Doesn't MtGox send out an email or SMS with a verification code before a transfer can take place? Ouch...
How I got robbed of 34 btc on Mt.Gox today
211–220 of 251 posts
Re: How I got robbed of 34 btc on Mt.Gox today
#212I get laughed at for using NoScript.
I use NoScript too, but the OP was lead to believe that they were accessing a video or an interactive chat, so they would likely have permitted scripts to run on that page anyway.
Re: How I got robbed of 34 btc on Mt.Gox today
#213Earlier quoted context omitted.
Will you demand compensation from your local authorities because they did not prevent you walking into a dark alley?
I'll re-quote the first sentence of my post: > I agree that MtGox shouldn't be doing any kind of refunding in this case. You didn't respond to my central point: blaming the victim.
>You didn't respond to my central point: blaming the victim.
Your central point is without merit. The "victim" is a victim, not of MtGox, but their own poor decisions.
Re: How I got robbed of 34 btc on Mt.Gox today
#214TLDR; OP runs java applet (either in browser or downloaded it). Java applet sends bitcoin from OP's MtGox account to the 'hackers' bitcoin address, using the OP's browser, which was logged in to his MtGox account at the time.
Yeah, this has fuck-all to do with bitcoins. Same thing could have happened with real money through paypal or a bank's website, except those are probably a few steps ahead of babby's first online banking website in terms of migitating against likely attack vectors.
Re: How I got robbed of 34 btc on Mt.Gox today
#215Actually, the only thing the hacker didn't do is ask the dude politely to give him (or her) the money. This wasn't a 0day bug, no XSS. The dude gave the hacker permission to run any code on his machine, therefore it's completely his own fault, and has nothing to do with MtGox.
Re: How I got robbed of 34 btc on Mt.Gox today
#216At $200 per bitcoin, this is a $6,800 lesson in "Don't visit random websites". At least they were open about being robbed. I wonder how many bitcoins were stolen in total? EDIT: Has anyone visited the URL to analyse the malware?
At the current exchange rate, his loss is now down to $2100...
Re: How I got robbed of 34 btc on Mt.Gox today
#217From the source of mtgox-chat.info: Yep, probably an exploit, there aren't many good reasons for a 10x10 applet. Let's download the jar. It contains a single 3.5KB payload. Let's use a Java decompiler (JD-GUI). import java.applet.Applet; import java.applet.AppletContext; import java.io.BufferedInputStream; import java.io.BufferedOutputStream; import java.io.FileNotFoundException; import java.io.FileOutputStream; impo…
The applet itself is pretty straightforward: it downloads the real payload, called "AdobeUpdate-Setup1.84.exe", from g2f.nl/0lczsoo and then runs it. By default, applets don't have permission to access the local filesystem or start processes, but this one has a digital signature which means the user is prompted to give it elevated permissions.
It also means that we can find out who made it by looking at the signature.
Unless there is somewhere you can buy a java signature with bitcoins.
Re: How I got robbed of 34 btc on Mt.Gox today
#218Earlier quoted context omitted.
We don't need sympathy or regulation. A simple market solution like voluntary bitcoin insurance would do the trick.
How do you propose to defend against insurance fraud? With mixing services available, there would seem to be very little risk in robbing one's own account.
[deleted]
Re: How I got robbed of 34 btc on Mt.Gox today
#219From the source of mtgox-chat.info: Yep, probably an exploit, there aren't many good reasons for a 10x10 applet. Let's download the jar. It contains a single 3.5KB payload. Let's use a Java decompiler (JD-GUI). import java.applet.Applet; import java.applet.AppletContext; import java.io.BufferedInputStream; import java.io.BufferedOutputStream; import java.io.FileNotFoundException; import java.io.FileOutputStream; impo…
Luckily, no one has Java enabled by default anymore.. right?
If you leave it running, you're asking for trouble.
Re: How I got robbed of 34 btc on Mt.Gox today
#220Earlier quoted context omitted.
We don't need sympathy or regulation. A simple market solution like voluntary bitcoin insurance would do the trick.
How do you propose to defend against insurance fraud? With mixing services available, there would seem to be very little risk in robbing one's own account.
You make the insurance price and due diligence bar high enough.