|
Title: Localbitcoins Update Post by: RockHound on April 18, 2014, 04:45:30 AM Multiple reports that withdraws have been frozen and do not leave the "pending" state. (3:52pm EST)
Staff posted an update on the blog -> http://localbitcoins.blogspot.com/2014/04/initial-response-regarding.html They make the claim that the effected users do not have 2nd factor enabled. (4:22pm EST) Staff have corrected their post recognizing that they have confirmed three cases of people with 2nd factor having funds stolen. They do say that these incidents are not affecting a large number of users. (4:30 EST) Staff confirm that withdraws may be delayed while this mess is sorted out. (4:38 EST) At a conference call on the issue, all affected traders in attendance reported LocalBitcoins has not yet provided ANY reply to support tickets. (8:00pm EST) Incidents of this form of attack appear to have started ~48 hours ago, coins appear to be withdrawn to a foreign address, despite 2FA. (8:34pm EST) Withdraws have been totally frozen for more than an hour now. (9:38pm EST) Any fellow Localbitcoiners on here? I do have currently Active listing(s). Just wondering whats the best course of action? Apparently attempting to Withdraw renders you susceptible to XSS attack. Title: Re: Localbitcoins Update Post by: bryant.coleman on April 18, 2014, 05:18:57 AM ^^^ I have just logged in to my localbitcoins.com account. Nothing unfamiliar. But I had withdrawn all my coins 2 months ago and I don't have any more coins in my account. The other sell / buy listings are visible.
Title: Re: Localbitcoins Update Post by: RockHound on April 18, 2014, 05:40:19 AM ^^^ I have just logged in to my localbitcoins.com account. Nothing unfamiliar. But I had withdrawn all my coins 2 months ago and I don't have any more coins in my account. The other sell / buy listings are visible. Very good of you to check, cheers Bry Hopefully it's nothing too serious - Although more folks on their forum are reporting missing coins with 2FA enabled - Worrying :-\ Title: Re: Localbitcoins Update Post by: chandan123 on April 18, 2014, 05:54:30 AM so its best not to withdraw the coins from localbitcoins now ?
Title: Re: Localbitcoins Update Post by: RockHound on April 18, 2014, 06:11:23 AM so its best not to withdraw the coins from localbitcoins now ? Sorry can't be of much help Chandan, still trying to find out more - Withdrawals are possibly affected by JavaScript, some folks have recommended that you disable if you are going to attempt a withdrawal? I contacted another Seller friend of mine, for now we are both leaving are listings active until Localbitcoins Team make another update. Localbitcoins team have pretty solid history, and have always been expedient fixing any issues. Title: Re: Localbitcoins Update Post by: bryant.coleman on April 18, 2014, 06:29:23 AM Although more folks on their forum are reporting missing coins with 2FA enabled - Worrying :-\ According to Localbitcoins admins, only 3 people with 2FA lost their coins. Is the real number more than this? If it is so, then this incident reminds me of Mt Gox. The Gox people had also claimed initially that the breach was not serious. Title: Re: Localbitcoins Update Post by: Light on April 18, 2014, 06:32:50 AM According to Localbitcoins admins, only 3 people with 2FA lost their coins. Is the real number more than this? If it is so, then this incident reminds me of Mt Gox. The Gox people had also claimed initially that the breach was not serious. Any business operation would initially claim the problem not to be serious otherwise there'd be mass panic. In both situations (serious and non-serious) it would be best to claim a reduced degree of severity simply because it is true if it is non-serious and if its not it buys you time to fix or steal before people begin suspecting and panic withdrawing and finding it doesn't work. Title: Re: Localbitcoins Update Post by: chandan123 on April 18, 2014, 07:22:21 AM Sorry can't be of much help Chandan, still trying to find out more - Withdrawals are possibly affected by JavaScript, some folks have recommended that you disable if you are going to attempt a withdrawal? thx . but disabling javascript makes the withdraw button nonfunctional i think I contacted another Seller friend of mine, for now we are both leaving are listings active until Localbitcoins Team make another update. Localbitcoins team have pretty solid history, and have always been expedient fixing any issues. was going to try withdraw but let me wait for a day Title: Re: Localbitcoins Update Post by: bryant.coleman on April 18, 2014, 07:28:50 AM Any business operation would initially claim the problem not to be serious otherwise there'd be mass panic. In both situations (serious and non-serious) it would be best to claim a reduced degree of severity simply because it is true if it is non-serious and if its not it buys you time to fix or steal before people begin suspecting and panic withdrawing and finding it doesn't work. Know what? I was planning to sell 1 BTC (for fiat) tomorrow on Localbitcoins (In my country, the Bitstamp / BTC-E fiat withdrawal can take a lot of time). Seems like I'll have to convert it somewhere else. Title: Re: Localbitcoins Update Post by: franky1 on April 18, 2014, 07:38:10 AM most likely insider job.
too many times i see bitcoin services put their hotwallets on remote servers. what makes it worse is they put it on remote servers which accepts bitcoin. this is a bit glowing neon sign that say the hosting provider knows all about bitcoin and has full access to the source code. so no matter how much security the service provider or customers use to prevent outside intrusion. there is nothing to stop insiders.. history has shown that the majority of hacks were actually inside jobs.. will bitcoin service providers ever learn. will service users ever learn do not store large amounts for long term periods on third party services. Title: Re: Localbitcoins Update Post by: pandit on April 18, 2014, 01:16:56 PM now withdrawals are working in lbc ?
Title: Re: Localbitcoins Update Post by: RockHound on April 18, 2014, 01:46:55 PM now withdrawals are working in lbc ? Cheers Pandit, how long did it take you? Title: Re: Localbitcoins Update Post by: RockHound on April 18, 2014, 01:49:38 PM most likely insider job. too many times i see bitcoin services put their hotwallets on remote servers. what makes it worse is they put it on remote servers which accepts bitcoin. this is a bit glowing neon sign that say the hosting provider knows all about bitcoin and has full access to the source code. so no matter how much security the service provider or customers use to prevent outside intrusion. there is nothing to stop insiders.. history has shown that the majority of hacks were actually inside jobs.. will bitcoin service providers ever learn. will service users ever learn do not store large amounts for long term periods on third party services. You could be right my brother, others think this is a possibility - Just takes one bad apple! I hope they fully secure this soon. Title: Re: Localbitcoins Update Post by: pandit on April 18, 2014, 02:38:22 PM now withdrawals are working in lbc ? Cheers Pandit, how long did it take you? Title: Re: Localbitcoins Update Post by: RockHound on April 18, 2014, 02:55:10 PM now withdrawals are working in lbc ? Cheers Pandit, how long did it take you? lol Mybad - Yeah, so some users report that withdrawals are being processed. 45 minutes for full Confirmations. Localbitcoins Team recently posted this: http://localbitcoins.blogspot.fi/2014/04/investigation-report-of-claimed.html I'm still waiting for another announcement saying "all is good/secure" If you are going to try just make sure you have 2FA and run a virus scan first. Title: Re: Localbitcoins Update Post by: RockHound on April 18, 2014, 02:56:13 PM most likely insider job. too many times i see bitcoin services put their hotwallets on remote servers. what makes it worse is they put it on remote servers which accepts bitcoin. this is a bit glowing neon sign that say the hosting provider knows all about bitcoin and has full access to the source code. so no matter how much security the service provider or customers use to prevent outside intrusion. there is nothing to stop insiders.. history has shown that the majority of hacks were actually inside jobs.. will bitcoin service providers ever learn. will service users ever learn do not store large amounts for long term periods on third party services. LocalBitcoins Team response: This case is also very unlikely to be an inside job. LocalBitcoins logs all the actions done by its support staff and developers to an audit log, so potential abuse of staff privileges is easily uncovered. Two-factor authentication codes and passwords are not accessible by the support staff. Furthermore, it would not be very rational for an insider to attack against one particular user and his/her wallet only if the insider would have access to all wallets. Title: Re: Localbitcoins Update Post by: Rishodi on April 18, 2014, 06:56:39 PM This is the reply which I have posted on the LocalBitcoins blog:
Quote From the given information, the theft depended on 1) session hijacking and 2) compromised 2FA. Although this is certainly indicative of a compromised user device, LocalBitcoins needs to take more aggressive action to inhibit session hijacking. Even with 2FA enabled, requests which originate from a user with a different IP address and browser than that which was recorded at the initiation of a session should be responded to by immediately destroying that session and asking the user to reauthenticate. In this particular case, the withdrawal request was associated with an IP address and user agent header which were distinguishably different from that which was recorded at the start of the session. As a result, the request should have been flagged as suspicious and denied. Of course, such policies may not have been able to prevent the theft in this particular case. If the attacker was able to gain not merely read-only permissions but also execution permissions on the user's device, then the attacker could have sent the request directly from the user's device using the existing session, and the request would not appear suspicious to the server. If the attacker was able to access both the user's password and 2FA code, then the attacker could simply establish a new session from anywhere and subsequently send the withdrawal request. Nonetheless, it is alarming to find that the security of session management at LocalBitcoins is certainly lacking. Taking a more proactive approach to session security would help to inhibit attacks and bolster trust in the LocalBitcoins platform. A good technical overview of the topic can be found here: https://wblinks.com/notes/secure-session-management-tips/ For anyone who uses LocalBitcoins, the safest course of action is to 1) enable 2FA and 2) logout after every session. Logging out will close the user session, and with no active sessions you are not susceptible to a session hijack attempt. Title: Re: Localbitcoins Update Post by: kittucrypt on April 18, 2014, 07:03:18 PM So it looks like the user account was hacked via a user device? I wonder if LBTC did anything fishy here?
Title: Re: Localbitcoins Update Post by: RockHound on April 18, 2014, 07:26:31 PM This is the reply which I have posted on the LocalBitcoins blog: Quote From the given information, the theft depended on 1) session hijacking and 2) compromised 2FA. Although this is certainly indicative of a compromised user device, LocalBitcoins needs to take more aggressive action to inhibit session hijacking. Even with 2FA enabled, requests which originate from a user with a different IP address and browser than that which was recorded at the initiation of a session should be responded to by immediately destroying that session and asking the user to reauthenticate. In this particular case, the withdrawal request was associated with an IP address and user agent header which were distinguishably different from that which was recorded at the start of the session. As a result, the request should have been flagged as suspicious and denied. Of course, such policies may not have been able to prevent the theft in this particular case. If the attacker was able to gain not merely read-only permissions but also execution permissions on the user's device, then the attacker could have sent the request directly from the user's device using the existing session, and the request would not appear suspicious to the server. If the attacker was able to access both the user's password and 2FA code, then the attacker could simply establish a new session from anywhere and subsequently send the withdrawal request. Nonetheless, it is alarming to find that the security of session management at LocalBitcoins is certainly lacking. Taking a more proactive approach to session security would help to inhibit attacks and bolster trust in the LocalBitcoins platform. A good technical overview of the topic can be found here: https://wblinks.com/notes/secure-session-management-tips/ For anyone who uses LocalBitcoins, the safest course of action is to 1) enable 2FA and 2) logout after every session. Logging out will close the user session, and with no active sessions you are not susceptible to a session hijack attempt. Thanks for the input Rishodi ! Is a session logout possible with an Active listing? Title: Re: Localbitcoins Update Post by: RockHound on April 18, 2014, 07:27:08 PM Coindesk, summary of events:
http://www.coindesk.com/localbitcoins-releases-investigation-report-site-wallet-issues/ Title: Re: Localbitcoins Update Post by: leopard2 on April 18, 2014, 11:30:37 PM Thanks for the input Rishodi ! Is a session logout possible with an Active listing? Huh? Sure it is, close your browser :-) And if using 2FA, it must be paper based, paper is normally not affected by malware... :D Title: Re: Localbitcoins Update Post by: RockHound on April 18, 2014, 11:54:41 PM Thanks for the input Rishodi ! Is a session logout possible with an Active listing? Huh? Sure it is, close your browser :-) And if using 2FA, it must be paper based, paper is normally not affected by malware... :D Cheers Mr Leopard, I'm just being justifiably paranoid :D There's a general consensus on their forums that this issue was largely FUD? - Conducted several sales today, non of my clients have got back to me with any issues, all positive feedback. From my perspective everything's been working great. They're a good team the Localbitcoins crew, sure they will post something on their blogspot pretty soon, giving the all clear. Title: Re: Localbitcoins Update Post by: escrow.ms on April 19, 2014, 12:07:05 AM Thanks for the input Rishodi ! Is a session logout possible with an Active listing? Huh? Sure it is, close your browser :-) And if using 2FA, it must be paper based, paper is normally not affected by malware... :D It's true but ^ that's false sense of security. Let's say bob's pc got infected or was infected by some malware, some days later bob started using localbitcoins. Bob enabled 2 factor authentication on infected pc. Is he's safe? NO Why? Because he created 2factor seed/keys on a infected machine and malware can capture keystrokes,take screenshot,share screen etc and there are high chances of getting paper code's/2factor seed compromised by hacker. Title: Re: Localbitcoins Update Post by: leopard2 on April 19, 2014, 09:05:30 PM I don't think there is a "seed". Those 2FA codes cannot be deterministic, or they would be a huge joke ;D
Screenshots, yes. If your PC has been taken over, you are out of luck - but to be honest, then the attacker could just empty your BTC wallet on your PC not just Localbitcoins. Also the question referred to session takeover only. The session is gone when you close your browser. Title: Re: Localbitcoins Update Post by: escrow.ms on April 19, 2014, 09:21:49 PM I don't think there is a "seed". Those 2FA codes cannot be deterministic, or they would be a huge joke ;D https://i.imgur.com/jtztltK.png Maybe you should atleast check localbitcoins or any other site/app that is using 2 factor authentication. The authentication key (seed)can be used on multiple devices simultaneously Quote The most common form of Two-Factor Authentication is TOTP. TOTP uses a secret seed and the current time to generate each of the individual authentication tokens. Essentially: http://blog.authy.com/assets/posts/heartbleed-2.jpg Given that anyone can know the current time, if the attacker knows the secret seed, he can essentially generate a valid OTP token at any time. So it's possible that the secret seed that you are using for Two-Factor Authentication might be compromised. http://blog.authy.com/heartbleed Title: Re: Localbitcoins Update Post by: escrow.ms on April 19, 2014, 09:25:29 PM As for paper codes, one screenshot is enough and sometimes people save them as PDF file for printing on their pc.
Title: Re: Localbitcoins Update Post by: moni3z on April 20, 2014, 01:10:05 AM As for paper codes, one screenshot is enough and sometimes people save them as PDF file for printing on their pc. Or write emails to themselves containing the seed/key Title: Re: Localbitcoins Update Post by: chandan123 on April 20, 2014, 11:11:13 AM yesterday i withdraw bitcoin from localbitcoin wallet to my QT wallet and it confirmed after 10-20 mins
cheers Title: Re: Localbitcoins Update Post by: leopard2 on April 20, 2014, 03:28:37 PM I don't think there is a "seed". Those 2FA codes cannot be deterministic, or they would be a huge joke ;D https://i.imgur.com/jtztltK.png Maybe you should atleast check localbitcoins or any other site/app that is using 2 factor authentication. The authentication key (seed)can be used on multiple devices simultaneously Quote The most common form of Two-Factor Authentication is TOTP. TOTP uses a secret seed and the current time to generate each of the individual authentication tokens. Essentially: http://blog.authy.com/assets/posts/heartbleed-2.jpg Given that anyone can know the current time, if the attacker knows the secret seed, he can essentially generate a valid OTP token at any time. So it's possible that the secret seed that you are using for Two-Factor Authentication might be compromised. http://blog.authy.com/heartbleed Ok thanks for the lesson If it is possible to generate new 2FA codes from seed automatically I don't understand the benefit - seed would be merely another password then You sure LBC will not ask for additional info before generating new 2FA list? Title: Re: Localbitcoins Update Post by: escrow.ms on April 20, 2014, 04:18:30 PM You sure LBC will not ask for additional info before generating new 2FA list? Paper codes list? It should, but I just tried and found a big fucking flaw. Once you are logged in, you can generate same list again. There is a big flaw, it doesn't generates a new 2FA code list until old one is used, instead of that it shows you current list. Ie: Once Attacker got your session somehow and logged in your account, he can get your 2FA paper code keys. I think this method was used to steal users coin and I am sure only those users who were using paper code 2FA got affected. Ps: I have reported it to jeremias on lbc edit: it's fixed now, codes were cached by their system for 24 hours. Title: Re: Localbitcoins Update Post by: leopard2 on April 20, 2014, 07:25:30 PM Wow now I am extra glad we had this discussion
Is the 24h caching thingy fixed for everyone then? Title: Re: Localbitcoins Update Post by: escrow.ms on April 20, 2014, 08:33:24 PM Wow now I am extra glad we had this discussion Is the 24h caching thingy fixed for everyone then? Yeah it's fixed. Title: Re: Localbitcoins Update Post by: billysweird on April 21, 2014, 11:03:14 AM thanks for notice
i usually take my wallet with me and then update the localbitcoins |
