This makes a lot more sense now:
How I got robbed of 34 btc on Mt.Gox today
131–140 of 251 posts
Re: How I got robbed of 34 btc on Mt.Gox today
#132Earlier quoted context omitted.
The applet itself is pretty straightforward: it downloads the real payload, called "AdobeUpdate-Setup1.84.exe", from g2f.nl/0lczsoo and then runs it. By default, applets don't have permission to access the local filesystem or start processes, but this one has a digital signature which means the user is prompted to give it elevated permissions.
Ah, that explains why it could get away with "Runtime.getRuntime().exec(str9);". Now, the thing is, I don't think the forum user mentioned clicking anything. However, it's possible they've stolen the signature from something else, which that person has previously chosen to "Always Accept"? (I don't know if Java lets you do that)
I think this may have been possible due to the purported Java exploit mentioned in the post:
"I then discovered that the site is loaded with a java script which, based on an initial analysis by my java programmer friend, is a 0 day java exploit with a cross site injection attack, which automatically started."
Re: How I got robbed of 34 btc on Mt.Gox today
#133Earlier quoted context omitted.
I think that is a bit extreme. I'd suggest rather than not installing Java at all just to not install/disable the browser addons that allow java applets to execute. This way the only way you are going to be executing anything Java is by downloading the .jar (or a executable wrapper) and running it. To me if you have to download the .jar and run it then that is no different to downloading an executable and running it…
How is it extreme? The only time I've needed java is for minecraft. Luckily I'm not rocking windows so the chance of being hit by a 0-day is a bit lower (correct me if I'm wrong.) But stopping the chance of having everything in your digital (and in the case of money, personal) life stolen because you clicked on a link FAR outweighs the benefit of playing minecraft imo.
http://krebsonsecurity.com/2012/04/urgent-fix-for-zero-day-m...
Macs get it too.
Linux theoretically can get these problems, but because every Linux machine is different, the malware would have to be written to be cross-distribution. (ie: One may work in Debian, but not in Fedora / Red Hat... depending on how things work out).
Nonetheless, some people write viruses for Debian specifically: http://www.securityspace.com/smysecure/catid.html?id=1.3.6.1...
It won't work on Red Hat, but the x86-specific 64-bit Debian was an attractive enough target for whoever wrote that one... I'm sure I can find a Red Hat Virus, Fedora Virus, Ubuntu virus, etc. etc. But they become increasingly rarer and rarer the fewer people use that specific distribution / OS.
Re: How I got robbed of 34 btc on Mt.Gox today
#134Earlier quoted context omitted.
If it has file access permissions it can scan for wallet.dat in a few likely locations and then simply upload that file to a server, then delete the original and you're pretty sure that you'll have time enough to register a transaction with the bitcoin network.
OK thank you. So is the wallet.dat related to MtGox at all or is it just a standard bitcoin wallet file used by the standard clients?
It's a Bitcoin concept. It's where your actual bitcoins are stored.
Re: How I got robbed of 34 btc on Mt.Gox today
#135Earlier quoted context omitted.
It sends log messages to http://www.galaxyjdb.com with your OS information and the state of the app.. /insert.php?o=*os.name*&u=*APPDATA*&ip=java.io.tmpdir&e=*APPSTATE* It appears to download an exe from http://g2f.nl/0lczsoo Then it tries to execute the exe: System.getenv("APPDATA") + "\\AdobeUpdate-Setup1.84.exe"; If at any point in the process it hits an exception, it sends the code for that exception to the galax…
AVG detects this as Luhe.Fiha.A Here's a mnetion from 2011: ( http://answers.microsoft.com/en-us/windows/forum/windows_7-s... ) So, someone using an OS heavily targeted by malware decides not to use anti-malware software, and to have javascript and apparently java enabled in the browser, and then chooses to visit an URL advertised in a chat window - that URL is unknown to that person, does not match the URL they're o…
I think they are trying to call it a false positive. They happen from time to time.
I wouldn't try to convince someone else they had a false positive without positively identifying the files in question though.
Re: How I got robbed of 34 btc on Mt.Gox today
#136So, how about if you could have a Linux boot image onna stick, properly secured, no Java, several BitCoin apps preinstalled and optimized to boot extremely quickly into what would basically be a sort of BitCoin Wallet dashboard interface. You could plug in the USB, hibernate, flip the switch and be Bitcoin banking within seconds. Then unhibernate and get on with whatever you were doing on your day-to-day OS. That way…
"Also, I'm not 100% sure if that hibernation trick is actually possible, I've never really seen it on multi-boot systems and I wonder why, but from what I understand about hibernation (RAM gets saved to HD, restored next boot) the components are there?"
It is possible, I've done it. If you're on a multi-boot system with Linux and Windows, you can freely hibernate either and boot into the other, as long as they completely don't touch each other. Neither can even mount the disk images of the other, let alone start changing things, or you face effectively-guaranteed corruption. Be careful with shared SD cards too. (I had it so Linux would never auto-mount those anyhow, so it was OK.)
The biggest objection I'd have to your plan is mostly that you'd also need some sort of backup plan, I don't think USB sticks are generally designed to store thousands of dollars' worth of stuff on them.
Re: How I got robbed of 34 btc on Mt.Gox today
#137Earlier quoted context omitted.
but bitcoins are like a digital cash - people don't expect to be compensated when their cash get burgled (at least, not by a bank).
In this analogy, his cash was held by the bank. He can say someone impersonated him to send it. But unfortunately he did not take advantage of two factor authentication and he got phished. Actually from reading more, i don't understand if MtGox is involved at all. Did the executable just steal the wallet.dat file from his hard drive and have nothing to do with MtGox?
Yeah - I'm unclear what's happening here as well. Did his bitcoins get stolen from wallet.dat, or did they get stolen from MtGox?
Re: How I got robbed of 34 btc on Mt.Gox today
#138I've not used Mt.Gox but does it let you perform transactions without authenticating again? Even if you were logged in to your account, I'd expect any kind of financial related website to perform some kind of re-authentication before processing any transaction. Perhaps with the exception of transferring funds to somewhere you've sent funds in the past.
If they have your wallet.dat file (which probably happened in this case), they don't even need to visit Mt. Gox to perform transactions.
The guy had a Trojan loaded up onto his computer where he stored his bitcoins. All this two-factor authentication stuff people are talking about is for `naut. He was attacked by a virus, and that virus stole bitcoins straight off of his computer.
Re: How I got robbed of 34 btc on Mt.Gox today
#139Earlier quoted context omitted.
It sends log messages to http://www.galaxyjdb.com with your OS information and the state of the app.. /insert.php?o=*os.name*&u=*APPDATA*&ip=java.io.tmpdir&e=*APPSTATE* It appears to download an exe from http://g2f.nl/0lczsoo Then it tries to execute the exe: System.getenv("APPDATA") + "\\AdobeUpdate-Setup1.84.exe"; If at any point in the process it hits an exception, it sends the code for that exception to the galax…
AVG detects this as Luhe.Fiha.A Here's a mnetion from 2011: ( http://answers.microsoft.com/en-us/windows/forum/windows_7-s... ) So, someone using an OS heavily targeted by malware decides not to use anti-malware software, and to have javascript and apparently java enabled in the browser, and then chooses to visit an URL advertised in a chat window - that URL is unknown to that person, does not match the URL they're o…
This isn't just an MS problem. Macs have the problem where users still believe their OS isn't vulnerable to malware and as such aren't careful either.
Re: How I got robbed of 34 btc on Mt.Gox today
#140Maybe I'm missing something something, but where exactly is the exploit here? (0-day no less)
AFAIU, the user was prompted to accept an autosigned applet, and he did so. After that, the outcome was inevitable. You may hate java all you like, but it seems like the user (inadvertently) gave this program permission to steal all his money.