Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How I got robbed of 34 btc on Mt.Gox today

bitcointalk.org

Post reply on HN
Print view View original

71–80 of 251 posts

Re: How I got robbed of 34 btc on Mt.Gox today

#71

Post by relix »

andyhmltn wrote: post #7
dreen wrote: post #2

So... you ran a Java applet on a domain with mtgox in its name and didn't make sure that site is owned by MtGox? I'm sorry for your loss but what happened is your own fault entirely and I would be surprised if MtGox decides to refund you.

That is true. 1) You really shouldn't be running java applets unless you are certain you want to. I have had Java disabled for about a year and have only seen a page that required it once. 2) The domain name should've been a dead giveaway 3) Why would MtGox refund it? You got your money stolen by someone else. It's not MtGox's fault at all.

One would expect a certain level of security measures for a site that directly influences your financial situation. Most CRUD applications require you to put in your old password when changing your new one. Apparently you can actually trade coins away from your account without typing your password on MtGox. That's just ridiculously unsecured.

Re: How I got robbed of 34 btc on Mt.Gox today

#72

Post by StavrosK »

DanBC wrote: post #65
axefrog wrote: post #35

MtGox really does run a subpar operation. There should be additional security checks when transferring money out of an account, and there should be the option to enable multifactor authentication. Back when they were originally hacked, this should have become top priority for them, along with making their service rock solid. If people are hacking and stealing from you, it's obvious you have something of value and nee…

This wasn't someone hacking MtGox. This was someone on a vulnerable OS, running without malware protection, with Java active in the browser, visiting an unknown link, and possibly giving an application permission to run. (Although maybe it didn't need permission to run?) To get to that point the person needed to ignore several well established security principles.

Oh come on, how hard is it for MtGox to implement TOTP and tell users to download Google Authenticator? It's not really that much hassle to enter a code each time you want to make a transaction, and these things wouldn't happen.

Sure, the user was being stupid here, but MtGox didn't do them any favors either.

Re: How I got robbed of 34 btc on Mt.Gox today

#73

Post by axefrog »

DanBC wrote: post #65
axefrog wrote: post #35

MtGox really does run a subpar operation. There should be additional security checks when transferring money out of an account, and there should be the option to enable multifactor authentication. Back when they were originally hacked, this should have become top priority for them, along with making their service rock solid. If people are hacking and stealing from you, it's obvious you have something of value and nee…

This wasn't someone hacking MtGox. This was someone on a vulnerable OS, running without malware protection, with Java active in the browser, visiting an unknown link, and possibly giving an application permission to run. (Although maybe it didn't need permission to run?) To get to that point the person needed to ignore several well established security principles.

Yes, but we have to assume the majority of people are not going to be particularly educated on stuff like this. Implementing simple checks before confirming a transfer out of an account should be a given.

Re: How I got robbed of 34 btc on Mt.Gox today

#74

Post by tocomment »

teraflop wrote: post #40
Tarilo wrote: post #6

This is exactly why everyone on the internet keeps saying that you shouldn't automatically run Java applets or shouldn't have Java installed at all on your computer. Java is just such a big target for hackers nowadays, that there will always be zero-days.

The funny thing is, this particular attack doesn't even involve a Java vulnerability. You have to either specifically grant the applet elevated permissions (giving it full access to your computer) or download and run something that claims to be a "Java updater" from the "g2f.nl" domain.

What I'm not getting is how a running executable can log into a website and initiate a transaction. It won't have your password right? Or is it just a keylogger to catch your password?

Re: How I got robbed of 34 btc on Mt.Gox today

#75

Post by chii »

andy_boot wrote: post #60
TazeTSchnitzel wrote: post #19

From the source of mtgox-chat.info: Yep, probably an exploit, there aren't many good reasons for a 10x10 applet. Let's download the jar. It contains a single 3.5KB payload. Let's use a Java decompiler (JD-GUI). import java.applet.Applet; import java.applet.AppletContext; import java.io.BufferedInputStream; import java.io.BufferedOutputStream; import java.io.FileNotFoundException; import java.io.FileOutputStream; impo…

>> if (str1 != "yes") Thats some dodgy java code right there. (You should use .equals() )

its decompiled code, so you'd have to forgive the bad style.

Re: How I got robbed of 34 btc on Mt.Gox today

#76

Post by RyanZAG »

Isn't this exactly what Bitcoin was created for - to allow unregulated access to currency? I guess people don't really realize what unregulated actually means - and nor do they realize why you really do want regulated currency.

This kind of thing happens all the time with real banks, but with real banks, all transactions can be traced and reversed. Law enforcement can follow the required documentation to find the owner of any account on a global level. This is exactly what Bitcoin was created to avoid.

Well guess what? When you avoid the regulation, you take the safety of the currency into your own hands. MtGox should not refund this in any way shape or form. The problem was entirely his fault. He did not secure his MtGox account with available two-factor authentication. He ran untrusted code at full permission on his PC. He needs to take some responsibility for his own use of an unsecured currency on an unsecured website with unsecured authentication and running untrusted code.

Zero sympathy from me. Maybe it will be a wake up call to others to actually think about their decisions. Shouting about the 'nanny state' and using bitcoin, and then turning around and looking for a nanny to help him out when he goes around it is pathetic.

Re: How I got robbed of 34 btc on Mt.Gox today

#77

Post by DanBC »

tripzilch wrote: post #54

So, how about if you could have a Linux boot image onna stick, properly secured, no Java, several BitCoin apps preinstalled and optimized to boot extremely quickly into what would basically be a sort of BitCoin Wallet dashboard interface. You could plug in the USB, hibernate, flip the switch and be Bitcoin banking within seconds. Then unhibernate and get on with whatever you were doing on your day-to-day OS. That way…

ASUS EEE PC had a 5 second Fedora boot in 2008. This was with an SSD; into a graphical desktop with disk and cpu idle; network manager was ready but the network wasn't up.

(https://lwn.net/Articles/299483/)

As for looks - desktop wallpaper with instructions and big red borders.

Re: How I got robbed of 34 btc on Mt.Gox today

#78

Post by psionski »

ConceitedCode wrote: post #67
tripzilch wrote: post #54

So, how about if you could have a Linux boot image onna stick, properly secured, no Java, several BitCoin apps preinstalled and optimized to boot extremely quickly into what would basically be a sort of BitCoin Wallet dashboard interface. You could plug in the USB, hibernate, flip the switch and be Bitcoin banking within seconds. Then unhibernate and get on with whatever you were doing on your day-to-day OS. That way…

The biggest issue I see would be updating the block chain for the wallet between uses. Seems like it takes longer and longer to update. Moved my wallet to a new computer last night and it's been going for the last 5 hours.

Blockchain.info wallets are pretty nice, they do client-side encryption with separate log-in and spending passwords (so your private key is encrypted inside an encrypted .json file and the first password decrypts only the outer layer).

You also get email (or dropbox or file download) backups that you can use in other Bitcoin clients in case something bad happens to blockchain.info.

Re: How I got robbed of 34 btc on Mt.Gox today

#79

Post by lucian1900 »

antr wrote: post #14
hodgesmr wrote: post #9

Earlier quoted context omitted.

Banks that handle USD follow strict federal regulations on security procedures and insurance. If this happened at a bank, the OP would absolutely get his money back. Bitcoin needs federal regulations... oh wait...

Agree. When a transaction is not authorised by the account holder, this transaction is legally invalid. Any bank would give the money back in this kind of situation. I can't imagine my parents (or 99% of the adult population) being liable for this theft when "proper security precautions" means knowing when to detect and avoid a "0 day java exploit with a cross site injection attack".

Not really. Most banks I've asked would not refund if the victim did not take proper security measures, and the OP in this case most certainly did not.

Re: How I got robbed of 34 btc on Mt.Gox today

#80

Post by chii »

mootothemax wrote: post #12

Mtgox has clearly not had time to respond, and I fear they will claim this is my fault as I have seen in other posts online that they say "report it to the police". They should compensate me 100%. This shows one of the fundamental problems with Bitcoin-related services: when people get taken advantage of, they expect to be compensated. While in the real world, banks will often compensate you if you're the victim of f…

but bitcoins are like a digital cash - people don't expect to be compensated when their cash get burgled (at least, not by a bank).
Post reply on HN