Bitcoin Forum

This address is receiving stolen BTC!

15Afx45asCysyNd9HE7xeZTkzLgDq2JCEx
http://blockexplorer.com/address/15Afx45asCysyNd9HE7xeZTkzLgDq2JCEx

and this one:

1GB8MHka8SXSFbJMViwkP6ANufts1qGnhF
http://blockexplorer.com/address/1GB8MHka8SXSFbJMViwkP6ANufts1qGnhF

All my BTC have transferred to this address hours ago!

------------

I'm using mac osx, and I have made an encrypted disk image to store the wallet.

A possible leak is that I used same account name and password at MtGox and Dropbox, from the first, the password is compromised, and from the last, the wallet backup is stolen, even though I zipped the wallet file with a long password...

Follow them?

I am not sure if any threads like this have produced results that have helped, but I hope so, sorry about your troubles.

From were?

from where?



how much?

There have been several threads about people who's money was sent to the same group of addresses. We are still trying to figure out how the computers are being compromised.

Could you give us a list of bitcoin related downloads you have made.
Do you feel like your computer is susceptible to traditional viruses?
Do you have your wallet online anywhere unencrypted?
Have you run any namecoin binaries?

are you running MS windows

can anyone verify this adress:
18hMx774ULBKJKMbwo5reBm3zW8unJ92FW

?

my btc-client told me, I transfered the btc I got earlier from deepbit (but i didn't transfer anything)

http://blockexplorer.com/address/18hMx774ULBKJKMbwo5reBm3zW8unJ92FW

The address had .02 in it then it got sent out.

my client sent 0.46 btc to this address today.. by itself.
im on win7x64 with latest updates, scanned the whole pc, checked open ports and autoruns.. and nothing.

i need help cus this is serious, if my antivirus and 4 anti-troyan apps say my windows is clean and it clearly isnt, there is something wrong.

I would in this case, format everything and start fresh.  But thats just me. 

Sure it was sent by your client, or did you store your wallet.dat somewhere else as well?  Look up the transaction ID in blockexplorer, and search for the first 20 bytes of it in debug.log.  (It is in ~/.bitcoin/ under Linux.  Have no idea where Wintendo stores it.)  If you see an "askfor tx transactionid" somewhere, the transaction was initiated by someone with a copy of your wallet.dat.  It looks like your own, because you have the same wallet.

@presha

A targeted virus, one that just opens wallet.dat and sends it off, one that you ran on your own accord, will not be detected by antivirus. No antivirus company yet looks for programs trying to access your wallet.dat.

Please tell us what you have downloaded and run lately so that we can find the program doing this.

I'm 99% sure now that someone hacked into my dropbox account, where I stored the first backup of my wallet.dat a few months ago, when I started mining. The file was compressed and with a rather long password, but I assume It wasn't a problem for some bruteforce app to crack it.
I'm so glad that this was my very old backup and I lost only 0.46 BTC (doing encrypted backups only on usb drives now)

btw http://techcrunch.com/2011/06/20/dropbox-security-bug-made-passwords-optional-for-four-hours/

goodbye dropbox...

Dropbox didn't require a login password for a while a couple weeks ago.  Anyone storing a wallet file on dropbox should've promptly transferred the bitcoins to a new wallet file.

thats why I'm leaving, got no email from them about this security issue, ridiculous
gonna try skydrive + truecrypt combo now

You knew about this, and didn't move your coins to a new wallet!?  If your zip file was password protected using the old standard zip password protection, it is vulnerable to a known plaintext attack.  Your wallet.dat contains many known strings of sufficient length.  Cracking it takes a few minutes at most on a normal desktop computer, no matter how long your password is.

OP, how strong was your password on the zipped wallet that was on DropBox? How many chars, and what kind of mixture of lower case, upper case, numbers, punctuation, etc, did it contain?

And what format was the zipped file in? WinRAR?

I hate when people make these posts and make you ask every little detail in order to try to help them figure out what may have happened. It's like pulling teeth. Just fucking give us all the info instead of making us ask for every little thing. Don't make assumptions like "I'm 99% sure that XYZ happened" and then think that posting additional details is no longer of any use. You are of course free to make your assumptions about what might have happened, but at least post all the necessary info that is required to come to that conclusion. If you leave things out like the info I asked above, you leave the possibility in everyone's mind that your zipped & password protected file might actually have been impossible to brute force. And then the community still has no idea what happened in your case and we are no closer to figuring out how people are getting hacked, and your entire thread was a waste of everyone's time. That also leaves open the possibility that all the "I was hacked" threads are troll or FUD threads.

Sorry, OP, this is not meant to single you out. This is a common theme in all the "My BTC was stolen due to hack" threads.

Can you elaborate on why running namecoin binaries in general (and not just any binary) is risky?

Sorry to hear about your loss nakowa. I hope you did not loose too much.

Please notify all the major exchanges about this so they can keep an eye on transactions flowing from those two addresses.

A firewall is better than an av scan to protect your wallet.dat Probably there will be more and more exe's that look for wallet.dat and upload to a server somewhere. A lot of time it will come in the guise of a special video player or something along those lines. Even with a firewall, people are inclined to grant internet access to it because otherwise, the video won't play.

In this case sounds like it was likely the copy on dropbox.com.

just what are the odds that someone knew what to look for when dropbox had their technical issue?
honestly.. unless there was some way to use google to identify wallet files on dropbox's website OR
someone knew it was there..

i find it highly doubtful that a person on the internet just happened to come upon that file on dropbox
and had the insight to brute force the password.. and then transfer the bitcoins. heck.. just finding a
person on the internet who even cares about bitcoins is a challenge let alone finding a wallet file during
a few hour period.

OK, so your Mtgox and Drop box were compromised... buy you say: "encrypted disk image to store the wallet" <--Was that PassWord the same too? and then you say: "zipped the wallet file with a long password"

So, you backup your wallet to Dropbox that could have been compromised, in a Encrypted .DMG that might have had the same password, that was Zipped with a long PW <--- BTW Zipped PW is by far full-proof...

I am thinking it is more likely your computer is compromised.... better check that also...

I'd say they are pretty good. Do you think none of the programmers working at dropbox know about bitcoin?... "Hey guys, I just published that password code, see you after lunch!" ... (quick trip to starbucks to download a few wallet.dat files) ... "hey guys, I found a problem with the password code... oops!"

We hope to solve this very soon .... http://www.bitprotection.info  more coming soon...

Dropbox staff can access your files directly, no need to introduce a password bug.

And no more messages from nakowa?

I'm telling you.....again my theory....

Everytime a "BTC stolen" story gets bumped to the bottom of the page or off the page a new one pops up. Legit? I don't know.

But it's like clock work. It's like the troll brigade just wants that front page of threads to be tainted with scandal. I don't buy it. Or I should say, I'm very skeptical.

What do you have in mind?

I updated some info by editing the original post.

You're not skeptical, you are dark.

Don't you see the blockexplorer link I've post?

I lost all my BTC. However, do you think I should cry for it everyday?

In fact, I'm busy on updating my BitcoinX (An AutoIt Shell for the official bitcoin client for windows. ) http://forum.bitcoin.org/index.php?topic=23791

Because I have to work on a virtual machine - I'm using a Macbook air, I had no time to back here for crying...

Do you think you could answer the additional questions people have so we could continue in trying to figure out how you were hacked?

It doesn't help your case that right now you are doing what a lot of other "I was hacked" posters do when pushed for more details the "I was hacked" -- being evasive.  (by not providing the info being requested by those trying to help you out)

I'm not normally one to go for conspiracy theory type stuff, but the point you raise is a possibility that can't be ruled out at the moment. It's suspicious how these guys often ask for money, and almost never provide enough info to troubleshoot. When prodded for more details they suddenly post a message with what they believe to be the loophole by which they were hacked, but without a trail of evidence to make it plausible enough to stop troubleshooting/investigating. If I were hacked I know I'd be a lot more systematic about wanting to find out exactly what went wrong, and I'd be a lot more cooperative with the people on the message boards who were trying to help me investigate what happened.

They should just all be pushed into a separate forum and urged to stick to a template if they want to get any help. Yet another case for having a bitcoin forum with better moderation.

A few other people claiming to be hacked that I've tried to hammed detail out of (it is like pulling teeth, I might buy the conspiracy), mentioned using a namecoin binary.

There is a new rootkit MBR virus, karpersky is almost "give up" (I hope they don't, keep it up guys!)
Infected approx 4.5million, this virus is on your harddrive MBR, it's almost impossible to detect,
In my personal oppinion, this kind of viruse cannot be detected & removed with "standard procedure".
I hope you guys are not get invected with these virus. It's P2P type of virus.
Check it out : http://www.computerworld.com/s/article/9218034/Massive_botnet_indestructible_say_researchers?taxonomyId=82&pageNumber=1 (http://www.computerworld.com/s/article/9218034/Massive_botnet_indestructible_say_researchers?taxonomyId=82&pageNumber=1)

useful article, cept it doesn't tell you how to detect it lol

The advice seems to be - nuke your hard drive and reinstall!

Here is an utility that I recommend people use to "nuke" their HD:

http://www.dban.org/

It is free software btw.

dban is a bit overkill if you just want to wipe the MBR and destroy data on a drive. A single zero pass would be fine :) Takes a hell of a lot less time!

It does have that option. I used the so called "least secure" option of a zero pass on a 100 gb HD and it took 2 hours max. Some of the erase options dban offers are insane.

Well obviously after you had your good cry you were still reading the board!! Your only statement is against me and you call me "dark" (whatever that means) for being skeptical and pointing out a trend.

I'm not calling you a liar. People are getting robbed and I sympathize. I was compromised as well within three days of getting into BTC but I think someone was punishing me for something stupid I did. We all know it's happening.

Nonetheless, I'm skeptical. I and a few others exposed an obvious scam right on the board here so there are reports like yours that are false. If you're going to bring it to the board back up your claim.

Otherwise you are just spreading fear and pessimism and in my world that would be considered "dark".

Are you serious? They don't run automated tests on something critical like authentication? That's retarded.

Just use a linux liveCD and run:

DISCLAIMER: DO NOT "test" THESE COMMANDS ON A SYSTEM YOU DON'T WANT TO DESTROY!!!!!

dd if=/dev/zero of=/dev/sdX

where X is the device

Did this to a 1TB drive not long ago, took maybe 4 hours... maybe a little more.

You could also do a (psuedo)random data write with

dd if=/dev/urandom of=/dev/sda

Since we were talking about these rootkit viruses within the MBR.. If you just wanted to kill the MBR:

dd if=/dev/null of=/dev/sdX bs=446 count=1

and to remove both the MBR and the partition table (which you'd have to rebuild if you wanted to use the partitions again!):
dd if=/dev/null of=/dev/sdX bs=512 count=1

DISCLAIMER: DO NOT "test" THESE COMMANDS ON A SYSTEM YOU DON'T WANT TO DESTROY!!!!!

I'd imagine these rootkits would get back into the MBR as soon as windows boots again, so I don't think this would fix it without at least killing the processes/services which it depends on in windows.

Interesting virus.. very nasty :( I'm gonna do some checking on all my systems. Guess its perfectly possible that poeple are losing their wallets to this rootkit/botnet - they could easily send a command to the infected machines to search for wallet.dat and send email/send it somewhere. Obviously I'm just guessing! But AFAIK you could end up infected just by visiting the wrong website :/

Is there any way to detect this virus?

Man. Before two weeks ago I wasn't that concerned about security. This forum has made me super paranoid about network and PC security. Thanks a lot, guys.

Dude, I hate you so much! It totally wiped out my computer!

Try MS System Sweeper

http://connect.microsoft.com/systemsweeper

I have run it on a number of computers at the office and home.  I have seen reports of people finding Root Kits (RKs) that normal AV is not picking up.  You burn it to a CD and boot from the CD.

http://blockexplorer.com/address/1Go93RSbJ5Ky8poq1NA9eWKfxPd55vKVos

This address was stolen, sent 15Afx45asCysyNd9HE7xeZTkzLgDq2JCEx 94.83BTC.

Stealing is going on...