How I got robbed of 34 btc on Mt.Gox today • Hacker News Board

Re: How I got robbed of 34 btc on Mt.Gox today

#171

Post by throwawaycan » Thu, Apr 11, 2013, 5:36 PM UTC

TazeTSchnitzel wrote: post #19

From the source of mtgox-chat.info: Yep, probably an exploit, there aren't many good reasons for a 10x10 applet. Let's download the jar. It contains a single 3.5KB payload. Let's use a Java decompiler (JD-GUI). import java.applet.Applet; import java.applet.AppletContext; import java.io.BufferedInputStream; import java.io.BufferedOutputStream; import java.io.FileNotFoundException; import java.io.FileOutputStream; impo…

Look at str2, it says poutinecoutu Seems to be the username of someone in Quebec (Canada), coutu being a very common last name and poutine being the national dish. This nickname has been used quite a lot on different hacking forums: https://www.google.com/search?q=poutinecoutu&aq=f&oq...

Re: How I got robbed of 34 btc on Mt.Gox today

#172

Post by bri3d » Thu, Apr 11, 2013, 5:37 PM UTC

Pezmc wrote: post #25

TazeTSchnitzel wrote: post #19

From the source of mtgox-chat.info: Yep, probably an exploit, there aren't many good reasons for a 10x10 applet. Let's download the jar. It contains a single 3.5KB payload. Let's use a Java decompiler (JD-GUI). import java.applet.Applet; import java.applet.AppletContext; import java.io.BufferedInputStream; import java.io.BufferedOutputStream; import java.io.FileNotFoundException; import java.io.FileOutputStream; impo…

It sends log messages to http://www.galaxyjdb.com with your OS information and the state of the app.. /insert.php?o=*os.name*&u=*APPDATA*&ip=java.io.tmpdir&e=*APPSTATE* It appears to download an exe from http://g2f.nl/0lczsoo Then it tries to execute the exe: System.getenv("APPDATA") + "\\AdobeUpdate-Setup1.84.exe"; If at any point in the process it hits an exception, it sends the code for that exception to the galax…

The EXE is an AutoIt3 script (they didn't even scrub the AutoIt version from the PE metadata).

You can run the AutoIt3 script through Exe2Aut (an AutoIt decompiler) and you'll find a pretty mundane remote access toolkit which inserts itself into \Run, checks to see if it's running in a variety of virtualized environments, and, if it's not, can start one of a couple different remote control payloads. It looks like it's got a rudimentary Facebook credentials theft mechanism in its first stage as well.

This is a pretty common for-sale driveby script kiddie exploit - it's depressing how effective these still are.

Re: How I got robbed of 34 btc on Mt.Gox today

#173

Post by steveklabnik » Thu, Apr 11, 2013, 5:40 PM UTC

tripzilch wrote: post #54

So, how about if you could have a Linux boot image onna stick, properly secured, no Java, several BitCoin apps preinstalled and optimized to boot extremely quickly into what would basically be a sort of BitCoin Wallet dashboard interface. You could plug in the USB, hibernate, flip the switch and be Bitcoin banking within seconds. Then unhibernate and get on with whatever you were doing on your day-to-day OS. That way…

    > So, how about if you could have a Linux boot image onna stick, properly
    > secured, no Java, several BitCoin apps preinstalled and optimized to boot
    > extremely quickly into what would basically be a sort of BitCoin Wallet
    > dashboard interface.  You could plug in the USB, hibernate, flip the switch
    > and be Bitcoin banking within seconds. Then unhibernate and get on with
    > whatever you were doing on your day-to-day OS.
    > 
    > That way it can be completely separate from whatever risky, dangerous and/or
    > irresponsible things you do on a regular basis with your computer--things
    > that seemingly are worth the risk as long as they don't directly give
    > attackers access to thousands of $$$ digital cash.

Bitcoin: a currency for regular, everyday exchange.

Re: How I got robbed of 34 btc on Mt.Gox today

#174

Post by steveklabnik » Thu, Apr 11, 2013, 5:42 PM UTC

tripzilch wrote: post #15

> I then discovered that the site is loaded with a java script which, based on an initial analysis by my java programmer friend, is a 0 day java exploit with a cross site injection attack, which automatically started "Being a techie", I like to confuse Java and Javascript ...

I thought this too, but it downloads a Java applet.

Re: How I got robbed of 34 btc on Mt.Gox today

#175

Post by halcyondaze » Thu, Apr 11, 2013, 5:48 PM UTC

No offense to bitcoiners, but what are people expecting when the biggest exchange is "Magic The Gathering Online Exchange" for this "currency" ?

Re: How I got robbed of 34 btc on Mt.Gox today

#176

Post by nwh » Thu, Apr 11, 2013, 5:49 PM UTC

pilgrim689 wrote: post #112

ConceitedCode wrote: post #67

Earlier quoted context omitted.

The biggest issue I see would be updating the block chain for the wallet between uses. Seems like it takes longer and longer to update. Moved my wallet to a new computer last night and it's been going for the last 5 hours.

A workaround: the device you connect to has a bitcoin client running just to keep the block chain up to date. The USB key, upon connecting, syncs that block chain with the one stored on the key. When you connect to a new device, the block chain from the key is synced onto that new device. Depending on how often you switch device / how often you use the key, this might or might not be a useful workaround :P.

Even synching the block chain that is a few hours old is irritating, days or weeks old would be a nightmare.

Re: How I got robbed of 34 btc on Mt.Gox today

#177

Post by nwh » Thu, Apr 11, 2013, 5:50 PM UTC

tripzilch wrote: post #118

cookiecaper wrote: post #91

Earlier quoted context omitted.

If you download the blockchain from the P2P wallet client it always takes forever. You should download the blockchain once, put it on a USB drive, and then copy it into .bitcoin before you bootstrap a new machine with a wallet. There are also sites that offer downloads of tar'd versions of the blockchain, or torrents. Pretty much anything is going to be faster than downloading via a bitcoin client.

This thread appears to have a download/torrent for a recent version of the blockchain data. It's about 4.7GB, apparently. https://bitcointalk.org/index.php?topic=145386.0 So does that mean if you're not using BC via a wallet service, it requires at least 4.7GB of disk space in order to do its thing? How is this amount of data expected to grow in the future?

That's not even a large portion of the blockchain anymore. The full thing is 7GB now, and most of the large transactions are in the very recent bit.

Re: How I got robbed of 34 btc on Mt.Gox today

#178

Post by TazeTSchnitzel » Thu, Apr 11, 2013, 5:51 PM UTC

throwawaycan wrote: post #171

TazeTSchnitzel wrote: post #19

From the source of mtgox-chat.info: Yep, probably an exploit, there aren't many good reasons for a 10x10 applet. Let's download the jar. It contains a single 3.5KB payload. Let's use a Java decompiler (JD-GUI). import java.applet.Applet; import java.applet.AppletContext; import java.io.BufferedInputStream; import java.io.BufferedOutputStream; import java.io.FileNotFoundException; import java.io.FileOutputStream; impo…

Look at str2, it says poutinecoutu Seems to be the username of someone in Quebec (Canada), coutu being a very common last name and poutine being the national dish. This nickname has been used quite a lot on different hacking forums: https://www.google.com/search?q=poutinecoutu&aq=f&oq...

As I had noted in another comment, this product that this person is using is advertised on hackforums. (https://news.ycombinator.com/item?id=5531500) So I've gone on hackforums, searched for poutinecoutu, and what do you know? This might be him.

http://www.hackforums.net/member.php?action=profile&uid=...

So let's look at their recent posts:

http://www.hackforums.net/search.php?action=results&sid=...

>RE: Bitcoin prices collapse over $100 in a matter of hours

http://www.hackforums.net/showthread.php?tid=3398170&pid...

>RE: Buying 10+ BTC via Bank Transfer / Western Union

http://www.hackforums.net/showthread.php?tid=3392974&pid...

So this person knows what Bitcoin is and has some to sell.

Hmm, let's look much further back in their history.

> RE: Ψ #1 [SILENT JAVA DRIVE BY] FoxxyJava [0/37]★ FREE HOSTING ★ SPREAD FASTER! ★ [$20] Ψ

>Vouch for this amazing jdb. Keep good work. He is ALWAYS disponible for his clients. He helped me alot.

http://www.hackforums.net/showthread.php?tid=3005399&pid...

FoxyJava is a Java Drive-By, similar to this GalaxyJDB the exploit used. I wonder if he has also used GalaxyJDB? I can't see any replies, but it's possible. Let's go to the galaxyjdb site and see if the person who programmed the login was dumb enough to check username and password seperately: http://galaxyjdb.com/index.php?a=Login

...sadly not, it would seem. So I can't prove they use GalaxyJDB, or that this is even the person we're after, but I think it's very likely.

Re: How I got robbed of 34 btc on Mt.Gox today

#179

Post by jessriedel » Thu, Apr 11, 2013, 5:53 PM UTC

hodgesmr wrote: post #9

antr wrote: post #5

I'm not doubting Bitcoin's potential to become a true currency, but unless this type of smash-and-grab situation can be traced/avoided/insured (whatever the right mechanism is) it is going to be extremely hard to make ordinary businesses and people use it. People don't place value in the currency itself, but the system that provides certain security around it.

Banks that handle USD follow strict federal regulations on security procedures and insurance. If this happened at a bank, the OP would absolutely get his money back. Bitcoin needs federal regulations... oh wait...

Or the bank could insure this type of stuff just like you're not on the hook when someone steals your credit card. (It's not an exactly analogous situation, but there's nothing preventing banks from handling this based on reputation.) We don't need to instantly assume this requires the government to intervene.

Re: How I got robbed of 34 btc on Mt.Gox today

#180

Post by sequoia » Thu, Apr 11, 2013, 5:54 PM UTC

burntsushi wrote: post #163

dreen wrote: post #2

So... you ran a Java applet on a domain with mtgox in its name and didn't make sure that site is owned by MtGox? I'm sorry for your loss but what happened is your own fault entirely and I would be surprised if MtGox decides to refund you.

> I would be surprised if MtGox decides to refund you I agree that MtGox shouldn't be doing any kind of refunding in this case. > what happened is your own fault entirely You're blaming the victim. If I'm walking down a dark alley and someone pulls a gun on me and takes my wallet, is it my fault because I decided to walk down a dark alley? Not at all. The only person at fault here is the cracker who perpetrated the s…

        +-------------------------------------------------------+
	|                  SECURITY WARNING!                    |
	|  You are attempting to walk down a dark alley,        |
	|  which could be dangerous.  Only walk down            |
	|  dark alleys you are familiar with and trust.         |
	|  By walking down this alley you assume responsibility |
	|  for the attendant risks.                             |
	|                                                       |
	|  Do you still wish to walk down the dark alley?       |
	|  [x] Yes         [ ] Cancel                           |
	+-------------------------------------------------------+

Perhaps a better phrasing that "your own fault" is "it was 100% in his power to prevent this from happening. He is responsible for the fact that it happened."