From the source of mtgox-chat.info: Yep, probably an exploit, there aren't many good reasons for a 10x10 applet. Let's download the jar. It contains a single 3.5KB payload. Let's use a Java decompiler (JD-GUI). import java.applet.Applet; import java.applet.AppletContext; import java.io.BufferedInputStream; import java.io.BufferedOutputStream; import java.io.FileNotFoundException; import java.io.FileOutputStream; impo…
codedbyorpheu http://www.orpheusinternet.com/portfolio ? Also http://pastebin.com/DTiv1TJq http://pastebin.com/S6V3fZcs http://www.galaxyjdb.com/index.php?a=DeveloperTeam
How I got robbed of 34 btc on Mt.Gox today
51–60 of 251 posts
Re: How I got robbed of 34 btc on Mt.Gox today
#52Earlier quoted context omitted.
Just appears to be an applet that downloads the actual payload . Although, I'm not a security expert and I can't see where the actual exploit is that would allow the file to be downloaded and executed.
Runtime.getRuntime().exec(str9); Why this works is beyond me, but that looks like the actual call to execute it.
A signed applet can do pretty much anything an executable app can do if the user gives it permission. I built a little zip utility applet years ago that accesses the file system, ezyzip.com. Still works even though the signature is expired.
Re: How I got robbed of 34 btc on Mt.Gox today
#53Doesn't Mt.Gox have any 2 factor auth when it comes to approving transfers?
Yup, they use yubikey and in the past have even given free devices to customers. This guy didn't have one, which is simply irresponsible on his part.
Re: How I got robbed of 34 btc on Mt.Gox today
#54So, how about if you could have a Linux boot image onna stick, properly secured, no Java, several BitCoin apps preinstalled and optimized to boot extremely quickly into what would basically be a sort of BitCoin Wallet dashboard interface.
You could plug in the USB, hibernate, flip the switch and be Bitcoin banking within seconds. Then unhibernate and get on with whatever you were doing on your day-to-day OS.
That way it can be completely separate from whatever risky, dangerous and/or irresponsible things you do on a regular basis with your computer--things that seemingly are worth the risk as long as they don't directly give attackers access to thousands of $$$ digital cash.
Question, I'm making a rough guess that a realistic speed-optimized fast boot-time for a Linux OS that doesn't need to do much is in the order of five seconds, is that about right? Also, I'm not 100% sure if that hibernation trick is actually possible, I've never really seen it on multi-boot systems and I wonder why, but from what I understand about hibernation (RAM gets saved to HD, restored next boot) the components are there?
And, make it look unlike any other OS, to make users instantly aware if they're operating on their banking/money "inside the stick" or "out in the open" (on the regular OS). For instance, a glowy green CRT terminal filter.
Re: How I got robbed of 34 btc on Mt.Gox today
#55Is there a way that MtCox or somewhere could keep a blacklist of 'stolen' coins? So that they become worthless because nobody would be able to trade them?
Without making that database universal it just means some poor merchant that accepts bit coins is going to get stiffed.
Re: How I got robbed of 34 btc on Mt.Gox today
#56Earlier quoted context omitted.
It's a long time since I went anywhere near Java (let alone an applet) - but these lines don't look very nice: String str2 = System.getenv("APPDATA"); String str5 = str2 + "\\"; String str6 = "AdobeUpdate-Setup1.84##e"; String str9 = str5.concat(str6.replace("##", ".ex")); Runtime.getRuntime().exec(str9);
From a quick glance it would appear it tries to execute: C:\Users\ \AppData\Roaming\AdobeUpdate-Setup1.84.exe Just appears to be a rudimentary attempt at obfuscating the executable path. The question is, how come the JVM is allowing Runtime.getRuntime().exec() to be called.
According to an up thread commenter, it's digitally signed which allows a prompt to the user for elevated permissions.
Re: How I got robbed of 34 btc on Mt.Gox today
#57A bit off topic, but if you care about security DO NOT INSTALL JAVA to your computer. I'm JAVA free for the last ~5 years and I never really needed it. Java's security track is horrible and it's quite popular target.
I think that is a bit extreme. I'd suggest rather than not installing Java at all just to not install/disable the browser addons that allow java applets to execute. This way the only way you are going to be executing anything Java is by downloading the .jar (or a executable wrapper) and running it. To me if you have to download the .jar and run it then that is no different to downloading an executable and running it…
How is it extreme? The only time I've needed java is for minecraft. Luckily I'm not rocking windows so the chance of being hit by a 0-day is a bit lower (correct me if I'm wrong.)
But stopping the chance of having everything in your digital (and in the case of money, personal) life stolen because you clicked on a link FAR outweighs the benefit of playing minecraft imo.
Re: How I got robbed of 34 btc on Mt.Gox today
#58MtGox really does run a subpar operation. There should be additional security checks when transferring money out of an account, and there should be the option to enable multifactor authentication. Back when they were originally hacked, this should have become top priority for them, along with making their service rock solid. If people are hacking and stealing from you, it's obvious you have something of value and nee…
They do have two-factor authentication, which the user admittedly didn't opt in to. See https://support.mtgox.com/entries/21743327-Security
Ah, my bad.
Re: How I got robbed of 34 btc on Mt.Gox today
#59Earlier quoted context omitted.
Ah, that explains why it could get away with "Runtime.getRuntime().exec(str9);". Now, the thing is, I don't think the forum user mentioned clicking anything. However, it's possible they've stolen the signature from something else, which that person has previously chosen to "Always Accept"? (I don't know if Java lets you do that)
Since I don't have an mtgox account, and I have a fair degree of confidence that the code posted can't possibly escape the Java sandbox, I decided to live dangerously and try loading the page. Here's the warning screen that comes up when you load it: http://i.imgur.com/sXDoFLt.png Note the self-signed certificate from "North Sumatra". Gotta say, I have no sympathy for someone who clicks through that warning screen an…
Ops :/ today I just clicked through that screen to run the bitcoin miner i downloaded from bitminter.com. Because I did not realize that, this is a warning from java, really confusing.
Re: How I got robbed of 34 btc on Mt.Gox today
#60From the source of mtgox-chat.info: Yep, probably an exploit, there aren't many good reasons for a 10x10 applet. Let's download the jar. It contains a single 3.5KB payload. Let's use a Java decompiler (JD-GUI). import java.applet.Applet; import java.applet.AppletContext; import java.io.BufferedInputStream; import java.io.BufferedOutputStream; import java.io.FileNotFoundException; import java.io.FileOutputStream; impo…
>> if (str1 != "yes")
Thats some dodgy java code right there. (You should use .equals() )