Bitcoin Forum
December 10, 2016, 08:57:48 PM *
News: To be able to use the next phase of the beta forum software, please ensure that your email address is correct/functional.
 
   Home   Help Search Donate Login Register  
Pages: « 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 [18] 19 20 21 22 23 24 25 26 27 28 29 30 31 32 »
  Print  
Author Topic: I just got hacked - any help is welcome! (25,000 BTC stolen)  (Read 343678 times)
Nescio
Jr. Member
*
Offline Offline

Activity: 56


View Profile
June 16, 2011, 03:38:47 AM
 #341

none of that helps against a compromised machine.

Actually, it does.
You may fool an attacker into thinking that he hacked all the layers, while he only hacked top 2 of them.

Maybe we are misunderstanding eachother, but what do you think gets captured by a keylogger running on the *host* where you open a VM in a VM in a VM via a VNC session and you type in a TrueCrypt password, anywhere? Bonus points for guessing the same for what happens if you press PrtScr.

Quote from: ShadowOfHarbringer
Security by obscurity + surprise element.

Security by self delusion is a new one Smiley Although, noooobody expects Self Delusion! We have two VMs.. no, we have three VMs! Wait, I'll come back in again. ... Chief amongst our surprises are such elements as TrueCrypt, VMs...

Quote from: ShadowOfHarbringer
Also, a possible attacker may not be prepared for task of this level of complexity.

Security by underestimating your opponent is another good one.

I think for half a million an attacker will do push ups, run around the block every morning and wear double D in broad daylight, or alternatively pay 10k to a bunch of people who are quite prepared already.

Quote from: ShadowOfHarbringer
Generally my thinking is that you can create multiple levels of complexity and every one of the makes it more difficult for the attacker to hack you.

A hall of mirrors is so Commodore 64 Smiley The object of security is not complexity, in fact the simpler you can make the more secure, because the less components can contain additional vulnerabilities. This happened: firewalls containing problems which made the machine less secure than without them. Virus scanners that kill your data due to false positives etc.

Quote from: CharlieContent
Poirot is Belgian. Tongue

Yes, and in this case instead of complaining he would point out the murderer of the joke.. Smiley
1481403468
Hero Member
*
Offline Offline

Posts: 1481403468

View Profile Personal Message (Offline)

Ignore
1481403468
Reply with quote  #2

1481403468
Report to moderator
Advertised sites are not endorsed by the Bitcoin Forum. They may be unsafe, untrustworthy, or illegal in your jurisdiction. Advertise here.
1481403468
Hero Member
*
Offline Offline

Posts: 1481403468

View Profile Personal Message (Offline)

Ignore
1481403468
Reply with quote  #2

1481403468
Report to moderator
1481403468
Hero Member
*
Offline Offline

Posts: 1481403468

View Profile Personal Message (Offline)

Ignore
1481403468
Reply with quote  #2

1481403468
Report to moderator
MoonShadow
Legendary
*
Offline Offline

Activity: 1666



View Profile
June 16, 2011, 03:45:30 AM
 #342

none of that helps against a compromised machine.

Actually, it does.
You may fool an attacker into thinking that he hacked all the layers, while he only hacked top 2 of them.

Maybe we are misunderstanding eachother, but what do you think gets captured by a keylogger running on the *host* where you open a VM in a VM in a VM via a VNC session and you type in a TrueCrypt password, anywhere? Bonus points for guessing the same for what happens if you press PrtScr.


A VM truecrypt that uses an on-screen keyboard that is randomly scrambled with each startup.  User clicks in his passcode.  Keylogger fails, mouse recording fails, screen capture does not fail.

Speech to text?  Soundcard sniffer?

"The powers of financial capitalism had another far-reaching aim, nothing less than to create a world system of financial control in private hands able to dominate the political system of each country and the economy of the world as a whole. This system was to be controlled in a feudalist fashion by the central banks of the world acting in concert, by secret agreements arrived at in frequent meetings and conferences. The apex of the systems was to be the Bank for International Settlements in Basel, Switzerland, a private bank owned and controlled by the world's central banks which were themselves private corporations. Each central bank...sought to dominate its government by its ability to control Treasury loans, to manipulate foreign exchanges, to influence the level of economic activity in the country, and to influence cooperative politicians by subsequent economic rewards in the business world."

- Carroll Quigley, CFR member, mentor to Bill Clinton, from 'Tragedy And Hope'
MoonShadow
Legendary
*
Offline Offline

Activity: 1666



View Profile
June 16, 2011, 03:46:48 AM
 #343

Some moron just admitted to stealing half a million bucks on Twitter?! Time to call your local FBI office.

agreed. theft of $500,000 in assets is a huge deal. you wouldn't get that from holding up a moderately sized bank. this has gotten a fair amount of attention and someone is going to jail for it for a long time. doesn't even matter if its the right person. nothing scares the people in power more then the concept of their money being stolen.

I'm going to get in touch with the RCMP who I hope will co-ordinate with FBI, InterPol and all the other international police agencies that can get involved.

You can expect to pay capital gains taxes on that sum, if it is recovered.  If not, then claim it as a loss on your taxes!

"The powers of financial capitalism had another far-reaching aim, nothing less than to create a world system of financial control in private hands able to dominate the political system of each country and the economy of the world as a whole. This system was to be controlled in a feudalist fashion by the central banks of the world acting in concert, by secret agreements arrived at in frequent meetings and conferences. The apex of the systems was to be the Bank for International Settlements in Basel, Switzerland, a private bank owned and controlled by the world's central banks which were themselves private corporations. Each central bank...sought to dominate its government by its ability to control Treasury loans, to manipulate foreign exchanges, to influence the level of economic activity in the country, and to influence cooperative politicians by subsequent economic rewards in the business world."

- Carroll Quigley, CFR member, mentor to Bill Clinton, from 'Tragedy And Hope'
allinvain
Legendary
*
Offline Offline

Activity: 2002



View Profile
June 16, 2011, 04:07:11 AM
 #344


You know what guys, if we expect the average joe to have to learn to become a security expert just to use bitcoin, then bitcoin is pretty much doomed.


Nonsense.  It just means that those who are good at security will become the new guardians of the realm.  Bitcoin was never really meant to be used at the protocol level by Joe Six Pack.  There will be geeks who write secure wallet systems for android and such that let Joe use bitcoins in daily life as an abstract means to pay with his mobile phone or over the Internet securely.  We don't really want one single client with one security model, because if it has flaws they all willl.  We want a bunch of clients, each doing security in a different way.  The bazzar, not the cathedral.

Hmm, don't you think this will take away from the decentralized nature of the bitcoin monetary system? In the end this is what must happen in order for bitcoin to gain mainstream acceptance. You have to trust someone else other than your self, but that may be the price you have to pay. In that case it would be wise to spread out your bitcoin savings amongst several of these security experts and whatever bitcoin banks they will eventually operate.

This is a crazy idea but we need some form of unique physical form of ID or way of signing your private keys - say retina scan.

Chimel
Newbie
*
Offline Offline

Activity: 13


View Profile
June 16, 2011, 04:15:10 AM
 #345

Or you could just put a majority of your coins onto couple of cheap thumbdrives, encrypt them, and put one in a safety deposit box and another in a bubble wrap envelope with your last will and testament.
But that's still putting all this money into a single basket, bitcoins. It does not matter if it's stored in different wallets, it's the same currency. If the exchange rate collapses or something happens to the currency, you have 25,000 BTC valued at $0.

I invest all of the $ salary that I don't spend, I invest into other areas half of the $ earnings I get from trading, it's a common sense security against something going wrong. Even if you lose all your earnings or they got stolen, you still have whatever you invested into these other areas, which with time represents the majority of your capital.
rezin777
Full Member
***
Offline Offline

Activity: 154


View Profile
June 16, 2011, 04:16:18 AM
 #346

This is a crazy idea but we need some form of unique physical form of ID or way of signing your private keys - say retina scan.

Well every "average joe" that I know has a retina scanner!  Huh

All you need for a practically foolproof secure wallet is a computer that never touches the internet and a little effort on the users part.

A savings account that can be accessed if needed. Like buying a safe or renting a safe deposit box.

Put fewer Bitcoins on a spending account that is less secure. Like carrying cash around daily.
allinvain
Legendary
*
Offline Offline

Activity: 2002



View Profile
June 16, 2011, 04:16:18 AM
 #347

Some moron just admitted to stealing half a million bucks on Twitter?! Time to call your local FBI office.

agreed. theft of $500,000 in assets is a huge deal. you wouldn't get that from holding up a moderately sized bank. this has gotten a fair amount of attention and someone is going to jail for it for a long time. doesn't even matter if its the right person. nothing scares the people in power more then the concept of their money being stolen.

I'm going to get in touch with the RCMP who I hope will co-ordinate with FBI, InterPol and all the other international police agencies that can get involved.

You can expect to pay capital gains taxes on that sum, if it is recovered.  If not, then claim it as a loss on your taxes!

Honestly I don't care about that. I would've had to pay taxes anyway if I cashed out. Which at the time I was stubborn and did not. Now that I think about it I should've just sold nearly all of them. Me and my big bitcoin business dreams..pff...


allinvain
Legendary
*
Offline Offline

Activity: 2002



View Profile
June 16, 2011, 04:32:21 AM
 #348

This is a crazy idea but we need some form of unique physical form of ID or way of signing your private keys - say retina scan.

Well every "average joe" that I know has a retina scanner!  Huh

All you need for a practically foolproof secure wallet is a computer that never touches the internet and a little effort on the users part.

A savings account that can be accessed if needed. Like buying a safe or renting a safe deposit box.

Put fewer Bitcoins on a spending account that is less secure. Like carrying cash around daily.

If bitcoin becomes the future currency of the world you can bet retina scanners will become more common. That and you'll see a lot more people with eye patches. Ok, I am just joking around.

I face a dillemma here. How do I get the bitcoin client into a non internet connected machine? This is assuming that you can never 100% trust the computer you're using to download the client. Along each step in the process of securing your bitcoins there is a small but every so slightly possible risk. Heck the client itself could be compromised. A hacker could break into the sourceforge servers and cleverly attach a payload into the official client. Guess how many people would not notice until it was too late.

I think the safest and most paranoid idea I've head so far is to physically print your private keys. I am even tempted to print them on a freaking gold plate!

What I thought of is an actual bitcoin wallet device. It would run a minimalistic version of the bitcoin client in firmware (naturally encrypted and password protected). All inputs would be via touch screen via the use of one of those secure keyboard apps. This device could be connected to the internet but only via a physical connection. And further it could only connect to the bitcoin network and have no other tcp/ip capabilities. The device should also be physically hardened. Also a "wallet backup" feature should be available and a simple usb port should be there as well.


MoonShadow
Legendary
*
Offline Offline

Activity: 1666



View Profile
June 16, 2011, 04:38:10 AM
 #349


What I thought of is an actual bitcoin wallet device. It would run a minimalistic version of the bitcoin client in firmware (naturally encrypted and password protected). All inputs would be via touch screen via the use of one of those secure keyboard apps. This device could be connected to the internet but only via a physical connection. And further it could only connect to the bitcoin network and have no other tcp/ip capabilities. The device should also be physically hardened. Also a "wallet backup" feature should be available and a simple usb port should be there as well.



Or just buy a used Android phone off of Ebay, and install your custom client with the cell radios turned off.  whenever you needed to update the blockchain or otherwise access the p2p network, then turn on the wifi radio and connect temporarily.  The truly paranoid could open up the phone and de-solder the radios other than the wifi.  Or the really paranoid could de-solder them all and only use a usb cable to connect to the p2p network.

"The powers of financial capitalism had another far-reaching aim, nothing less than to create a world system of financial control in private hands able to dominate the political system of each country and the economy of the world as a whole. This system was to be controlled in a feudalist fashion by the central banks of the world acting in concert, by secret agreements arrived at in frequent meetings and conferences. The apex of the systems was to be the Bank for International Settlements in Basel, Switzerland, a private bank owned and controlled by the world's central banks which were themselves private corporations. Each central bank...sought to dominate its government by its ability to control Treasury loans, to manipulate foreign exchanges, to influence the level of economic activity in the country, and to influence cooperative politicians by subsequent economic rewards in the business world."

- Carroll Quigley, CFR member, mentor to Bill Clinton, from 'Tragedy And Hope'
cronopio
Jr. Member
*
Offline Offline

Activity: 59


View Profile
June 16, 2011, 05:32:32 AM
 #350

Hacker "th3j35t3r" gets $500K Twitter twit thief to expose himself

Interesting thing

12FKPNwQUS6Em7Ar6wc1GnzpU4NWBKhTAK

WARNING! This game its so addictive
allinvain
Legendary
*
Offline Offline

Activity: 2002



View Profile
June 16, 2011, 05:35:33 AM
 #351


What I thought of is an actual bitcoin wallet device. It would run a minimalistic version of the bitcoin client in firmware (naturally encrypted and password protected). All inputs would be via touch screen via the use of one of those secure keyboard apps. This device could be connected to the internet but only via a physical connection. And further it could only connect to the bitcoin network and have no other tcp/ip capabilities. The device should also be physically hardened. Also a "wallet backup" feature should be available and a simple usb port should be there as well.



Or just buy a used Android phone off of Ebay, and install your custom client with the cell radios turned off.  whenever you needed to update the blockchain or otherwise access the p2p network, then turn on the wifi radio and connect temporarily.  The truly paranoid could open up the phone and de-solder the radios other than the wifi.  Or the really paranoid could de-solder them all and only use a usb cable to connect to the p2p network.

That's a very good idea. It should be a bit cheaper than a dedicated custom build device, but I still think later on down the line we will see such "bitcoin wallets" appear on the scene.

ShadowOfHarbringer
Legendary
*
Offline Offline

Activity: 1470


Bringing Legendary Har® to you since 1952


View Profile
June 16, 2011, 07:03:14 AM
 #352

none of that helps against a compromised machine.

Actually, it does.
You may fool an attacker into thinking that he hacked all the layers, while he only hacked top 2 of them.

Maybe we are misunderstanding eachother, but what do you think gets captured by a keylogger running on the *host* where you open a VM in a VM in a VM via a VNC session and you type in a TrueCrypt password, anywhere? Bonus points for guessing the same for what happens if you press PrtScr.

Actually, i meant VNCing to the VM from a laptop.
VNCing from the same comp would have no sense as the keyloggers/screen capture/mouse movements capture would kill it.

But VNCing to the bottom layer from outside should be safe enough.

A hall of mirrors is so Commodore 64 Smiley The object of security is not complexity, in fact the simpler you can make the more secure, because the less components can contain additional vulnerabilities. This happened: firewalls containing problems which made the machine less secure than without them. Virus scanners that kill your data due to false positives etc.

Well, i didn't say this is the most secure way, i just said it is more secure than having single layer protection on a single computer.

The "separate minimal machine for Bitcoin only" is of course superior to everything.

allinvain
Legendary
*
Offline Offline

Activity: 2002



View Profile
June 16, 2011, 07:03:54 AM
 #353


Thus far it looks like I was hacked by the Anonymous group?

Quote
@LulzSec Look at your bitcoin balance. Hope you enjoy my a little percentage of my findings... ;-) (tinyurl.com/3mfngql)

FreeMoney
Legendary
*
Offline Offline

Activity: 1246


Strength in numbers


View Profile WWW
June 16, 2011, 08:07:56 AM
 #354


I face a dillemma here. How do I get the bitcoin client into a non internet connected machine? This is assuming that you can never 100% trust the computer you're using to download the client. Along each step in the process of securing your bitcoins there is a small but every so slightly possible risk. Heck the client itself could be compromised. A hacker could break into the sourceforge servers and cleverly attach a payload into the official client. Guess how many people would not notice until it was too late.

I think the safest and most paranoid idea I've head so far is to physically print your private keys. I am even tempted to print them on a freaking gold plate!


Are you serious? Maybe use some kind of file storage device to move Bitcoin onto the computer's hard-drive? Or you could download it and then turn off the internet forever.

Printing keys would make them as insecure as cash. It's close to the worst idea.

Play Bitcoin Poker at sealswithclubs.eu. We're active and open to everyone.
allinvain
Legendary
*
Offline Offline

Activity: 2002



View Profile
June 16, 2011, 08:14:19 AM
 #355


I face a dillemma here. How do I get the bitcoin client into a non internet connected machine? This is assuming that you can never 100% trust the computer you're using to download the client. Along each step in the process of securing your bitcoins there is a small but every so slightly possible risk. Heck the client itself could be compromised. A hacker could break into the sourceforge servers and cleverly attach a payload into the official client. Guess how many people would not notice until it was too late.

I think the safest and most paranoid idea I've head so far is to physically print your private keys. I am even tempted to print them on a freaking gold plate!


Are you serious? Maybe use some kind of file storage device to move Bitcoin onto the computer's hard-drive? Or you could download it and then turn off the internet forever.

Printing keys would make them as insecure as cash. It's close to the worst idea.

That's what I eventually will do - use a brand new usb stick on a machine that I feel reasonably sure that it's clean - maybe even from within a vmware image running on that clean machine.

Funny you should say cause a lot of people are saying that physically printing the keys and storing them in a safe is a super secure method of protecting your balance. I worry about what if someone steals or breaks into the safe. I'd think an encrypted USB stick would be better - unless the encryption can be broken via brute force.

winnetou
Sr. Member
****
Offline Offline

Activity: 361


View Profile
June 16, 2011, 09:20:39 AM
 #356

Quote
@LulzSec Look at your bitcoin balance. Hope you enjoy my a little percentage of my findings... ;-) (tinyurl.com/3mfngql)
Where is this posted?

The thief is probably reading this thread, too. I have to say that it is the lamest thing ever to rub someones 25k btcs. I hope all bad things he ever did are coming back to him and he never will be lucky until he sends the money back. It would be gentleman like to do this or at least >75% I think allinvain would give him a suitable finder's reward and both can sleep well again.. .

@allinvain, some days ago I got a PM from a spammer that asked me what is the best miner. it included a link to a website that hosted all recent miners and the official client - but probably infected because even the official client was hosted on this space. You have never downloaded something from such a site !?

btw: this thing is on the top at Germans biggest it-magazine/site, http://www.heise.de/newsticker/meldung/Bitcoin-Diebstahl-Eine-halbe-Million-US-Dollar-weg-1261046.html
manifold
Member
**
Offline Offline

Activity: 62


View Profile
June 16, 2011, 10:32:00 AM
 #357

oh.... that is so....  did you mine these 25.000?

Yeah maybe there should be a default encryption on the wallet....
For everyone wanting to encrypt your wallet, I wrote a little script to mount the truecrypt volume conveniently: http://rn0.ru/show/jrfH6yLK84YQvC7jx0wK/

Osiris Bitcoin Forum
This is a recursive text, if you restart reading from the beginning. And you will never get to this point informing you that it had no exit condition.
jerfelix
Sr. Member
****
Offline Offline

Activity: 266


View Profile
June 16, 2011, 10:52:15 AM
 #358

I face a dillemma here. How do I get the bitcoin client into a non internet connected machine? This is assuming that you can never 100% trust the computer you're using to download the client.

1. Download LinuxCoin ISO.
2. Put LinuxCoin ISO on a CD or USB device
3. Turn off PC  (hard for you guys, I know!!!)
4. UNPLUG PC from Network, and turn off any wireless open access points
5. Boot from the LinuxCoin CD or USB device
6. Run Bitcoin Client - a random wallet is created
7. Record the Bitcoin Address (public key) that is displayed in the client.  You can write it down, or store it on a CD or USB drive that is "ok to contaminate".
8. Exit the Bitcoin Client
9. Store the wallet.dat file on multiple CD's and a USB device.  heck, print it if you want.  Virgin wallet files are small enough.  These are "NOT ok to contaminate".  Never let these touch a PC connected to the internet.
10. Power off your PC.  The wallet file Never touched your hard drive (since LinuxCoin is all RAM based).  
11. Remove all your media that is "NOT ok to contaminate"
12. Power up your PC as you normally would.


At this point you have a "savings account wallet".  Any time you want to put away money for a rainy day, send BTC to the address that you recorded in Step 7.  You can verify your account balance or see all transfers via BlockExplorer.

Take your CDs and USB devices and paper, and store them in several safe places far apart from each other.  Include instructions for your next-of-kin.

If you are super paranoid, feel free to encrypt your wallet (between steps 8 and 9) , but as others have said, this is risky in that you may forget your pass phrase.  My recommendation is that if you encrypt it, you store with it some clues to your pass phrase that only you would know.  For instance "My pass phrase is the one I used in 2011.  It has 8 words.  It has to do with my favorite song and that wench girl who dumped me in 5th grade" (or whatever)


Option 2:  If you trust me, contact me, and I'll create for you 2 virgin wallets, each with 2 CDs, a USB device, and a paper printout, using the above technique.  One is for you to practice with (maybe with .5 BTC, to make sure you can recover later), the other is your permanent Savings Vault.  I'll delete any copies I have, and so if you lose it, you're on your own (i.e. you're screwed).  The benefit is, you don't have to worry about the security of my copies.  You can randomly select one of the two as practice, to make sure that withdrawal from your "savings account" will be straight forward.

I'll do this service for anyone, for 2.5 BTC (while 1 BTC is in the $20 range), including shipping.  If you receive the package un-tampered, you should be safe.  Contact me if you are interested.
gusti
Legendary
*
Offline Offline

Activity: 1102


View Profile
June 16, 2011, 12:05:45 PM
 #359

I face a dillemma here. How do I get the bitcoin client into a non internet connected machine? This is assuming that you can never 100% trust the computer you're using to download the client.

1. Download LinuxCoin ISO.
2. Put LinuxCoin ISO on a CD or USB device
.............................................................


Your described method need a blind trust on LinuxCoin ISO.
Did anybody audit it ?

If you don't own the private keys, you don't own the coins.
jerfelix
Sr. Member
****
Offline Offline

Activity: 266


View Profile
June 16, 2011, 12:20:13 PM
 #360

I face a dillemma here. How do I get the bitcoin client into a non internet connected machine? This is assuming that you can never 100% trust the computer you're using to download the client.

1. Download LinuxCoin ISO.
2. Put LinuxCoin ISO on a CD or USB device
.............................................................


Your described method need a blind trust on LinuxCoin ISO.
Did anybody audit it ?
You are correct.

I compared the bitcoin executable to the same version number that was posted on sourceforge. 
But then again, your question needs a blind trust in me (or some other auditor), unless you are willing to audit yourself.  In addition, this whole system is based on open source software that should be audited by a trusted auditor.  I didn't audit the source of Bitcoin, and don't personally know and trust anybody who did.  Did you?

The risk is that LinuxCoin ISO is spitting out "predictable" wallet ID's.  You can create your own wallet file manually if you want.

LinuxCoin was created by some people in the Bitcoin community with reputations.  I don't personally know drgr33n, gnukix, Davidonpda, or Xenland.  So don't trust my recommendation. Use your own judgment.  I'm not making paid endorsements, I'm just suggesting what looks like a reasonable path.
Pages: « 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 [18] 19 20 21 22 23 24 25 26 27 28 29 30 31 32 »
  Print  
 
Jump to:  

Sponsored by , a Bitcoin-accepting VPN.
Powered by MySQL Powered by PHP Powered by SMF 1.1.19 | SMF © 2006-2009, Simple Machines Valid XHTML 1.0! Valid CSS!