Bitcoin Forum

A new report from security firm Symantec claims the number of Trojan malware programs targeting bitcoin users has fallen in the past year. they suggest that since the number of users of crypto is still low it is not a good target!

it is a good news but i thought cryptocurrency was getting popular so as a result it will attract evil people too but seems not!
source: http://www.coindesk.com/symantec-bitcoin-financial-trojans/

most crypto users at this point are still a bit tech savvy.  that makes it more difficult and less worth it for the trojan builders.

Password protect your wallet. Or save your coins on some trusted exchanger site.
Also, do not disable your antivirus, just update it and be safer.
I said this about antivirus as many users doing it "because it slows down their CPU" or whatever reason is.
Just don't. Stay protected. I know that sometime virus or trojan is undetected by antivirus, but it's more chances to not get infected by keeping antivirus up and running updates every day. Also, Malwarebytes is a good protection, can work with antivirus without conflict.

Being tech savvy will help any bitcoin user. Its most commonly a fault with general public users who have no idea how to secure their bitcoin, let alone their machines.

The saving coins method is flawed. Everyone said inputs.io was legit and looked what happen >:(. True it's a wallet service but exchanges are all the same. If you password protect the wallet, the password can still be captured if you have a virus.

Most Bitcoin users use Ubuntu which do not have much vulnerability.

Not only trojan but silent miners! That makes 99x PROFIT! Satoshi wont be happy with that  :(
If satoshi's computer got infected...its over...hacker will probably take over Bitcoin :-[

Silent miners do not profit as much as before. To gain a viable hashrate, you need thousands of the most powerful and biggest hardware. GPU or CPU mining is dead long ago compared to ASIC.

I'm pretty sure he is safetly storing his btc.. He is not an idiot, come on guys.

He might be an idiot :P. Human make always makes mistakes.If he didnt do mistake , he aint human ::)

I'm curious, why on earth is a New Password requirement not part of the installation setup for every wallet in existence? I would think it should be automatic that whenever you install a wallet that it asks you to set up a password the first time you run it. The thought that people are downloading wallets and sending BTC to them and not realizing that anyone/anything accessing their PC can simply take the bitcoins, floors me.

that's the bad side of this, if you are not careful you can have your bitcoin stolen, as it is something you have in your computer and it is untraceable, hackers have bitcoin users as a target

I think most wallets first prompt the user to create a password to encrypt the wallet with when it's first generated. I know Electrum does, and Trezor recommends that the user either enters a PIN, or a password. I'm not sure why wallets like Mycellium, or Bitcoin-Core don't recommend setting a password when the wallet is first created.

There is a difference between making a mistake and being an idiot. I expect he can manage to store at least some of his bitcoins in a paper wallet that is obviously completely safe from trojans.
I use online wallets generally with 2FA and strong unique passwords, and I am not quite as tech savvy as Satoshi!

It does seem that trojans like these will be a hinderance to further adoption of bitcoin though, your average windows 7, internet explorer user won't use Bitcoin again if they manage to lose them without doing anthing really wrong.

This is horrible advice. Offline storage is the best option.

Never save your coins online with any service or exchange. And if you do make sure you store a very little amount in wallet sites.

People just need to stop with downloading and installing crap because it says "100% working Bitcoin generator!"

ofcourse it is possible with present security because owr antiviruses are not fully designed to stop these type of attack

Having lower number of malware programs doesn't mean anything. I bet there are still users losing their coins either due to carelessness, ignorance or for whatever reasons and most of the time it sounds easier than it seems. And there were cases of coins getting stolen having nothing to do with malware, it was just left over there for the taking.

If u use multisig, trojan cant do anything as one private key wont give them the bitcoin...

probably we blame too much to the bitcoin users who hasn't implemented security method to protect their bitcoin and end up losing them! It may be the reasons the masses still stay far away from bitçoin. Bitcoin itself needs to be unbreakable like the banks vaults and user friendly. The masses will be comfortable to use it.

This isnt surprising since most trojans were made in order to mine bitcoins using cpu and gpu devices, but with the difficulty on this level, even a botnet with thousands of computers
cant make enough profit to the attacker. Also before there were alot of wallet stealing trojans that had to do simple task, locate wallet.dat and upload it to attacker, but even wallets are much more secure now.
Bitcoin simply isnt as profitable for attackers as it used to be, so they moved elsewhere.
There now are stories like this one from Verge, which is much more troubling : http://www.theverge.com/a/anatomy-of-a-hack [worth reading]

cheers

Some users are plain lazy and just sign them all on one. Also, it is possible for malware to spread via a usb storage device. If this happens, the other keys could probably be compromised.
Since Bitcoin is decentralized, we can't expect someone to take control of your coins and keep it secure for you. It's your coins and you need to take responsibility for it. Malware threat can possibly never be eliminated in our real life world. The best way is to practice security measures. It is very easy for one to reduce the risk of being infected with virus on an everyday computer :"Don't download foreign programs".

Im considering moving to Linux for this reason and forget about updating antiviruses and whatnot.

It might also have something to do with Bitcoin's price?
The bitcoins that the trojans gain fetch far less fiat these days.

Thanks for the article, it's really scary stuff.

Purely theoretical, all bitcoin clients that do not depend on hardware encrypted keys are susceptible to these kinds of attacks. Solutions like Trezor stop these types of attacks, but the workflow is more difficult than simply using a software wallet (and they're expensive).

Hopefully, things like bitcoin will be a driving force for TPM chips, small crypto chips embedded in your computer, that stop attacks like these.

Someone mentioned the possibility of hoarding coins in an exchange earlier, which is about the worst advice ever. If you want good security you have to be responsible for it yourself. No product alone will do it for you.

Yeah I'm looking forward to the price coming down on hardware wallets like Trezor, I'll be sticking to my paper wallets in the meantime ;)

I don't want my computer to be locked up like iOS one day just to have the advantage to shift the responsibility over my computer to some "goverment trusted" foreigners. If I don't want responsibility which is the downside of freedom, I'm better off with fiat in use with traditional banking.

This is the best decision if you need to use windows use it strictly for wallets you trust and leave it offline between uses i do this without any anivirus lol, when you explore the web or need to download anything other than your wallets you have your linux system this is what i do and have never had any problem so far fingers crossed of course. 

I believe that each bitcoin core installation should include a prompt to backup the wallet on external media (CD, thumbdrive/USBstick, memory card, etc) with the option to encrypt with passphrase. This will assist users who are not tech savvy to at least have a protected hard copy elsewhere.

Electrum offline wallet for me.
The fact that it can be recovered from the seed is a big comfort.

I think you meant soft copy, hard copy is usually something printed on paper and is not inside any electronic devices. Also, there is a risk of the device getting corrupted.

This is a good idea, surprized that option isn't already included in bitcoin core to be honest.

We could also do with an secure noob-friendly way of making paperwallets.

I have heard many people losing their bitcoins from their wallets due to Trojan attacks. I have McAfee antivirus installed on my PC and it keeps deleting the Trojan viruses but still I feel it's better to have paper wallets.

Condom companies should accept btc  :P

as long as your btc are in a cold storage, malware/trojan cannot do anything

otherwise dedicate a network and a desktop exclusively to your bitcoin client, and don't surf or DL nothing on that machine, 100% safe, unless a real thief enter your house, but that's another story....

There is no need to dedicate a whole computer for that, you can much more easily create a virtual machine with all your wallets and rest of stuff u need to protect and store it on a usb drive.
Would make much more sence than having a separate computer just to hold your wallet on it.

cheers

Lol it would actually be great, I havent heard a single company offering condoms for BTC, maybe it would be a good niche.

"In the past year" means from about early 2014 onwards - i.e. only a couple months after the November-December 2013 spike. Back then, the price of Bitcoin was much higher ($700's) and there were a lot more new people entering the community compared to today.


Someone else already mentioned inputs.io as an example of why it's not a good idea to store your coins on a third party exchange or wallet site and they are correct. There have been many other "hacked" online wallet services and exchanges in the past - the most famous being Mt. Gox which was trusted for many years. One of the first to be hacked was MyBitcoin which was a service that even Satoshi recommended (but only for small amounts). Recently, Bitstamp and Bter suffered major hacks too. I wouldn't feel safe having my coins stored on an exchange. For long term storage, offline or paper wallets are the best solution.


Even for someone with a botnet, it would be pointless trying to mine BTC using ordinary computers. The introduction of ASICs made the threat of botnet mining farms obsolete for Bitcoin. It would make much more sense for a botnet operator to silently mine a CPU or GPU mineable altcoin instead and then convert these coins to BTC via an exchange.


Electrum prompts for an (optional) password after installation so I'm not sure why Bitcoin Core doesn't. In fact, even the ability to encrypt the wallet in Bitcoin Core was a recent addition. Before late 2011, it was impossible to encrypt your wallet unless you used a third party tool. It wasn't until allinvain's 25,000 BTC hack (link (http://bitcointalk.org/index.php?topic=16457)) in the same year that prompted the devs to add encryption.

Hmm.. So are they targeting bitcoin users or just targeting random people and use their computer to mine bitcoins?

Any malware that uses computers to mine bitcoins would be pointless nowadays due to ASICs. Such malware did once exist but those days are now long gone. The only exception is malware that secretly mines altcoins since many altcoins can still be mined on CPUs and GPUs. The article posted by the OP seems to be talking about bitcoin users specifically:

Trojan targets everything, Bank system, nuclear power station, companies, etc ,and it try to make money or for some politics reasons.

Bitcoin is growing, becoming a traget is also quite common.

virtual machine share the same network, it won't be 100% safe, i read that there are exploit to by pass virtual machine protection, strong malware/virus can do it

the point is to have a completely separate network

Technically speaking, any computer that is attached to a network is not immune to viruses and Linux malware does exist (http://en.wikipedia.org/wiki/Linux_malware) although it's very, very rare and much less likely to cause any significant damage.


That shouldn't be a problem if your computer is encrypted with a 30+ character password via Truecrypt. Even if only your wallet is encrypted, it should still be OK.

Lol..true..He is god when it comes to BTC.. n he wont be leaving it around just like that to be hacked.

That would be a good idea and it would be better if it automatically takes a back up whenever a transaction is made so that even if the user misses out to take a backup on one day, it will do the needful without being prompted and get updated regularly.

You have to be careful what you run on your computer these days. Your computer is like a bank account but more susceptible to thefts.

Your computer is only as safe as you make it if you want to go around clicking random links downloading random crap then even if you have antivirus you should be prepared to be infected there are many top hackers that can infect your computer without even the best av finding it.

Just be careful and do not download crap on the computer you use for anything to do with finance and all will be ok i have never had a problem thankfully, but i rarely use windows so that is a benefit. 

It'll get even worse once the btc price rises again, i've always had a dedicated secure laptop for my bitcoin stuff / hot wallets and then use my main desktop pc for web browsing, games, downloading software etc

Who will benefit here .. By the way any trojans take bitcoin. And what should we do to save the bitcoin ?? All I know is using offline wallet to save btc

There's a lot of trojan stealing wallets. Obviously the trojan owner would benefit. If you take safety precautions such as not installing random softwares, it should be fine. It would be rather inconvenient to save BTC on an offline computer so most would just put it on their online computer.

Just keep things common sense and dont download wallets from recently announced coins specially those that do not release the source code right away.

A friend of mine got affected with a trojan and all his media files in his computer got locked. Now he doesn't know how to recover them because the hackers are asking for a lot of btc to release the password.

Try booting with Ubuntu. Unless the trojan encrypted their files, they should be able to make a backup with no problem.

One acid test of whether an exchanger should be "trusted" is if they have EVER accepted a bribe, or even openly charged a fee, to list an altcoin.  It's not the only test you should be looking at but it's definitely one of them.

If they are already known to be corrupt, don't trust them with your bitcoin keys.

Unfortunately, it sounds like his friend might have been infected with a variant of CryptoLocker:


Source: http://en.wikipedia.org/wiki/CryptoLocker

If the files aren't actually encrypted, then it should be possible to recover them by booting with Ubuntu. However, if they are actually encrypted then I don't think there is a way to decrypt it without paying the ransom. This is one of many reasons why it's so important to backup your data.

EDIT: Wait, I found this. Seems to be a new development that could help your friend:


Link to the service: http://www.decryptcryptolocker.com/


I don't think I've ever heard of an altcoin exchange charging listing fees before but I do know that many legitimate exchanges have paid voting for adding new altcoins where each vote costs a certain fee. In the end, the coins with the most number of votes get added. They get a lot of revenue from these votes so I don't see why a listing fee would be required.

And inputs.io wasn't an exchange anyway. It was an online wallet service similar to MyBitcoin that allowed for off-blockchain transactions.

And really, no exchanges should be "trusted" for storing anything more than pocket change either. If someone is a day trader who must store their coins on an exchange, then they should understand that part of the risk of day trading is that the exchange could go under. Mt. Gox was a highly trustworthy exchange for many years until it imploded. Bter was a respected exchange too but they were hacked twice. Poloniex was hacked too. Same with Bitstamp. No amount of respect or trustworthiness can protect against the possibility of hacks.

not necessarily. you can easily not define any network for the virtual machine so that it works as a computer with only minimum requrements like CPU, CD, and HDD and nothing more.

This is only true as long as you store the private keys separately from each-other. If you were going to do this then you might as well use an offline computer to generate and store your private keys and then keep your funds in cold storage

Trojans are targeting your computers to mine bitcoins. I found report that they find it in the torrent application. I would lie to see if it can bring some significant amount of Bitcoins.

No they don't do that anymore. It used to be that some trojans would infect computers and secretly mine bitcoins without the owner knowing but those days are long gone. There would be no point mining bitcoins because even the best computers are no match for ASICs. This has been true since 2013.

As for the torrent application, what you are probably thinking about is uTorrent. The latest version of uTorrent added a program called Epic Scale that uses your CPU to perform computing tasks in the background while it is not in use - one of these tasks being cryptocurrency mining. The cryptocurrency in this case was not Bitcoin but a related coin called Litecoin. Installing Epic Scale was technically optional as you could choose to opt out during the installation process although the installer was written in a way that made it easy to overlook this option.

Can a bitcoin mining virus make a profit today? Actually, yes, it can. But it would make much more sense to channel the computing power into mining altcoins instead. I wrote a detailed analysis of how much profit 1 million infected computers can make here (http://bitcointalk.org/index.php?topic=918303.msg10718429#msg10718429) which I've reposted below:

Very interresting link.. thanks.  ;D

I think the downward trend, was based on the small gains, received from Bitcoin trojan's and people should be made aware that alt coins are also mined from trojan infected machines.

If someone download a "FREE" / "Pirated" game from torrent sites, they should expect a little bonus trojan too. {Free is seldom FREE from virusses or trojan's}

There are many people who still think, it's OK.... so a little bonus, is OK too.  ;D 

Imagine if the company, who owned the game, had a way to determine, who pirated their game and instead of disabling it, they could enable a trojan like this and mine for Alt's from that persons CPU/GPU until they received the amount that the user stole from them. {Sounds like a good idea to me} 

not just bitcoin
trojan target is every object popular used by people
like windows, android, and many more

https://bitcoin.org/img/icons/opengraph.png                                                         http://static.guim.co.uk/sys-images/Guardian/Pix/pictures/2014/3/7/1394161985443/d31775e2-b02f-4cc4-b733-37a7e552a50b-140x84.jpeg
http://www.condomdepot.com/content/product/description/large/trojan-enz-side.gif