How I got robbed of 34 btc on Mt.Gox today • Hacker News Board

Re: How I got robbed of 34 btc on Mt.Gox today

#121

Post by tripzilch » Thu, Apr 11, 2013, 2:10 PM UTC

Intermernet wrote: post #104

tripzilch wrote: post #63

Earlier quoted context omitted.

I would have, but then the term " cross site injection attack", is again Javascript terminology (he probably meant XSS or CRSF, but the term "cross site" doesn't really apply to Java applets). However, the guy just got hacked out of about $8k worth of BC, which sucks, and for that I do give him a pass :)

I'm assuming you mean "XSS or CSRF". In both cases the first 2 letters denote "Cross Site". But, I'm picking hairs, and as you say, the guy just lost a shed-load of coin, so mostly sympathy (with a bit of urge to educate) from this end. EDIT: Sorry, your comment was slightly ambiguous, I apologize for picking on a typo, I originally thought you were saying that XSS and CSRF had nothing to do with "Cross Site" which,…

Well abovethread it turns out he must have clicked through all sorts of Java certificate warning boxes, or run an old vulnerable Java version -- now I feel about as sorry for him as someone whose laptop got stolen as they left it unattended on the table in a coffeeshop for a toilet break. You can wait for something to happen like that.

Re: How I got robbed of 34 btc on Mt.Gox today

#122

Post by tlrobinson » Thu, Apr 11, 2013, 2:13 PM UTC

axefrog wrote: post #35

MtGox really does run a subpar operation. There should be additional security checks when transferring money out of an account, and there should be the option to enable multifactor authentication. Back when they were originally hacked, this should have become top priority for them, along with making their service rock solid. If people are hacking and stealing from you, it's obvious you have something of value and nee…

I agree MtGox is subpar, but this isn't their fault. MtGox has two-factor auth, which the victim willfully didn't enable, and was infected with malware. There's not much else MtGox can do to protect against this sort of thing.

Re: How I got robbed of 34 btc on Mt.Gox today

#123

Post by andyhmltn » Thu, Apr 11, 2013, 2:13 PM UTC

Intermernet wrote: post #109

andyhmltn wrote: post #57

Earlier quoted context omitted.

How is it extreme? The only time I've needed java is for minecraft. Luckily I'm not rocking windows so the chance of being hit by a 0-day is a bit lower (correct me if I'm wrong.) But stopping the chance of having everything in your digital (and in the case of money, personal) life stolen because you clicked on a link FAR outweighs the benefit of playing minecraft imo.

"Luckily I'm not rocking windows so the chance of being hit by a 0-day is a bit lower (correct me if I'm wrong.)" As far as I know, if you run it, and it's written intelligently enough, you're in trouble no matter what OS you're on. It doesn't matter if you're on Windows, OSX, Linux or System i V7, if you approve the app to run, it'll run. Java is a bit dangerous that way, but it's also a bit awesome that way :-)

Oh of course. But the majority of virus' I've seen target windows specifically. So it is a bit lower when you're using something like Linux. But I just don't enable it :-)

Re: How I got robbed of 34 btc on Mt.Gox today

#124

Post by tripzilch » Thu, Apr 11, 2013, 2:13 PM UTC

willvarfar wrote: post #47

Is there a way that MtCox or somewhere could keep a blacklist of 'stolen' coins? So that they become worthless because nobody would be able to trade them?

I've seen this suggestion pop up many times in all sorts of discussions on bitcointalk.org forums. There's a bunch of pretty good reasons not to do it, I encourage you to look up those old discussions yourself.

Re: How I got robbed of 34 btc on Mt.Gox today

#125

Post by andyhmltn » Thu, Apr 11, 2013, 2:14 PM UTC

Tomdarkness wrote: post #83

andyhmltn wrote: post #57

Earlier quoted context omitted.

How is it extreme? The only time I've needed java is for minecraft. Luckily I'm not rocking windows so the chance of being hit by a 0-day is a bit lower (correct me if I'm wrong.) But stopping the chance of having everything in your digital (and in the case of money, personal) life stolen because you clicked on a link FAR outweighs the benefit of playing minecraft imo.

I think you need to go back and read what you replied to. Having Java installed but with Java disabled in your browser, like I suggested, means Java applets won't run in your browser at all. You'd need to download and execute the .jar or wrapper (which would be a executable anyway) which is no different from downloading any normal executable and running it.

Well yes I agree on that actually. Probably should've thought that through.

Re: How I got robbed of 34 btc on Mt.Gox today

#126

Post by tlrobinson » Thu, Apr 11, 2013, 2:14 PM UTC

Jach wrote: post #53

dan1234 wrote: post #28

Doesn't Mt.Gox have any 2 factor auth when it comes to approving transfers?

Yup, they use yubikey and in the past have even given free devices to customers. This guy didn't have one, which is simply irresponsible on his part.

They also support TOTP (Google Authenticator, etc)

Re: How I got robbed of 34 btc on Mt.Gox today

#127

Post by andyhmltn » Thu, Apr 11, 2013, 2:15 PM UTC

namdnay wrote: post #99

andyhmltn wrote: post #57

Earlier quoted context omitted.

How is it extreme? The only time I've needed java is for minecraft. Luckily I'm not rocking windows so the chance of being hit by a 0-day is a bit lower (correct me if I'm wrong.) But stopping the chance of having everything in your digital (and in the case of money, personal) life stolen because you clicked on a link FAR outweighs the benefit of playing minecraft imo.

Eclipse, Netbeans, IDEA, SoapUI, HermesJMS, Notes, SQLDeveloper, DB2 viewer. Chances are, if you're developing software you're going to use Java at some point

Hmm yes I guess. Although saying that, I've never used any of those tools (Well Eclipse and Netbeans but not for anymore than a few days.)

Re: How I got robbed of 34 btc on Mt.Gox today

#128

Post by amalag » Thu, Apr 11, 2013, 2:17 PM UTC

jacquesm wrote: post #119

amalag wrote: post #108

Earlier quoted context omitted.

Yes, I understand the java applet executed the next file. How did the "AdobeUpdate-Setup1.84.exe" executable do the transfer?

If it has file access permissions it can scan for wallet.dat in a few likely locations and then simply upload that file to a server, then delete the original and you're pretty sure that you'll have time enough to register a transaction with the bitcoin network.

OK thank you. So is the wallet.dat related to MtGox at all or is it just a standard bitcoin wallet file used by the standard clients?

Re: How I got robbed of 34 btc on Mt.Gox today

#129

Post by lmm » Thu, Apr 11, 2013, 2:24 PM UTC

tripzilch wrote: post #118

cookiecaper wrote: post #91

Earlier quoted context omitted.

If you download the blockchain from the P2P wallet client it always takes forever. You should download the blockchain once, put it on a USB drive, and then copy it into .bitcoin before you bootstrap a new machine with a wallet. There are also sites that offer downloads of tar'd versions of the blockchain, or torrents. Pretty much anything is going to be faster than downloading via a bitcoin client.

This thread appears to have a download/torrent for a recent version of the blockchain data. It's about 4.7GB, apparently. https://bitcointalk.org/index.php?topic=145386.0 So does that mean if you're not using BC via a wallet service, it requires at least 4.7GB of disk space in order to do its thing? How is this amount of data expected to grow in the future?

It's going to grow hugely (at least as long as punters keep using bitcoin); there's an expectation that clients will switch away from using the full history sooner or later, and there are mechanisms prepared for remaining reasonably secure with shorter histories.

Re: How I got robbed of 34 btc on Mt.Gox today

#130

Post by tlrobinson » Thu, Apr 11, 2013, 2:24 PM UTC

willvarfar wrote: post #47

Is there a way that MtCox or somewhere could keep a blacklist of 'stolen' coins? So that they become worthless because nobody would be able to trade them?

Here's an interesting (and controversial) proposal and discussion:

"Decentralised crime fighting using private set intersection protocols" - Mike Hearn

https://bitcointalk.org/index.php?topic=157130.0