Bitcoin Forum

Hello all,
My cex.io account has just been hacked and drained dry.
I am in contact with Admin and they are investigating it.
The offender used the following weblink as his means of doing so.
mineramicasa.com/minera/
I am doing this as a means of helping others avoid this same trap.
I am a bit SAD because the BTC's that I had invested in the site are on loan to me, and I do not have any means of paying it back.
But I have some faith in the CEX.IO Admin team to hopefully recover my now empty account.
Imagine a world without SCUMBAGS, wouldn't it be nice?
Thanks.

0zman

Saddened to hear this. How much did you lose? Do you have any idea how it happened? i.e compromised system, key logger, stolen passwords.etc?

I have lost a bit more than 0.5 BTC in total.
I had 11 GH/s and had enough to buy another 1.5.
I have sent the files dumped in my TEMP folder to another CEX user, he will pull it apart and help to discover what and how he managed to get it done.
The webpage listed above ran a JAVA plugin, which I stupidly agreed to run.
What got my attention at first was btc-e loaded in another web browser that was closed.
It also ran an app called mtgox_bot.exe.
The Scumbag has managed to get into my account and change my password, I am locked out.
I was able to see my worker on ghash.io with 0 GH/s just before I was locked out of there.
I'm SAD.

Did you have 2-FA turned on for your account?

Either way, sorry for your loss... This seems to happen a lot more than it should.

No I didn't. My Smartphone has been out of order. I pick it up tomorrow.
Was going to do exactly that when I got it back, too late.
I feel very much like this guy.  :'( and his mate  :-[.
All I hope to do now is stop him from draining anyone else's account.
I think he needs a good poke in the EYE.

Oh man that sucks. so sorry to here that.

It seams that most people that are getting hacked did not have 2factor on there accounts. and there have been a good few.

So do you think it was the bot or the java that you ran?

I'm no coder, but I feel that it was the JAVA.
One of the dumped files was LOGIN_DATA
I opened it in Notepad only to see all of my web login account names + a lot of other code.
I'm lucky that I don't have an online wallet.
So far my CEX account is the only one that has been compromised. But that could change.
Unfortunately CEX is where all of my BTC were.
I'm just waiting on Admin now. I will reply later with updates on status of this.

UPDATE:

CEX Admin have managed to get me back online and my funds are 100% still there.
Good work CEX.IO resolved quickly. Now I can sleep. It is 2:30 am here in Australia.
Good night all.
 ;D ;D ;D ;D ;D

0zman

Glad to hear it! I'm really happy for you! Looks like you'll have some peaceful sleep... :)

Once you get your phone back, remember to activate 2-FA!

Thanks,
Yes it will be priority number 1.
Have a good day to everyone, wherever you are on this Beautiful blue planet.
I'm off to the land of NOD.

So my understanding is that your machine been injected with java from website and this way someone sucked all info from webrowser or computer.
No spyware or good antyvir installed?? What browser you using?

My browser blocking this plugin to run, so u had to click on it.
Safest way is to disable java in browser

Lesson for everyone. Never run a Java plugin. Sorry for your loss

That and turn on 2-FA as soon as you can, while making sure to keep your keys in a safe place. Obviously, it's not 100% foolproof, but it can save you from a lot of trouble a lot of the time.

you dont need a phone to use it.

https://github.com/gbraad/html5-google-authenticator

take care.

Thanks for that. I was worrying about that last night. Got 2fa on so many sites now. What if my phone disappeared ...... now I know what to do :)

youre welcome

Java is ok from trusted places or sandboxed. The best one is http://www.sandboxie.com/ (http://www.sandboxie.com/)

I did download whole site as mirror and  applet.jar on the website. Anyone who knows java could look in that what's acctually this script doing.

Zip file is here: http://www38.zippyshare.com/v/80049771/file.html (http://www38.zippyshare.com/v/80049771/file.html)

I suggest if any one, to run it sundboxed.

I do not encourage anyone to download and open this file.

Files provided to analyse what contains that plugin and how they taking info from machine.

You've lost me ..... what Java are you encouraging people to download and run given that the thread was about someone who ran some Java and got hacked because of it ?

My intention was to provide applet which trying to load by visiting site given by OP, to someone who can check what's that plugin doing. I done it sundboxed and plugin done nothing to my laptop.
Someone who knows Java can check it and can provide info how cex account was emptied.
By downloading zip and unpack it nothing will happen. U have to applet.jar to have effect.
I did check this file by opening in editor but cannot find anything-i dont know what im looking for anyway.

Earlier today my cex.io account was hacked and also my email. The hacker sold the GHS I had and withdrew the funds. I had deposited 10 btc into my cex account. My cex account is now frozen by cex and they are investigating - whatever that means. Does not cex have the obligation to make this right??

My account was hacked too on 3 of jan about 21.30. But I don't run anything. It was about 5 BTC in GHS ant BTC. My account is frozen now.
There is no viruses on my pc, i've just checked it out.

I think that somebody has been stolen db with logins and e-mail from cex.io...

I am hoping that cex will make this right, either erstore the btc or provide enought temporary GHS to remine the lost btc.  What have they told you?

Java is a huge malware vector.  I do not run it on my PC's for reasons such as this.  This is the first time I have heard of it being used for BTC related hack stuff but it has long been used to make your webmail accounts send spam for the malware writers that wind up encouraging your friends to click malicious links since the email comes from you.  It is also frequently used to install trojans and other crap on your PC.  There is a reason java has updates almost bi-weekly.  Don't install java on any computer unless it is essential to some app you use and then don't use that computer to surf the web.

Did you have 2-FA enabled for your account?

Cex.io has been a mixed bag in the past, it seems, when it comes to hacked accounts. On the site's troll box, there have been users explaining that they had their funds withdrawn as well, with Cex.io doing nothing about it. So who know...

You don't know what you are looking for? So why look?

Leave security analysis to people that know what they are doing. They don't need advise about sandboxes either ;)

I think cex.io need to comment about this.

How many accounts have been hacked in the last week and funds stolen? Is cex.io safe at all now?

read this:

http://mentaso.com/bitcoin-news/cex-part-2-the-hacked-account-and-children-playing-grownups.html

hmm.. so if im understanding correctly... the hacker can easily get someones username/btc address and the hack.. part is the finding the persons email address ?

another bitcoin site with iffy security - what a shock

stop being cocky. I just trying to help plus the fact I have cex account and want to understand how its done. if I knew I have to deal with idiots I wouldn't wright anything at all.

You can decompile with http://jd.benow.ca/

It's a regular java driveby, with a reg to disable uac and taskmanager (I think). I found 1 valid url inside, of which the domain expired on December 20.
http:**www.mundoonlinejava.com*cgi.bin*uploads*update2.jar

On http://web.archive.org  I see it was hosted by https://pt-br.facebook.com/KingHost.Brasil

whois:
http://whois.domaintools.com/mundoonlinejava.com
It's probably registered with the email-address of the hosting comp, not sure.

If someone could get the ip-adress the domain pointed to before it expired, you might be able to download the update2.jar to get more info.

I know there have been silent javadriveby's that would run without requiring permission.
You should disable the java plugin by default...
This way Jars won't even ask for permission, so you can't 'accidently' press 'run/allow', and silent driveby's don't have a chance.

Just remember to not run that on the same computer. The point of 2fa is that the OTPs come from another source, so if your main computer is hacked all is not lost.

My account was hacked too. Cex.io doesn't seem to care. Making me feel it my fault. ??? :o

Did you have 2fa on?

I do now. I have never been hacked before this.

I mean when you were hacked.

Me too. :'(

https://bitcointalk.org/index.php?topic=365103.msg4821269#msg4821269