Bitcoin Forum

I just had a minor theft (0.11BTC, I'll live) and while I understand ways I can positively prevent this (offline wallet, etc), I'm quite curious how the thief did this.

I'm just running the client 0.82/Win7 with my wallet encrypted with a short but unusual password.  I have not opened the client for about two weeks, but I did today just to check the balance.  As soon as I opened it, the balance was .10996851, but after it downloaded the blockchain, it was 0.00000000000000, nada, zilch.  There were two transactions:

First, 11/3/2013, from address 1NpovwBu8RdXYZUHHd4ZWEEnGNgAu3QfWy, tx # 95054f44018eda3be92f3274cc31d56dc7e84c8a6d0f5919da09a8b9e01aadd2 , there is a .00006BTC payment to my address.

Then, 11/6/2013, to address 1NTcSTt3MEW4Mw8SRy9xXmMstk8Pimcjqn, tx # 7c348e83cb9bbabfb567770e322384b37712fcaf704bb17b09e4ca6c3232b71b,  my BTC goes out the door--.11BTC to the thief, then 2851 satoshis as a tx fee.

The 1Npov address was used for a number of these .00006 payments, and a lot (but  not all) of the addresses that received these payments got cleaned out at about the same time I did.  Some of the payments were substantial.  THe 1NTcS address was used to clean out a few accounts, but other addresses were used as well.  One guy got cleaned out of over 300BTC, here is his link from the explorer.

https://blockchain.info/address/1JwSSubhmg6iPtRjtyqhUYYH7bZg3Lfy1T

So if anyone can tell me, how is this done?  My computer is not particularly secure--Windows firewall, Avast antivirus, but I've downloaded and tried a pile of miners, altminers, etc, including the now infamous "tradercoin" that had a built in keylogger.  I'd be surprised if that one worked, as I caught it and the keylog files didn't have any relevant info.  If you had my whole computer and were smart, you might guess my wallet.dat encryption password.  I'm especially curious about this--what is the significance of the .00006 BTC payment three days prior.

Any insight appreciated.

You should download Malwarebytes and do a scan, I bet you'll be surprised by all the things picked up that your current AV client hasn't detected.  Given your risky download habits, it's not a stretch to predict that you have been infected by multiple trojans and keyloggers.

I cleaned up pretty good after the TraderCoin debacle.  I just rescanned and checked for rootkits, nothing exciting came out.  My old, unused, miningware downloads did have various junk in them (a lot of Crypt-OSW) but nothing active.  I'm OK, I just would like to know how these things are perpetrated and especially why the .00006 payment?   

To decrypt an encrypted wallet.dat two possibilities:
a) keylogger

or

b) you claim short but unique.  Short = worthless password.  If it was short enough it may have simply been brute forced.  If it had been long and unique that would have been more interesting.  Care to share the password?  Hopefully you are not using it anywhere else, you should assume the attacker knows it.

Or at least tell us the number of characters and the type of characters (upper / lower case letters, numbers) you used.  Interested in this as well.

#2~          if that's your "short but unique" then everything is clear

UPD: also this
http://imgs.xkcd.com/comics/password_strength.png

And then dictionary attack became a thing...
4 random english words aren't very strong as password.

I though the brute force do not work if the password is long enough.

What happens with a locked wallet, when incoming tx is seen by running bitcoind?
Isn't it automatically unlocked for a brief period? Would it be of use to a memory scanning malware?
Just thinking aloud..

Noone expects you to have a string of multiple words this long

Everyone's using Xxxxxxx* these days

Also good luck guessing my wallet's pass with dictionary

hint: it's 6 meaningful words  ~28 chars total, plus one word is used in possessive case

@PrintMule et al:

I suppose my password could be brute forced, I hadn't intended any great level of security here.  That is why there was only .11BTC to be had.  My own previous attempts at cracking a wallet (my own, of course) weren't all that successful, but the program I had only did a few attempts per second.  I had to seed it with some pretty good guesses or have a 2-character password to get in.

I don't want to reveal the password, but it was on the order of "malleus4" or "centrifugal9" or "rhapsody3".  Oddly enough, PrintMule, the phrase "correct horse battery staple" appears in the address of the guy who got ripped for 300BTC.   

This leaves the questions of:

1.  What malware finds and sends wallet.dat files?  I suppose a decoy wallet might be the thing?  And then rename  your actual wallet  "familyvacation.jpg"?

2.  (the one bugging me the most)  What is the .00006BTC for?

3.  Why wait?  I realized TraderCoin was a virus/keylogger (if that is the source of this theft) and cleaned it up, but if I was more concerned or had more BTC, I would have transferred them out immediately.  The TraderCoin keylogger thing was 10/24/13, almost two weeks earlier.

As far as passwords concerned, is using leetspeak generally a good idea? 

For example:  For a while my password was "monkeyshit" but I typed it in leetspeak so it was "M0nK3y$h17"

Seems pretty secure to me.

And one other thing--if you look at the transaction 95054f44018eda3be92f3274cc31d56dc7e84c8a6d0f5919da09a8b9e01aadd2  you'll see that a lot of the addresses involved are related to HHTT Mining Pool, so perhaps someone quite a bit more sophisticated is trying to rip off HHTT?  It would hardly seem worth any significant effort to get my .11BTC, but for 300BTC or more from a pool, I suppose the game changes.

Or

C) Someone has a list of of passwords.

maybe btc-e, coinbase, this forum, blockchain.org?

Hjwdi%3?hiuqofC9ybsyq!YFrdEDe

A password should look like the example above. Long, random and using caps, numbers, special chars, etc. Never use a word or anything remotely connected to you, such as a pet's name or a child's birthday.

thats it.

In the chat I'm in now there is a guy who openly accepts that he steals bitcoins and he has an exploit on blockchain according to those he stole from

Not really. http://optimwise.com/passwords-with-simple-character-substitution-are-weak/ (http://optimwise.com/passwords-with-simple-character-substitution-are-weak/).

4 RANDOM words is a very strong password (assumming the rest of the system is secure, random large number salt, multi-round key hardening, secure algorithm).   Dictionary attacks aren't looking for random words, they are looking for common words, phrases, known used passwords, variations of words (p@ssw0rd), phrases from books/movies/etc.

A dictionary of all 4 combinations of english words is well useless.

I strongly suspect this to be the case. I had an excellent password and got hacked. I did a virus scan and didnt come up with anything that looked malicious.

It isn't that "nobody expects" it is that the keyspace is so large you could tell the attack.  BTW my password is 4 random words all lower case please try to crack it and the permutations make it difficult.

The issue is that humans are often bad at random so 4 random words has to be 4 RANDOM words not hey let me think of 4 words randomly.   The problem with the later is why the English language may have thousands of words the common vocabularly (not every word you ever knew but the words most likely for a human to "think up randomly") is much smaller.  Throw in some selection bias and you can end up with a lot less entropy.

tacohomonymblueparabola is going to be my new password...

Hm, when I said random, I meant randomly selected from the dictionary with no permutation, just like in the picture.
correct horse battery staple

Ok ~180,000 words in the English language, so there are 180,000^4 different variations: 1,049,760,000,000,000,000,000
That's a lot, but a lot of magnitudes less than needed to crack a normal Bitcoin address.
Furthermore you don't need to crack a specific Bitcoin address, if there are multiple people using it the chance to successfully steal Bitcoins increases.

Where am I wrong?

DoNotFuckWithPrintMule'sBTCS

That's my guess  :P

Well 180,000^4 = 2^70  Most passwords have far far far far less than 70 bits of entropy.
While it is harder than brute forcing a private key (which is impossible) it is beyond what is computationally feasible with any reasonable cost/time constraint.

The fact that multiple people might be using the same password doesn't matter in this case.  We aren't talking about a brain wallet.  The attacker would need a copy of the wallet.dat and attempt to brute force that wallet individually. The QT client uses a random 64 bit salt when hashing the passphrase which means there is no precomputation or shared attack possible.  Each potential password has to be salted and check against a single wallet file (which the attacker needs to have access to first).  The QT wallet also employs key strengthening by hashing the password many tens of thousands of times so instead of the attacker getting to use 1 hash = password attempt it is 56,000 hashes = 1 password attempt.

So putting that all together.
2^70 possible passwords.
Assume 2^16 hashes per password so 2^70 * 2^16 =  2^86 hashes needed
A high end GPU can attempt ~1B SHA-2 hashes a second.

2^86 / 1000^3 / 60 / 60 / 24 / 365 =  2,453,426,321 GPU years.   So if you had 1 billion GPUs you would have a 50% chance of brute forcing a single password on a single wallet in a year.


For the record most people probably would use a smaller dictionary so to be safe I would use more words (an additional one or two words adds significant security while still being memorable) but even still it is probably more secure than 90% of the passwords people "think" are safe.  That was the whole point of the cartoon.  The complicated garbage password people try to come up with actually has very little entropy.  A purely random password "h23j2hF@xl-hd$ij" has about 6.5 bits of entropy per symbol so to acheive 70 bits of entropy would require 11 char/smbols.  In the real world most user's password that they think are strong have much much less entropy.  NIST estimate is the average user select 8 digit password with upper, lower, number and symbols has about 18 bits of entropy. 

http://en.wikipedia.org/wiki/Password_strength

Diceware is another example of a method to randomly pick a password by rolling dice and comparing it against a much smaller word list.  The words are chosen to avoid words which may be hard to remember, have alternate spellings, may be mixed with other words, etc.  Even with a much smaller word list diceware is ~12 bits of entropy per word.  6 or 7 words combined with random salt and key hardening is impossible to brute force.

http://world.std.com/~reinhold/diceware.html

The .00006BTC could have something to do with a Mastercoin transaction.

See the spec at https://sites.google.com/site/2ndbtcwpaper/ for more info.


Although neither of those addresses have any history at http://mastercoin-explorer.com/

This is an address I recognize, it is the brainwallet address when "correct horse battery staple" is used as the passphrase.

Anything sent to it is guaranteed to be swept away in short order.

fatchickgiveshead,y?causeshehas2..duh

ok, so this is 37 characters, 8 words, 4 symbols

would this have hi entropy?