Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How I got robbed of 34 btc on Mt.Gox today

bitcointalk.org

Post reply on HN
Print view View original

161–170 of 251 posts

Re: How I got robbed of 34 btc on Mt.Gox today

#161

Post by ChuckMcM »

RyanZAG wrote: post #76

Isn't this exactly what Bitcoin was created for - to allow unregulated access to currency? I guess people don't really realize what unregulated actually means - and nor do they realize why you really do want regulated currency. This kind of thing happens all the time with real banks, but with real banks, all transactions can be traced and reversed. Law enforcement can follow the required documentation to find the own…

BitCoin, the Internet's answer to "Capture the Flag" now with scoring in dollars.

Re: How I got robbed of 34 btc on Mt.Gox today

#162

Post by jacquesm »

phormula wrote: post #143
jacquesm wrote: post #119

Earlier quoted context omitted.

If it has file access permissions it can scan for wallet.dat in a few likely locations and then simply upload that file to a server, then delete the original and you're pretty sure that you'll have time enough to register a transaction with the bitcoin network.

bitcoins were not stolen from a local wallet, rather they were withdrawn from his mtgox account to the thief's address.

Ah, yes of course a mtgox balance would be at risk as well. I'd definitely check to see if my wallet had not been ripped as well.

Re: How I got robbed of 34 btc on Mt.Gox today

#163

Post by burntsushi »

dreen wrote: post #2

So... you ran a Java applet on a domain with mtgox in its name and didn't make sure that site is owned by MtGox? I'm sorry for your loss but what happened is your own fault entirely and I would be surprised if MtGox decides to refund you.

> I would be surprised if MtGox decides to refund you

I agree that MtGox shouldn't be doing any kind of refunding in this case.

> what happened is your own fault entirely

You're blaming the victim.

If I'm walking down a dark alley and someone pulls a gun on me and takes my wallet, is it my fault because I decided to walk down a dark alley? Not at all.

The only person at fault here is the cracker who perpetrated the scam.

The only thing you can say about the victim in this case is that they aren't very sensible. Just like walking down dark alleys might not be sensible. But it's not the OP's fault that someone stole something from him.

Re: How I got robbed of 34 btc on Mt.Gox today

#164

Post by ritchiea »

RyanZAG wrote: post #76

Isn't this exactly what Bitcoin was created for - to allow unregulated access to currency? I guess people don't really realize what unregulated actually means - and nor do they realize why you really do want regulated currency. This kind of thing happens all the time with real banks, but with real banks, all transactions can be traced and reversed. Law enforcement can follow the required documentation to find the own…

Can't we just keep everything unregulated until it's inconvenient for me that it's unregulated?

Re: How I got robbed of 34 btc on Mt.Gox today

#165

Post by wereHamster »

Intermernet wrote: post #113
wereHamster wrote: post #98

"site is loaded with a java script" - srsly? You do ebanking (or ebitcoining) on a computer which has java installed?

I hate to say it, but (at least in Australia) many banks require Java to do business banking. This should change (at the glacial rate banks change things) as they realise that Java in the browser is risky business. This may change if Oracle pull their finger out, stop being dicks about the licensing, and try to promote the language again. Honestly, I think they've left it too late and the majority of "Java" you're go…

Then at least have a virtual machine snapshot of a clean install of OS+Java+Browser and always boot from the snapshot when doing internet business.

Re: How I got robbed of 34 btc on Mt.Gox today

#167

Post by revelation »

Pezmc wrote: post #25
TazeTSchnitzel wrote: post #19

From the source of mtgox-chat.info: Yep, probably an exploit, there aren't many good reasons for a 10x10 applet. Let's download the jar. It contains a single 3.5KB payload. Let's use a Java decompiler (JD-GUI). import java.applet.Applet; import java.applet.AppletContext; import java.io.BufferedInputStream; import java.io.BufferedOutputStream; import java.io.FileNotFoundException; import java.io.FileOutputStream; impo…

It sends log messages to http://www.galaxyjdb.com with your OS information and the state of the app.. /insert.php?o=*os.name*&u=*APPDATA*&ip=java.io.tmpdir&e=*APPSTATE* It appears to download an exe from http://g2f.nl/0lczsoo Then it tries to execute the exe: System.getenv("APPDATA") + "\\AdobeUpdate-Setup1.84.exe"; If at any point in the process it hits an exception, it sends the code for that exception to the galax…

The exe it downloads seems to be a compiled AutoIt3 script.

Here it is cleaned up: http://pastebin.com/raw.php?i=neP9qXGM

Seems like yet another dropper, not the actual bad thing.

Re: How I got robbed of 34 btc on Mt.Gox today

#168

Post by serf »

danielweber wrote: post #147
mikeash wrote: post #117

Earlier quoted context omitted.

I felt sorry for the guy up to this point. You have the notoriously insecure Java plugin enabled in the same browser you use to access your digital cash, and you click on random links in a chat full of people with accounts on the same digital cash site? No, that's your fault, not Mtgox's. He goes on to say, "First because their site is not secured against such rudimentary attacks as has been demonstrated today." I ca…

Does Mt Gox require you to enable client-side Java? I don't like running Java on my computers even if they don't have access to $10,000 worth of bitcoins.

No.

In fact, I use a curses based program alongside the Mt.Gox API.

I had to log in at one point, obviously, but I can handle it all using the API now.

For those interested : https://github.com/prof7bit/goxtool

Re: How I got robbed of 34 btc on Mt.Gox today

#169

Post by jeremyjh »

salvadors wrote: post #156
danielweber wrote: post #146

Earlier quoted context omitted.

"Federal Reserve Regulation E guarantees that US consumers are made whole when their bank passwords are stolen" From http://research.microsoft.com/apps/pubs/default.aspx?id=1618... Of course, as that paper points out, the traditional electronic money system is incredibly reversible. If someone transfers $50,000 from my personal bank account to someone else's bank account, it's pretty easy for it to be undone. The bot…

> If someone transfers $50,000 from my personal bank account to someone else's bank account, it's pretty easy for it to be undone. That depends on the timeframe. Once the money has been moved out of that new account again things start getting much harder.

Not really. If a Bank gets a reversal before funds have cleared its pretty straightforward and the stack will almost unwind itself as each Bank reverses credits to the accounts in response to reversals before them. Depending on type of transfer yes there is a date beyond which reversals are not possible but the number of transfers has little to do with it.

Re: How I got robbed of 34 btc on Mt.Gox today

#170

Post by pbhjpbhj »

Intermernet wrote: post #81
dolphenstein wrote: post #52

Earlier quoted context omitted.

A signed applet can do pretty much anything an executable app can do if the user gives it permission. I built a little zip utility applet years ago that accesses the file system, ezyzip.com. Still works even though the signature is expired.

Wow, I hadn't noticed that about Java before, Just checked ezyzip.com. The sig is expired, but it only says that right at the bottom of the dialogue, and it still allows you to run it without a problem. I can imagine many people just clicking through that, as it seems almost identical to the standard Java applet warning. Oracle really need to change that, there should be flashing red lights (alright, maybe not flashi…

Anyone else thinking dolphenstein is an evil genius cracker who just got a load of HNers to run his exploit?
Post reply on HN