exodus is not for keeping BTC, it's for transacting with it. The wallet file is for keeping BTC, and whether you print it on laminated paper or copy it to multiple USB sticks that you distribute in multiple places (you can encrypt a USB stick, but not really a piece of paper, so beware who has access to your storage!), doesn't matter once you want to use your BTC. Using your BTC requires a computer and a wallet app; there's no way around that besides online platforms. The real solution for fake wallets is to independently validate signatures of wallet app releases or to build from source yourself. Also wait for a few weeks before jumping onto the latest wallet version. Who knows if the developer's supply chain got compromised. Edit for completeness: Last but not least, do offline transactions (send the signed transaction using an online device without access to the wallet).
- fsflover 3y ago
  > Keeping your Bitcoin on your computer in any form is an extremely bad idea. How about an offline virtual machine on Qubes OS?
upofadown 3y ago
This seems to be the big, unsolved, identity problem at least X3: * No way for anyone (user or store) to verify the identity of the publisher. * User was not given enough understanding to be able to protect their Bitcoin identity (usability, identity backup). * No way for anyone (user or store) to identify who had downloaded the malicious snap.
lucaalessandro 3y ago
[dead]
clarkrizzo 3y ago
[dead]
farukmanon12 3y ago
[dead]
arnoldpritzker 3y ago
[dead]
ivana111 3y ago
[flagged]
- FabHK 3y ago
  How hasn't this been flagged dead yet?
judith48 3y ago
The world has evolved, lot of phishing and scam on cryptocurrencies . its very important to know that a source is legit before investing and most importantly safe guarding and upgrading security concerning your crypto like two factors authenticators and all necessary precautions .. although there are lot of good coders and hackers like recovering ATusa com that make it easier to recover stolen cryptocurrencies and of course only few are able to get theirs in full......
paulhowson 3y ago
[dead]
Hwanpark 3y ago
[dead]
ZaynBashar 3y ago
[dead]
ketrymercy 3y ago
[dead]

222 points by flexiondotorg 3y ago

fuddle 3y ago

Do we know how much was transferred to the attackers wallet in total from all attacks?

laverya 3y ago
Only if the attacker only transferred funds to one wallet. I could also see a sophisticated attacker holding off on draining wallets until the amount contained started to drop or increased past a threshold. Draining funds as soon as a user attempts to setup the app gets you a few suckers but also means you'll be reported quickly. Giving everyone a failure message while recording the recovery key might let you go significantly longer before discovery.

aaroninsf 3y ago

[flagged]

Jacquepagan080 3y ago

[dead]

Michaelhartnett 3y ago

[dead]

markd081711 3y ago

[dead]

GeorgeCaldwell 3y ago

[dead]

BirgitMeyer673 3y ago

[dead]

Jeremyiv 3y ago

[dead]

Jeremyiv2 3y ago

[dead]

Jeremyiv2 3y ago

[dead]

florieger 3y ago

[dead]

louwrentius 3y ago

[flagged]

mhluongo 3y ago
Clearly you didn't RTFA. This mistake was on Canonical / is due to a lack of vetting in the Ubuntu app store.
- beachy 3y ago
  I don't know jack about crypto but surely we shouldn't expect a distro provider to be vetting financial instruments?
  - mhluongo 3y ago
    There was malware in the Snap store! This could've just as easily been a password manager and wiped out the guy's bank account.
    - KomoD 3y ago
      There's malware everywhere
woah 3y ago
Cryptocurrency is the only place where regular people use cryptography that they control in a way that matters enough for someone to attack it. Of course we will see mistakes being made. Covering your ears and singing "lalala crypto bad" instead of trying to learn how to make cryptography easier to use is boring.
- nradov 3y ago
  Far more regular people use other cryptography tools and protocols like full disk encryption, TLS, end-to-end encrypted messaging, etc. All of those are secure and easy to use.

david4568 3y ago

[dead]

ceejayoz 3y ago

A rather hilariously appropriate app name.

redder23 3y ago

Even the real version is the app is a software wallet right? If you have almost 500k in BTC and do not have it on a hardware wallet and use their official software for it, I have to say it's at least partially on you if you lose it.

ramijames 3y ago
It wouldn't matter. If your seed phrase is exposed, you lose all funds.
- redder23 3y ago
  You sound like you do not understand hardware wallets. The point of the hardware wallet is that you NEVER EVER expose your seed phase you basically hammer it in some metal or buy something that survives fire with your seed phase, and you NEVER EVER type it into any program, nor to you write it down from a computer screen but only directly from the wallet device. If anyone is dumb enough to go through the setup process of a hardware wallet and STILL end up typing their seed phase into some software wallet, then it's on them. So hell yeah, it would matter, because that setup process alone makes you understand crypto better and why it's isolated from your PC. As others mentioned, that person later realized this.
reisse 3y ago
Bitcoin "wallet" is just a pair of public and private keys. Honest question - what is the difference between a "hardware wallet" and a thumbdrive with the keys on it, except for the price tag?
- jstanley 3y ago
  When you plug a hardware wallet into a computer it can't get the keys off the wallet. It can only ask the hardware wallet to sign a transaction, and the hardware wallet asks the user to confirm. When you plug a thumbdrive with keys on it into a computer the computer can just take the keys. It's the same as the difference between a YubiKey and a thumbdrive with GPG keys on it.

renewiltord 3y ago

Well, that's really unfortunate. I would never just go download a random crypto app, not even from the Apple App Store. But the "Safe" marker is a massive UI risk. It makes me think it was signed and verified in some way.

edent 3y ago

What I don't get about the Snap store is why there's no verified link back to a website? If you have the technical ability to create an app, you probably have the ability to upload something to /.well-known/ or to add a DNS TXT record. That way the Snap store could say "This app came from this website." OK, it doesn't help if someone goes to the trouble of registering a homograph address, but it would at least give normal users a chance to check out who the author is. That seems to be how Flathub works. It shows a verified domain, or prominently says that it is a community released app.

popey 3y ago
Back in the day, we had long internal conversations about doing verification 'properly' with government-issued IDs, third-party verification agencies and the like. But that never amounted to anything, sadly. They might consider it further if the store got to a decent scale (like the contemporaries like iOS, Play and Microsoft). But with "only" 6K applications published, and the money canon being pointed in other directions, I can't see it happening any time soon.
- deleted 3y ago
  [deleted]
KomoD 3y ago
This assumes the user would actually pay attention to that. (spoiler: they won't) > OK, it doesn't help if someone goes to the trouble of registering a homograph address Doesn't even have to be homograph, it can just be something that has "exodus" in it (coming back to users not paying attention, this would work, and is also the reason phishing and other fake sites work), if "exodus-wallet.com" was verified then many people would still fall for it. The entire thing would've been avoided if users paid attention and going to the official website instead of blindly trusting the Snap Store (and following VERY common advice, such as don't enter your secret phrase or password anywhere)
__MatrixMan__ 3y ago
DNS isn't quite as adversary resistant as the crypto space likes to have things. I'm not sure what Bitcoiner's preference would be exactly, but I'm sure they've got something involving signed wallet hashes published on the chain. The hard part, as with anywhere else, is getting users to check it.

jstanley 3y ago

One point I would make: > it connects to some API at https://www.exchangerate-api.com/ https://www.exchangerate-api.com/ This is not necessarily right. The exchangerate-api.com site is hosted behind Cloudflare, so I don't know where it's actually hosted, but the IP addresses shown in bandwhich could be unrelated. You also said: > Visiting one of those IPs redirects to https://www.exchangerate-api.com/ https://www.exchangerate-api.com/ It is common for malicious sites to redirect to legitimate sites to help evade detection, so it is possible that exchangerate-api.com is an unrelated and legitimate site.

popey 3y ago
Sure, there was a bit of guesswork on my part. I could analyse the traffic in more detail, but when I wrote this all up, it was Sunday evening, and I wanted to do the minimum analysis to get a response to the unlucky rube. I still have the snap, and could test further, but I suspect the endpoint linode boxes will disappear and popup somewhere else sometime.
- jstanley 3y ago
  What I mean was your wording implied that exchangerate-api.com was somehow implicated, but in my opinion that is too much of a leap to make. The only thing implicating that site is a redirect that you got from a site that you know you don't trust.
  - popey 3y ago
    Yes, I understood your point.
zx76 3y ago
I'm the developer of the ExchangeRate-API.com service. Obviously it's upsetting to have our API used by a scammer, but our service couldn't have been involved in this hack beyond fetching a JSON-formatted response of up-to-date exchange rates because that's the only functionality our service/domain provides. My guess is that the scammer implemented a call to our API to fetch up-to-date exchange rates in order to make their fake wallet seem more plausible & real. Interestingly my API doesn't even support any exchange rates involving cryptocurrencies and so the scammer would have had to additionally integrate with a different API to get something like the up-to-date exchange rate between BTC and USD. The API is a very simple service - it's just a few endpoints that supply JSON formatted exchange rates over HTTPS. Anyone with an email address can sign up to use the service for free and there are even some totally "open access" endpoints that don't require any authentication. One of these has been used in the GNU `units` converter software for a while. With regard to proving it's a legitimate service, this is the point where I wish I had made more progress with the landing page update that emphasizes social proof I've been working on recently! The API is used by ICs/teams at hundreds of recognizable companies. There are tens of thousands of free users including some that have used the API consistently for free for over a decade. I guess you could check many instances of the service being archived on the wayback machine? https://web.archive.org/web/20240000000000*/https://www.exchangerate-api.com/ https://web.archive.org/web/20240000000000*/https://www.exch... I'll definitely admit the domain does look a bit odd but back in 2010 when registering it the "Exact Match Domain" bonus was a big factor for SEO. The site has been a top 3 Google result for "exchange rate api" pretty consistently - presumably also how the scammer ended up using the service. I've used Cloudflare since approx. 2019 and their "cloudflared" tunnel infrastructure since approx. 2021 to secure servers against DDoS. I'll contact popey to see if we can get more details on the exact path/request they saw being made to our domain and if that leads to any further information or logging from our side.

codetrotter 3y ago

This is scary and even a hardware wallet might not help. When I create a transaction with Electrum on my computer, I use a hardware wallet to sign the transaction. When I sign the transaction, the hardware wallet shows the amounts, and the output addresses. But if my copy of Electrum was backdoored and smart about what it did, it could use an output address for the remaining amount that went to another wallet. And since I and most people mainly check the address we are sending to but don’t pay close attention to the change address, we could end up having our funds stolen that way. I’ve been thinking about moving to a multisig setup instead, that would have multiple computers independently used for checking and signing the transactions. So far I’ve been putting it off because a single wallet and being diligent about checking the output address that you send to seemed sufficient. But now I think moving to a multisig setup is something me and more people should do sooner rather than later.

woah 3y ago
So many of these exploits boil down to "hardware wallets not providing enough/the right information". The screen is tiny, and protocol devs don't usually put a lot of thought into making stuff easily human readable. Ideally a transaction can be fully understood and verified from the hardware wallet but we still have a ways to go.
- npoc 3y ago
  I use a repurposed mobile running BlueWallet
popol12 3y ago
No, you're wrong. The issue you're describing can't be exploited on Ledger devices at least. (Source: I’m a contributor to their bitcoin transaction parsing code) Their hardware wallet checks if the provided change output's address is actually owned by the device owner: - if it does, then the change output is simply hidden from the user validation flow - if it doesn’t it will appear as a second bitcoin transfer to approve, which require a second physical approval on the device. this is highly unusual and should trigger the user's suspicion. I can’t say for other vendors but this is pretty standard security practice I’m sure, hardware wallets are fighting against attacks that are way more elaborate than this one.

hsbauauvhabzb 3y ago

‘ I’m writing this in the hope Canonical will fix its processes so reputation-damaging events like this don’t keep happening.’ That is such a poor attitude. Instead maybe hope that canonical may fix the lax vetting and security of their store, but to care directly about their reputation and not the user who was scammed due to their weak practices goes hand in hand with everything else I’ve seen from snap.

popey 3y ago
Maybe I could have worded that sentence better. Thanks for the feedback. It wasn't intended the way you took it. But I appreciate you mentioning it anyway.

neilv 3y ago

> They likely saw a button like this in the "App Centre", which gave them some confidence in the application. [...] Furthermore the title of the Snapcraft web frontend says "Snaps are containerised software packages that are simple to create and install. They auto-update and are safe to run." Sounds like assurances made by UX and Marketing, which engineering might've been able to tell them they can't make. If it ends up costing them $490K plus legal fees, that's still a relatively inexpensive way to learn this lesson.

ElijahLynn 3y ago
However, the app is already installed on many other devices, and likely affected many others too.
loloquwowndueo 3y ago
You assume sales and marketing listen to engineering. At Canonical, they do not. Source: I’m a former Canonical employee.

shuntress 3y ago

If only there were some kind of system or network of long-standing institutions with a deep commitment to paper-trails and accountability that was overseen by some kind of community-managed regulation to control this type of thing.

ToucanLoucan 3y ago
Glad I'm not the only one who is thoroughly tired of this second coming of the financial system except with bonus insane energy waste and an absolute obliteration of consumer protections at seemingly every tier. A security product built by people who have zero understanding of actual financial security and how financial crimes actually happen. Truly astonishing.
- shuntress 3y ago
  It turns out that with "electronic cash", the same as with physical cash, you do actually still need the banking system. Wow! Who could have ever guessed?
mistercheph 3y ago
I feel the same exact way whenever I see a car crash: "If only there was a mode or system of human transportation backed by long-standing institutions with a deep commitment to dirt trails and rideability that occurred at speeds which were safe for this type of thing." *spits into spittoon*
- shuntress 3y ago
  I don't know what dirt trails and slow speeds have to do with trains and trolleys but I agree with you that we could drastically reduce motor vehicle accidents by re-building our systems of public transportation and walkable neighborhoods.

lyu07282 3y ago

The takeaway is to avoid using Snap. In case you needed another reason to.

diego_sandoval 3y ago
And more generally, avoid installing apps from centralized repositories/ App stores. Go to the official source if available.
- lyu07282 3y ago
  No actually, official distribution repositories are preferable if they are properly maintained. Debian for example has provided such centralized repositories that can absolutely be trusted for decades. Otherwise you'd have to update each application manually and/or trust each application's update mechanism (also bad). Snap is only bad because the people developing snap are incompetent. The idea itself isn't bad.

gjsman-1000 3y ago

I'm still not exactly sure, to be honest, why Snap exists. The desktop on Linux has gone Flatpak. If I'm running a server, why the heck would I trust Snap, a platform that until recently didn't even let me control updates, over Docker? If something goes wrong, who do I call? If I need a custom storage arrangement, who do I call? If I need a custom network arrangement, who do I call? If I need to scale up, who do I call? Why would I subject myself to this? Is it IoT? Maybe it has a market there - but why doesn't it focus on being the best it can be, solely for that market, then? One more note: Snap even allowing unapproved repackaging of apps was, in my opinion, a very bad idea in the first place. Case in point: Even the Snap homepage is advertising a community repackage of a password manager ("NordPass" - developer not verified). Why the heck should Snap be proud of that? (Edit: Apparently NordPass's website does point to it - but the developer remains unverified. What's the point of verification...)

ladyanita22 3y ago
For reference, I've checked the Flatpak app and can confirm that the Flatpak for Exodus is the correct Electron app. In Flathub it's as easy as going to the github of the store and looking at the package's instructions. You'll see what it does is basically downloading the ZIP from the offical Exodus website and run it.

codedokode 3y ago

Canonical should not have displayed a "safe" icon at scam app page. The proper text should be something like "Not verified. Review the code and check the publisher before using the app.". The same should be at Google Play and Apple Store. Scam apps and sanctioned apps are regularly passing through reviews.

LelouBil 3y ago
Or maybe just write "sandboxed" or "isolated" since it's actually what safe means here, not that the code is actually doing what it says.
- 1oooqooq 3y ago
  maybe if icon-fonts shipped a sandbox with the poo emoji inside it would make it easier for lazy UX designers to communicate it. amazing how little effort goes into UX these days.
yau8edq12i 3y ago
If every single app has the same warning, the warning becomes useless too.

nntwozz 3y ago

On a tangent, my neighbor came to me about a month ago and asked if I was a "hacker"? He's around 75 and has known me for maybe 20 years, we're not close friends but we run into each other every now and then and he knows I work with IT; I'm about half his age. Long story short, I find out he needs help to retrieve his bitcoin wallet because he's lost $300k. I spend an hour looking around his devices and find out he's been buying bitcoin from a young hip instagram lady in Florida. Wait for it… …they shared access to the wallet. He had a chat log stretching back one year on whatsapp with her, he was now paying her smaller sums to cover the cost for some "hacker" to retrieve his wallet. ¯\_(ツ)_/¯

yankaf 3y ago
who the fuck told this poor guy about bitcoin, tell him to invest his money in some stocks, he will be taxed but wont be fucked.
- damontal 3y ago
  Matt Damon
- TimeBearingDown 3y ago
  Or just buy it with classic instruments - ETF.
- mtnGoat 3y ago
  Probably the Instagram lady that is helping him. These scams are fairly common on IG these days.
  - yieldcrv 3y ago
    probably a trafficked person in Cambodia theyre put in labor camps and do cryptocurrency scams over social media
    - mtnGoat 3y ago
      Interesting I didn’t know that, I’ll have to learn more. I had heard about stuff like that in N. Korea but not Cambodia.

Pxtl 3y ago

Reminds me of this old Xkcd: https://xkcd.com/1200/ https://xkcd.com/1200/ when they said that these Snap packages were "safe" they probably meant from a "linux is secure" and "properly sandboxed" meaning, not "we've verified that this person isn't trying to scam you".

GoodUser77 3y ago

[dead]

GoodUser77 3y ago

[dead]

lxe 3y ago

App stores with stringent and restrictive policies do indeed help prevent this type of scams, unfortunately.

philipwhiuk 3y ago

By the standards of Web3, this is a very small theft. Case in point: https://www.web3isgoinggreat.com/?id=fixedfloat-hack https://www.web3isgoinggreat.com/?id=fixedfloat-hack

Devasta 3y ago

They shouldn't feel too bad. If they still had that 490k they'd just waste it on stupid bullshit like cryptocurrency.

outside415 3y ago
have fun staying poor.
- Devasta 3y ago
  lol, cry more.
  - outside415 3y ago
    https://tenor.com/view/woody-harrelson-crying-money-wipe-tears-rich-gif-16201471 https://tenor.com/view/woody-harrelson-crying-money-wipe-tea...
    - Devasta 3y ago
      A gif of Woody Harrelson! Sure showed me! Look, I can do that too! https://tenor.com/view/uncle-scrooge-mcduck-money-rich-gif-14161225 https://tenor.com/view/uncle-scrooge-mcduck-money-rich-gif-1...

Saris 3y ago

The strangest part to me is that it shows it as "Safe", based on what? It doesn't seem like any checks were done at all to make sure this was a real app from Exodus.

jis 3y ago
I suspect that the definition of "Safe" in this context is that it has limited ability to mess with your computer. From what I have read, the application didn't violate the security of anyone's computer, it didn't need to! So we need to be careful with how we interpret "Safe!"
- Saris 3y ago
  Yeah it's quite confusing for the less technical user. Hopefully they change that so it doesn't just say "safe" in such a generic way.

doubloon 3y ago

so they cut a bunch of people and abandoned the desktop, https://www.techradar.com/news/what-happened-at-canonical https://www.techradar.com/news/what-happened-at-canonical then tried to 'self checkout' the app store "One of the goals is to automate the whole Snapcraft publishing and review pipeline so there’s fewer (expensive and slow) humans in the loop." (from op article). automation should not replace human judgement, it should replace human drudgery.

Linda231 3y ago

[dead]

rsynnott 3y ago

In which being your own bank continues to be undesirable. (Never understood why ‘be your own bank’ was meant to be at all appealing. Being a bank is terrible. And still realistically less risky than this sort of thing; apart from truly bizarre edge cases (see the Citi/Revlon drama), this sort of thing simply can’t happen.)

fragmede 3y ago
Well, they have a lot of money, and if you're morally flexible, as anyone who's played the banker in a family game of Monopoly can tell you, you can just take some.
kwar13 3y ago
How is being a bank terrible? It's one of the most profitable businesses ever and continues to be.
- rsynnott 3y ago
  … Wait, what? I mean, possibly if you’re a large investment bank , those can be quite profitable (until they’re abruptly not; see 2008). Retail banks (which the ‘be your own bank’ people are presumably referring to; if you want to be your own investment bank you can just skip the ‘bank’ bit) are generally not particularly profitable.
- andruby 3y ago
  Being a stable working bank is really really hard. Most people don't have the knowledge, time or desire to do that. For 99+ % of the world's population using fiat currency is simple and the learning curve is basic school maths.

DerekRodriguez 3y ago

I founded a company that makes a distributed wallet that is immune to these types of problems. You might be scammed out of your specific keyshare, but the scam would need to compromise all nodes at once which is nearly impossible. It's called Gridlock.

achiang 3y ago

It has been 10 years since I left Canonical (on good terms), but what popey describes (hi popey) about the intentional lack of human review in the Snap store sounds very Canonical to me. I agree with all the recommendations - add human gates. Yes, it's expensive, but still far cheaper than the unbounded reputational damage that just occurred around the untrustworthiness of the store (hi Amazon).

popey 3y ago
Hi Alex!

kwar13 3y ago

The crypto industry has had a serious UI/UX problem, no doubt about that. I also presume this bitcoin holder wasn't a sophisticated one, because the main point of a cold wallet is NOT ever have your seed phrase (12-24 words) go online. That's the real exploit in here. Crypto has a long way to go and some improvements are being made but it definitely is one of the main pain points.

democracy 3y ago

Crypto is sooooo cringey in 2024...

vmoore 3y ago

The operational security measures one has to take these days to secure crypto is insane. You have to build your own mini intelligence agency just to protect your digital crypto assets. You have to do: - Principle of least privilege. - Zero Trust. - Compartmentation. - Hardened Operating Systems with no malware and strong endpoint defense. - Firewalls that whitelist only your IP and disavow everything else. - 2FA/MFA/Biometrics auth for everything. - Defense in Depth. - Use crytography tools vetted from the community surrounding it, and use tools which are battle hardened. Modern computing is very leaky and every node is malicious. You need extreme vigilance to safeguard crypto. Are people up to the task of doing all this? I'm asking because I lost crypto before, and now I'm more resilient and have better security posture.

geek_at 3y ago
If you just want to buy crypto currencies and check again in a few years, the procedure is much simpler: 1. Make a paper wallet, laminate it, put it in a safe location or maybe two 2. Use any exchange and send the coins to the wallet. Never leave any coins on the exchange When you want to get them out again, this is the safest approach: 1. Boot Tails from USB 2. Enter your private key in Electrum (it's preinstalled in Tails) 3. Send to exchange and convert to fiat If you want to do daytrading it's a whole other story
- danbruc 3y ago
  This essentially boils down to not using Bitcoin. If Bitcoin ever wants to achieve its goal of becoming a usable currency, hiding pieces of paper in safes is not the way to go. But you can of course speculate that in a few years someone else is willing to pay more than you did to enjoy the fun of storing a piece of paper in a safe.
  - tainted_blood 3y ago
    Use a hardware-wallet like the Bitbox2 for your big stash. Use a lightning wallet like phoenix on your phone for smaller amounts which you could loose, like in a physical wallet.

lobito14 3y ago

https://www.exchangerate-api.com/ https://www.exchangerate-api.com/ isn't related to crypto, and it's probably also a fake website.

8organicbits 3y ago
If you're posting a website you don't trust, try breaking the link so people don't misread and click through. A good approach is something like: http[://]example.com
nerdbert 3y ago
It's a real site, I've used it for at least 10 years.

nly 3y ago

Keeping your Bitcoin on your computer in any form is an extremely bad idea. Multiple laminated (real) paper wallets in a safety deposit box and multiple locations is the only way to go.

akaiser 3y ago
A wallet app like Exodus is not for keeping BTC, it's for transacting with it. The wallet file is for keeping BTC, and whether you print it on laminated paper or copy it to multiple USB sticks that you distribute in multiple places (you can encrypt a USB stick, but not really a piece of paper, so beware who has access to your storage!), doesn't matter once you want to use your BTC. Using your BTC requires a computer and a wallet app; there's no way around that besides online platforms. The real solution for fake wallets is to independently validate signatures of wallet app releases or to build from source yourself. Also wait for a few weeks before jumping onto the latest wallet version. Who knows if the developer's supply chain got compromised. Edit for completeness: Last but not least, do offline transactions (send the signed transaction using an online device without access to the wallet).
fsflover 3y ago
> Keeping your Bitcoin on your computer in any form is an extremely bad idea. How about an offline virtual machine on Qubes OS?

upofadown 3y ago

This seems to be the big, unsolved, identity problem at least X3: * No way for anyone (user or store) to verify the identity of the publisher. * User was not given enough understanding to be able to protect their Bitcoin identity (usability, identity backup). * No way for anyone (user or store) to identify who had downloaded the malicious snap.

lucaalessandro 3y ago

[dead]

clarkrizzo 3y ago

[dead]

farukmanon12 3y ago

[dead]

arnoldpritzker 3y ago

[dead]

ivana111 3y ago

[flagged]

FabHK 3y ago
How hasn't this been flagged dead yet?

judith48 3y ago

The world has evolved, lot of phishing and scam on cryptocurrencies . its very important to know that a source is legit before investing and most importantly safe guarding and upgrading security concerning your crypto like two factors authenticators and all necessary precautions .. although there are lot of good coders and hackers like recovering ATusa com that make it easier to recover stolen cryptocurrencies and of course only few are able to get theirs in full......

paulhowson 3y ago

[dead]

Hwanpark 3y ago

[dead]

ZaynBashar 3y ago

[dead]

ketrymercy 3y ago

[dead]