Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Exodus Bitcoin Wallet: $490k swindle

popey.com

Post reply on HN
Print view View original

21–30 of 297 posts

Re: Exodus Bitcoin Wallet: $490k swindle

#21

Post by popey »

jstanley wrote: post #8

One point I would make: > it connects to some API at https://www.exchangerate-api.com/ This is not necessarily right. The exchangerate-api.com site is hosted behind Cloudflare, so I don't know where it's actually hosted, but the IP addresses shown in bandwhich could be unrelated. You also said: > Visiting one of those IPs redirects to https://www.exchangerate-api.com/ It is common for malicious sites to redirect to l…

Sure, there was a bit of guesswork on my part. I could analyse the traffic in more detail, but when I wrote this all up, it was Sunday evening, and I wanted to do the minimum analysis to get a response to the unlucky rube.

I still have the snap, and could test further, but I suspect the endpoint linode boxes will disappear and popup somewhere else sometime.

Re: Exodus Bitcoin Wallet: $490k swindle

#22

Post by popey »

redder23 wrote: post #3

Even the real version is the app is a software wallet right? If you have almost 500k in BTC and do not have it on a hardware wallet and use their official software for it, I have to say it's at least partially on you if you lose it.

Indeed, the victim, in this case, did mention on the linked 4chan thread that they realised their mistake. While we only see a small part of their world through text communication on forums, I suspect they're kicking themselves in the real world.

Or perhaps not, and they have a ton of other wallets full to the brim with crypto-nonsense.

Re: Exodus Bitcoin Wallet: $490k swindle

#23

Post by jstanley »

popey wrote: post #21
jstanley wrote: post #8

One point I would make: > it connects to some API at https://www.exchangerate-api.com/ This is not necessarily right. The exchangerate-api.com site is hosted behind Cloudflare, so I don't know where it's actually hosted, but the IP addresses shown in bandwhich could be unrelated. You also said: > Visiting one of those IPs redirects to https://www.exchangerate-api.com/ It is common for malicious sites to redirect to l…

Sure, there was a bit of guesswork on my part. I could analyse the traffic in more detail, but when I wrote this all up, it was Sunday evening, and I wanted to do the minimum analysis to get a response to the unlucky rube. I still have the snap, and could test further, but I suspect the endpoint linode boxes will disappear and popup somewhere else sometime.

What I mean was your wording implied that exchangerate-api.com was somehow implicated, but in my opinion that is too much of a leap to make.

The only thing implicating that site is a redirect that you got from a site that you know you don't trust.

Re: Exodus Bitcoin Wallet: $490k swindle

#24

Post by popol12 »

codetrotter wrote: post #9

This is scary and even a hardware wallet might not help. When I create a transaction with Electrum on my computer, I use a hardware wallet to sign the transaction. When I sign the transaction, the hardware wallet shows the amounts, and the output addresses. But if my copy of Electrum was backdoored and smart about what it did, it could use an output address for the remaining amount that went to another wallet. And si…

No, you're wrong. The issue you're describing can't be exploited on Ledger devices at least. (Source: I’m a contributor to their bitcoin transaction parsing code) Their hardware wallet checks if the provided change output's address is actually owned by the device owner:

- if it does, then the change output is simply hidden from the user validation flow

- if it doesn’t it will appear as a second bitcoin transfer to approve, which require a second physical approval on the device. this is highly unusual and should trigger the user's suspicion.

I can’t say for other vendors but this is pretty standard security practice I’m sure, hardware wallets are fighting against attacks that are way more elaborate than this one.

Re: Exodus Bitcoin Wallet: $490k swindle

#25

Post by popey »

edent wrote: post #5

What I don't get about the Snap store is why there's no verified link back to a website? If you have the technical ability to create an app, you probably have the ability to upload something to /.well-known/ or to add a DNS TXT record. That way the Snap store could say "This app came from this website." OK, it doesn't help if someone goes to the trouble of registering a homograph address, but it would at least give n…

Back in the day, we had long internal conversations about doing verification 'properly' with government-issued IDs, third-party verification agencies and the like. But that never amounted to anything, sadly.

They might consider it further if the store got to a decent scale (like the contemporaries like iOS, Play and Microsoft). But with "only" 6K applications published, and the money canon being pointed in other directions, I can't see it happening any time soon.

Re: Exodus Bitcoin Wallet: $490k swindle

#26

Post by popey »

jstanley wrote: post #23
popey wrote: post #21

Earlier quoted context omitted.

Sure, there was a bit of guesswork on my part. I could analyse the traffic in more detail, but when I wrote this all up, it was Sunday evening, and I wanted to do the minimum analysis to get a response to the unlucky rube. I still have the snap, and could test further, but I suspect the endpoint linode boxes will disappear and popup somewhere else sometime.

What I mean was your wording implied that exchangerate-api.com was somehow implicated, but in my opinion that is too much of a leap to make. The only thing implicating that site is a redirect that you got from a site that you know you don't trust.

Yes, I understood your point.

Re: Exodus Bitcoin Wallet: $490k swindle

#27

Post by [deleted] »

popey wrote: post #25
edent wrote: post #5

What I don't get about the Snap store is why there's no verified link back to a website? If you have the technical ability to create an app, you probably have the ability to upload something to /.well-known/ or to add a DNS TXT record. That way the Snap store could say "This app came from this website." OK, it doesn't help if someone goes to the trouble of registering a homograph address, but it would at least give n…

Back in the day, we had long internal conversations about doing verification 'properly' with government-issued IDs, third-party verification agencies and the like. But that never amounted to anything, sadly. They might consider it further if the store got to a decent scale (like the contemporaries like iOS, Play and Microsoft). But with "only" 6K applications published, and the money canon being pointed in other dire…

[deleted]

Re: Exodus Bitcoin Wallet: $490k swindle

#28

Post by lightweb »

reisse wrote: post #11
redder23 wrote: post #3

Even the real version is the app is a software wallet right? If you have almost 500k in BTC and do not have it on a hardware wallet and use their official software for it, I have to say it's at least partially on you if you lose it.

Bitcoin "wallet" is just a pair of public and private keys. Honest question - what is the difference between a "hardware wallet" and a thumbdrive with the keys on it, except for the price tag?

Bitcoin wallets are collections of private keys and corresponding public keys. They may or may not also be linked together hierarchically using ECDSA math, and possibly encrypted as well.

Re: Exodus Bitcoin Wallet: $490k swindle

#30

Post by ToucanLoucan »

shuntress wrote: post #17

If only there were some kind of system or network of long-standing institutions with a deep commitment to paper-trails and accountability that was overseen by some kind of community-managed regulation to control this type of thing.

Glad I'm not the only one who is thoroughly tired of this second coming of the financial system except with bonus insane energy waste and an absolute obliteration of consumer protections at seemingly every tier.

A security product built by people who have zero understanding of actual financial security and how financial crimes actually happen. Truly astonishing.

Post reply on HN