Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How I got robbed of 34 btc on Mt.Gox today

bitcointalk.org

Post reply on HN
Print view View original

101–110 of 251 posts

Re: How I got robbed of 34 btc on Mt.Gox today

#101

Post by amalag »

DanBC wrote: post #65
axefrog wrote: post #35

MtGox really does run a subpar operation. There should be additional security checks when transferring money out of an account, and there should be the option to enable multifactor authentication. Back when they were originally hacked, this should have become top priority for them, along with making their service rock solid. If people are hacking and stealing from you, it's obvious you have something of value and nee…

This wasn't someone hacking MtGox. This was someone on a vulnerable OS, running without malware protection, with Java active in the browser, visiting an unknown link, and possibly giving an application permission to run. (Although maybe it didn't need permission to run?) To get to that point the person needed to ignore several well established security principles.

How did the executable instruct the bitcoin transfer to take place?

Re: How I got robbed of 34 btc on Mt.Gox today

#102

Post by obilgic »

JonnieCache wrote: post #96
TazeTSchnitzel wrote: post #46

Earlier quoted context omitted.

Ooh, galaxyjdb has a register page: http://www.galaxyjdb.com/index.php?a=Register >Paypal E-Mail: >Hackforums Profile Link: That means this is a service for script kiddies, they've sold this exploit as a service. EDIT: Hackforums is basically a public internet forum where people openly discuss "hacking" and sell "hacking" tools. I've seen another example, a DDOS service, with an almost empty homepage but login and re…

What did you redact there?

Probably author removed the feature and was lazy about the design

Re: How I got robbed of 34 btc on Mt.Gox today

#103

Post by axefrog »

zwily wrote: post #86
StavrosK wrote: post #72

Earlier quoted context omitted.

Oh come on, how hard is it for MtGox to implement TOTP and tell users to download Google Authenticator? It's not really that much hassle to enter a code each time you want to make a transaction, and these things wouldn't happen. Sure, the user was being stupid here, but MtGox didn't do them any favors either.

"Oh come on, how hard is it for MtGox to implement TOTP and tell users to download Google Authenticator?" Not hard, and they did it a long time ago. The user didn't opt in.

When I signed up for an account, there was no obvious prompting to go and turn it on. It's all well and good having extra security, but if you don't actively try to get your users to make use of it, it's only going to be marginally useful.

Re: How I got robbed of 34 btc on Mt.Gox today

#104

Post by Intermernet »

tripzilch wrote: post #63
jotaass wrote: post #37

Earlier quoted context omitted.

Well, he did put a space there. I'd give him a pass.

I would have, but then the term " cross site injection attack", is again Javascript terminology (he probably meant XSS or CRSF, but the term "cross site" doesn't really apply to Java applets). However, the guy just got hacked out of about $8k worth of BC, which sucks, and for that I do give him a pass :)

I'm assuming you mean "XSS or CSRF". In both cases the first 2 letters denote "Cross Site".

But, I'm picking hairs, and as you say, the guy just lost a shed-load of coin, so mostly sympathy (with a bit of urge to educate) from this end.

EDIT: Sorry, your comment was slightly ambiguous, I apologize for picking on a typo, I originally thought you were saying that XSS and CSRF had nothing to do with "Cross Site" which, upon reading again, I noticed was not the case. (Also, I made the same typo (CRSF) while typing this and only caught it just before hitting the submit button!)

Re: How I got robbed of 34 btc on Mt.Gox today

#105

Post by dolphenstein »

amalag wrote: post #97
teraflop wrote: post #31

Earlier quoted context omitted.

The applet itself is pretty straightforward: it downloads the real payload, called "AdobeUpdate-Setup1.84.exe", from g2f.nl/0lczsoo and then runs it. By default, applets don't have permission to access the local filesystem or start processes, but this one has a digital signature which means the user is prompted to give it elevated permissions.

How did that executable transfer his bitcoins?

It didn't. "AdobeUpdate-Setup1.84.exe" is the executable that did the damage.

Re: How I got robbed of 34 btc on Mt.Gox today

#106

Post by sneak »

relix wrote: post #71
andyhmltn wrote: post #7

Earlier quoted context omitted.

That is true. 1) You really shouldn't be running java applets unless you are certain you want to. I have had Java disabled for about a year and have only seen a page that required it once. 2) The domain name should've been a dead giveaway 3) Why would MtGox refund it? You got your money stolen by someone else. It's not MtGox's fault at all.

One would expect a certain level of security measures for a site that directly influences your financial situation. Most CRUD applications require you to put in your old password when changing your new one. Apparently you can actually trade coins away from your account without typing your password on MtGox. That's just ridiculously unsecured.

No.

Re: How I got robbed of 34 btc on Mt.Gox today

#107

Post by plg »

I'm having trouble understanding the OP's problem with mt. gox. Is it that the OP wants mt. gox to have somehow prevented him from downloading and running malicious java code from some other third party website? (WTF dude) or is it more specific, that the OP thinks mt. gox should have somehow prevented the OP's credentials from being sniffed by said malicious program?

Re: How I got robbed of 34 btc on Mt.Gox today

#108

Post by amalag »

dolphenstein wrote: post #105
amalag wrote: post #97

Earlier quoted context omitted.

How did that executable transfer his bitcoins?

It didn't. "AdobeUpdate-Setup1.84.exe" is the executable that did the damage.

Yes, I understand the java applet executed the next file. How did the "AdobeUpdate-Setup1.84.exe" executable do the transfer?

Re: How I got robbed of 34 btc on Mt.Gox today

#109

Post by Intermernet »

andyhmltn wrote: post #57
Tomdarkness wrote: post #34

Earlier quoted context omitted.

I think that is a bit extreme. I'd suggest rather than not installing Java at all just to not install/disable the browser addons that allow java applets to execute. This way the only way you are going to be executing anything Java is by downloading the .jar (or a executable wrapper) and running it. To me if you have to download the .jar and run it then that is no different to downloading an executable and running it…

How is it extreme? The only time I've needed java is for minecraft. Luckily I'm not rocking windows so the chance of being hit by a 0-day is a bit lower (correct me if I'm wrong.) But stopping the chance of having everything in your digital (and in the case of money, personal) life stolen because you clicked on a link FAR outweighs the benefit of playing minecraft imo.

"Luckily I'm not rocking windows so the chance of being hit by a 0-day is a bit lower (correct me if I'm wrong.)"

As far as I know, if you run it, and it's written intelligently enough, you're in trouble no matter what OS you're on.

It doesn't matter if you're on Windows, OSX, Linux or System i V7, if you approve the app to run, it'll run.

Java is a bit dangerous that way, but it's also a bit awesome that way :-)

Post reply on HN