Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How I got robbed of 34 btc on Mt.Gox today

bitcointalk.org

Post reply on HN
Print view View original

141–150 of 251 posts

Re: How I got robbed of 34 btc on Mt.Gox today

#141

Post by dariopy »

amalag wrote: post #100
chii wrote: post #80

Earlier quoted context omitted.

but bitcoins are like a digital cash - people don't expect to be compensated when their cash get burgled (at least, not by a bank).

In this analogy, his cash was held by the bank. He can say someone impersonated him to send it. But unfortunately he did not take advantage of two factor authentication and he got phished. Actually from reading more, i don't understand if MtGox is involved at all. Did the executable just steal the wallet.dat file from his hard drive and have nothing to do with MtGox?

Did you read the FA? It was clearly stated that 1. the transaction took place in MtGox, and 2. the rest of his bitcoins were safely encrypted in his hard disk.

Re: How I got robbed of 34 btc on Mt.Gox today

#142

Post by dariopy »

tocomment wrote: post #74
teraflop wrote: post #40

Earlier quoted context omitted.

The funny thing is, this particular attack doesn't even involve a Java vulnerability. You have to either specifically grant the applet elevated permissions (giving it full access to your computer) or download and run something that claims to be a "Java updater" from the "g2f.nl" domain.

What I'm not getting is how a running executable can log into a website and initiate a transaction. It won't have your password right? Or is it just a keylogger to catch your password?

Like your regular XSRF, it relies on the user already being logged in some browser tab.

It probabley has a keylogger too.

Re: How I got robbed of 34 btc on Mt.Gox today

#143

Post by phormula »

jacquesm wrote: post #119
amalag wrote: post #108

Earlier quoted context omitted.

Yes, I understand the java applet executed the next file. How did the "AdobeUpdate-Setup1.84.exe" executable do the transfer?

If it has file access permissions it can scan for wallet.dat in a few likely locations and then simply upload that file to a server, then delete the original and you're pretty sure that you'll have time enough to register a transaction with the bitcoin network.

bitcoins were not stolen from a local wallet, rather they were withdrawn from his mtgox account to the thief's address.

Re: How I got robbed of 34 btc on Mt.Gox today

#145

Post by pjzedalis »

Intermernet wrote: post #81
dolphenstein wrote: post #52

Earlier quoted context omitted.

A signed applet can do pretty much anything an executable app can do if the user gives it permission. I built a little zip utility applet years ago that accesses the file system, ezyzip.com. Still works even though the signature is expired.

Wow, I hadn't noticed that about Java before, Just checked ezyzip.com. The sig is expired, but it only says that right at the bottom of the dialogue, and it still allows you to run it without a problem. I can imagine many people just clicking through that, as it seems almost identical to the standard Java applet warning. Oracle really need to change that, there should be flashing red lights (alright, maybe not flashi…

A valid certificate does not make a bad program good.

Re: How I got robbed of 34 btc on Mt.Gox today

#146

Post by danielweber »

DanBC wrote: post #16
mootothemax wrote: post #12

Mtgox has clearly not had time to respond, and I fear they will claim this is my fault as I have seen in other posts online that they say "report it to the police". They should compensate me 100%. This shows one of the fundamental problems with Bitcoin-related services: when people get taken advantage of, they expect to be compensated. While in the real world, banks will often compensate you if you're the victim of f…

...and banks will only compensate if they really have to because there are laws compelling them to do so. If they can get away with saying it's your fault they will. While I have sympathy for the author it was a pretty silly thing to do.

"Federal Reserve Regulation E guarantees that US consumers are made whole when their bank passwords are stolen"

From http://research.microsoft.com/apps/pubs/default.aspx?id=1618...

Of course, as that paper points out, the traditional electronic money system is incredibly reversible. If someone transfers $50,000 from my personal bank account to someone else's bank account, it's pretty easy for it to be undone.

The bottleneck is the money mules who are hired (read: suckered) into engaging in irreversible transactions.

Re: How I got robbed of 34 btc on Mt.Gox today

#147

Post by danielweber »

mikeash wrote: post #117
mootothemax wrote: post #12

Mtgox has clearly not had time to respond, and I fear they will claim this is my fault as I have seen in other posts online that they say "report it to the police". They should compensate me 100%. This shows one of the fundamental problems with Bitcoin-related services: when people get taken advantage of, they expect to be compensated. While in the real world, banks will often compensate you if you're the victim of f…

I felt sorry for the guy up to this point. You have the notoriously insecure Java plugin enabled in the same browser you use to access your digital cash, and you click on random links in a chat full of people with accounts on the same digital cash site? No, that's your fault, not Mtgox's. He goes on to say, "First because their site is not secured against such rudimentary attacks as has been demonstrated today." I ca…

Does Mt Gox require you to enable client-side Java?

I don't like running Java on my computers even if they don't have access to $10,000 worth of bitcoins.

Re: How I got robbed of 34 btc on Mt.Gox today

#148

Post by danielweber »

lucian1900 wrote: post #79
antr wrote: post #14

Earlier quoted context omitted.

Agree. When a transaction is not authorised by the account holder, this transaction is legally invalid. Any bank would give the money back in this kind of situation. I can't imagine my parents (or 99% of the adult population) being liable for this theft when "proper security precautions" means knowing when to detect and avoid a "0 day java exploit with a cross site injection attack".

Not really. Most banks I've asked would not refund if the victim did not take proper security measures, and the OP in this case most certainly did not.

Banks are required to make users whole, even if the user's password is compromised. At least for individual accounts. (For businesses the situation is different.)

http://research.microsoft.com/apps/pubs/default.aspx?id=1618...

Re: How I got robbed of 34 btc on Mt.Gox today

#149

Post by jes5199 »

The non-reversibility of bitcoin transactions is a huge liability. Our current state of software technology was designed in a world where the most valuable/dangerous thing you could possibly have on your disk or on a web site was, what, your ssh keys? Nude photos of yourself?

The value of hacking, phishing, etc is significantly increased by the presence of bitcoins.

I guess you could argue that if bitcoins are popular, software practices will evolve to be much more secure - but until then, it's wild west, and much more wild than the internet ever was before.

Re: How I got robbed of 34 btc on Mt.Gox today

#150

Post by DanBC »

axefrog wrote: post #103
zwily wrote: post #86

Earlier quoted context omitted.

"Oh come on, how hard is it for MtGox to implement TOTP and tell users to download Google Authenticator?" Not hard, and they did it a long time ago. The user didn't opt in.

When I signed up for an account, there was no obvious prompting to go and turn it on. It's all well and good having extra security, but if you don't actively try to get your users to make use of it, it's only going to be marginally useful.

That user was aware of extra MtGox security and chose not to use it.

On top of that the user

1) Chose to turn off (or not use) malware software

2) Enabled Java in the browser

3) Chose to visit a short url link presented in a chat window

4) Clicked through a big scary warning

All while still logged into their MtGox account.

It sucks that they're a victim of crime, but their actions were dumb.

Post reply on HN