Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

“Crypto drainer” template facilitates theft

blog.confiant.com

Post reply on HN
Print view View original

91–100 of 228 posts

Re: “Crypto drainer” template facilitates theft

#91

Post by api »

zeven7 wrote: post #82
dcolkitt wrote: post #62

Earlier quoted context omitted.

That's not how it works at all. When you connect a wallet, the only unrestricted access it gives the app is the ability to see your public address. The app does not have the ability to sign transactions on your behalf without your explicit approval.

It depends on the website and the wallet, but either way the wallet app tells you what permissions it's giving the website. My guess is people don't pay attention or think about it. But it's not as parent described "the way the crypto community designed it". It's actually the opposite. The crypto community designed wallets that give you control over what third parties are allowed to do with your accounts. It's a lot…

> My guess is people don't pay attention or think about it.

This is a well known fact in secure system design. Most people just click through dialogs. If you must get their attention you have to make the dialog huge and scary but then people will usually just turn back instead of reading. Scary dialogs make it seem like you should never say OK.

Re: “Crypto drainer” template facilitates theft

#92

Post by koprulusector »

I am honestly mind blown that a scam tool like this isn’t minified and uglified to obfuscate reverse engineering. The process also strips comments, which I imagine would’ve been a preference of the perpetrator.

I assume the example from the author [of the blog post] must’ve been a deployment by someone without much experience with the javascript ecosystem or extremely lazy. Pretending this assumption is correct, what does it tell us? Is it a reflection of the environment’s lack of regulation (even industry/market led, like PCI) and a deluge of unsophisticated (ignorant) users/consumers?

Re: “Crypto drainer” template facilitates theft

#93

Post by Barrera »

dcolkitt wrote: post #64
Barrera wrote: post #50

> Victim connects their wallet to “mint”. It's not clear exactly what's going on here. The word "connect" by itself implies two modes: (1) present public keys; or (2) present private keys. But the loss of property suggests it's (2). If so, then the people falling for this are hopelessly incompetent. Of course, this has been a problem from the start of Bitcoin. Users "buy" something they have no clue how to secure. Th…

All connecting a wallet does is allow the app to see your public keys. Private keys are not directly exposed. The app can then request the user sign transactions, but they must be explicitly approved by the user. Where fraud typically happens is when a user thinks they're signing an innocuous transaction, when in fact they're signing a malicious one. This is generally a hard problem, but it's very clear from the wall…

Where do the private keys reside in this scenario?

Re: “Crypto drainer” template facilitates theft

#94

Post by peyton »

gowld wrote: post #70
Barrera wrote: post #50

> Victim connects their wallet to “mint”. It's not clear exactly what's going on here. The word "connect" by itself implies two modes: (1) present public keys; or (2) present private keys. But the loss of property suggests it's (2). If so, then the people falling for this are hopelessly incompetent. Of course, this has been a problem from the start of Bitcoin. Users "buy" something they have no clue how to secure. Th…

CBDC has never been about blockchain or cryptocurrency. That's what the first "C" means, and why the "D" isn't a C". It's Venmo or Zelle but run by the government bank.

Here's the Fed's Project Hamilton experiment [1]:

> In our design users interact with a central transaction processor using digital wallets storing cryptographic keys. Funds are addressed to public keys and wallets create cryptographic signatures to authorize payments. The transaction processor, run by a trusted operator (such as the central bank), stores cryptographic hashes representing unspent central bank funds. Each hash commits to a public key and value. Wallets issue signed transactions which destroy the funds being spent and create an equivalent amount of new funds owned by the receiver. The transaction processor validates transactions and atomically and durably applies changes to the set of unspent funds. In this version of our work, there are no intermediaries, fees, or identities outside of public keys.

That doesn't sound like Venmo to me.

[1]: https://www.bostonfed.org/news-and-events/press-releases/202...

Re: “Crypto drainer” template facilitates theft

#95

Post by Barrera »

rattlesnakedave wrote: post #56
Barrera wrote: post #50

> Victim connects their wallet to “mint”. It's not clear exactly what's going on here. The word "connect" by itself implies two modes: (1) present public keys; or (2) present private keys. But the loss of property suggests it's (2). If so, then the people falling for this are hopelessly incompetent. Of course, this has been a problem from the start of Bitcoin. Users "buy" something they have no clue how to secure. Th…

No it doesn’t suggest 2. Google “token approvals.” Or just look at metamask for like 30 seconds.

I looked at it for 30 seconds and am deeply skeptical of the scheme.

Re: “Crypto drainer” template facilitates theft

#96

Post by patch_cable »

AgentME wrote: post #86
mrep wrote: post #77

Earlier quoted context omitted.

I have a CS degree and have worked at FAANG for 6 years and that was straight gibberish to me. I guess maybe because I have only worked at FAANG using traditional tech and not crypto startups?

I think that explanation was just a little too jargony. If you have the Metamask browser extension (or another compatible web3 extension) and press its browser button to enable it while on a webpage, then the webpage can see your wallet address and suggest transactions for you to make. When that happens, the browser extension then shows a window under its own control explaining the transaction and allows you to choos…

The UX is similar to buying something with Apple Pay from a website in my experience.

Re: “Crypto drainer” template facilitates theft

#97

Post by infotogivenm »

trompetenaccoun wrote: post #88
PragmaticPulp wrote: post #46

Absolutely baffling that the crypto community normalized this process of connecting your wallet to a random website and letting it access all of your money. I see a lot of victim-blaming suggestions that it's the fault of the person who didn't set up a new crypto wallet for every interaction they might want to make and then transfer enough money into said wallet to cover unpredictable gas fees (while also paying gas…

It turns out you're not the first person to realize that this is an issue. If you'd actually read up on cryptocurrency wallets before commenting, you might have found there are multiple solutions for this out already, including one of the most popular Ethereum wallets called Argent, which let's you set limits. Basically the fraud described is a twist on the classic "Musk giving away BTC" scam that's all over Youtube…

> The way you can prevent it on smart contract platforms is simply holding the funds in a smart contract that allows users to set restrictions so that they couldn't take that expensive NFT even if the user mindlessly clicks on a fishing link, connects the wallet and approves the transaction without checking what it is.

Yes, so simple! Just put your coins into this website’s smart contract and you’ll be much more secure.

Re: “Crypto drainer” template facilitates theft

#98

Post by 8note »

r00fus wrote: post #79
scoofy wrote: post #72

Earlier quoted context omitted.

The problem with democracy is the dunning-kruger effect more than the principle-agent problem. People think highly-complex problems are obvious and easy. They care more about big sweeping theory than they do about local technocracy. The idea that anti-intellectualism even exists is testament to this.

Gonna say something that would likely be downvoted but a functioning society does not need democracy. A governing body needs legitimacy because it's power springs from the people, but democracy and voting are not necessarily requisite. e.g. China/CCP (which isn't really communism, but definitely not democratic).

No post body was provided.

Re: “Crypto drainer” template facilitates theft

#99

Post by xwolfi »

zeven7 wrote: post #82
dcolkitt wrote: post #62

Earlier quoted context omitted.

That's not how it works at all. When you connect a wallet, the only unrestricted access it gives the app is the ability to see your public address. The app does not have the ability to sign transactions on your behalf without your explicit approval.

It depends on the website and the wallet, but either way the wallet app tells you what permissions it's giving the website. My guess is people don't pay attention or think about it. But it's not as parent described "the way the crypto community designed it". It's actually the opposite. The crypto community designed wallets that give you control over what third parties are allowed to do with your accounts. It's a lot…

But debit cards are protected and cant be used without several factors authentication. At least mine is.

Re: “Crypto drainer” template facilitates theft

#100

Post by 8note »

cvccvroomvroom wrote: post #87
bogwog wrote: post #85

Earlier quoted context omitted.

My next billion dollar app will be a service that unlocks anyone's doors and gives you directions to their valuables (with augmented reality ofc). That way, you can directly steal from people without the complexity and carbon footprint of traditional cryptocurrency and NFT projects.

Tell August, Ring, and Nest you have a new auditing API designed exclusively for them coupled with a value-add homeowners asset inventory management app. ;)

Allows for thefts without the related property damage.

Who wants to replace your TV and have to fix the window they broke to steal it

Post reply on HN