I just got hacked - any help is welcome! (25,000 BTC stolen)

[Capitan]

I do know basics of how a computer works, but that doesn't make me a security expert. I don't want to become a security expert, and I don't want to spend hundreds of hours learning about security. In an ideal world I would, because yes, that is an interesting topic, but as it turns out I have other things to spend my time on.

Not everyone can be an expert in security. That's an unrealistic request. It would be nice if we had people who knew security giving out useful, actionable advice rather than "that sucks. learn real security. compare the hashes of all your .exe's by hand".

I guess I'm still frustrated because I don't know what mistakes the OP made (besides using Windows in the first place), and therefore I don't know if I'm making the same ones too.

[1714049342]

1714049342

[1714049342]

1714049342

[1714049342]

1714049342

[1714049342]

1714049342

[1714049342]

1714049342

[Nescio]

A VM truecrypt that uses an on-screen keyboard that is randomly scrambled with each startup.  User clicks in his passcode.  Keylogger fails, mouse recording fails, screen capture does not fail.

Speech to text?  Soundcard sniffer?

If LogMeIn, VNC or remote desktop can do all of that, so can malware. A scrambled mouse driven keyboard is no protection against a screenshot + mouse capture, or delta based screengrabs a la remote desktop. Audio + webcam are routinely used for spying, whether in the form of anti-theft (Prey) or highschool scandal where teachers were watching the kids at home like a soap.

Of course I agree that the base attack will most likely be limited, but a simple screengrab with a large enough balance visible will be plenty of reason to upgrade the kit with more sophisticated modules.

It's always good to assume the worst in security, so you cannot depend on a compromise that only installs a DDoS module, especially if Bitcoin becomes prevalent.

[Nescio]

I think the safest and most paranoid idea I've head so far is to physically print your private keys. I am even tempted to print them on a freaking gold plate!

That's awesome, "My Bitcoin is backed by gold! Have at that you fiat based currency!"

[allinvain]

I think the safest and most paranoid idea I've head so far is to physically print your private keys. I am even tempted to print them on a freaking gold plate!

That's awesome, "My Bitcoin is backed by gold! Have at that you fiat based currency!"

Technically there is no reason why bitcoins (realistically only a portion of them) can't be backed by gold, but that would kill the whole decentralized thing bitcoin has going for itself.

[Anonymous]

Not really. Bitcoins are technically already backed by Gold. You can buy Gold with it. Ahaha.

[allinvain]

Not really. Bitcoins are technically already backed by Gold. You can buy Gold with it. Ahaha.

Question is when shit hits the fan which would you rather hold, bitcoins or gold?

So you know of an online store where you can buy gold coins with bitcons?

[rezin777]

Not really. Bitcoins are technically already backed by Gold. You can buy Gold with it. Ahaha.

Question is when shit hits the fan which would you rather hold, bitcoins or gold?

So you know of an online store where you can buy gold coins with bitcons?

Shit hits the fan? How much shit?

Anyway. Beans. Bullets. Bullion. Bitcoins.

I think Bitcoins could survive teotwawki better than most currencies. As long as there is still an internet that is. Plus they are highly portable!

[Nescio]

Actually, i meant VNCing to the VM from a laptop.
VNCing from the same comp would have no sense as the keyloggers/screen capture/mouse movements capture would kill it.

Right. But if you use VNC from a different machine, why not just run your VM there? Or vanilla Bitcoin? Since you are assuming that that machine is and remains clean, otherwise using VNC from there is just as pointless. It would even increase security since you seem to assume the original VM/VNC host could be compromised.

The "separate minimal machine for Bitcoin only" is of course superior to everything.

Definitely, if you have a sizable wallet it's worth it. If Bitcoin really takes off there will be businesses around this putting something on a cheap device, maybe smartphone.

[TraderTimm]

Can we let this thread die?

Really.

Unless you enjoy the press picking up on someone's lack of personal security and inferring bitcoin is at fault.

[imperi]

Can we let this thread die?

Really.

Unless you enjoy the press picking up on someone's lack of personal security and inferring bitcoin is at fault.

The press really eat up this forum. I bet there's reporters hovering over this place just waiting for something juicy to write about, usually negatively.

[SgtSpike]

Can we let this thread die?

Really.

Unless you enjoy the press picking up on someone's lack of personal security and inferring bitcoin is at fault.

Why are you so intent on letting the thread die?  There's still discussion going on within it, which is the whole point of a forum.

[unemployed]

Well, if OP instead of just hoarding money, would have sometimes tippped poor developers, maybe he would have no problems today. Implementing encrypted wallet isn't rocket science, it's just matter of time invested.
It's a lesson for all early miners. Avarice brings bad karma.

[Bind]

I do know basics of how a computer works, but that doesn't make me a security expert. I don't want to become a security expert, and I don't want to spend hundreds of hours learning about security. In an ideal world I would, because yes, that is an interesting topic, but as it turns out I have other things to spend my time on.

Not everyone can be an expert in security. That's an unrealistic request. It would be nice if we had people who knew security giving out useful, actionable advice rather than "that sucks. learn real security. compare the hashes of all your .exe's by hand".

I guess I'm still frustrated because I don't know what mistakes the OP made (besides using Windows in the first place), and therefore I don't know if I'm making the same ones too.

can you read a web page and follow very simple instructions to protect your wallet, allowing other experts to advise you who already did the work ?

if not, then cash in your bitcoins, delete the client, and continue using fiat currrency from central banks, because no one can help you.

Who protects the other personal wealth in your home ?

you do.

protecting the assets in your home is not bitcoins responsibility.

[unk]

Who protects the other personal wealth in your home ?

you do.

even if you believe this (though it sounds like an untenably strong view of property rights - stronger than those of any legal system in existence), many people would want to choose tools that help them protect their 'wealth' rather than encourage theft.

there are many things bitcoin could do better in this respect. for example, the block chain could easily record commitments that prevent spending beyond a certain amount from an address in an certain time. why force end users to set up complex and potentially fragile 'savings' wallets when bitcoin could simply support a voluntary declaration, recorded in the block chain, that transfers beyond some particular fraction of the wealth of an address (or some fixed amount) in a particular period are invalid? surely some people would want to use a feature like that, and it would be relatively straightforward to implement.

there are other possibilities. for example, users can record commitments using nLockTime in the block chain as a sort of 'forced savings', though at present that probably wouldn't help much with security unless the user could ensure unique possession of the target address in the future. other script-based mechanisms can aid security as well. but there's no reason bitcoin can't improve in this regard, and i'll criticize yet again the remarkable complacency, cultural conservatism, and fear of change that's been on exhibit in these forums for well over a year now. (i've seen it in literally no other open-source project i've ever worked on, and it's remarkably dysfunctional.) 'personal responsibility' is a pretty silly mantra from the perspective of a systems designer.

[TraderTimm]

Can we let this thread die?

Really.

Unless you enjoy the press picking up on someone's lack of personal security and inferring bitcoin is at fault.

Why are you so intent on letting the thread die?  There's still discussion going on within it, which is the whole point of a forum.

Absolutely.

Moderator, MODERATOR! I say good sir, could we sticky this so people see it upon their first viewing of bitcoin.org's forums? I believe it will leave a lasting impression of much goodwill.

Losing bitcoin is the first things people should see on a forum such as this. Huzzah, sir!

[unk]

Why are you so intent on letting the thread die?  There's still discussion going on within it, which is the whole point of a forum.

Absolutely.

Moderator, MODERATOR! I say good sir, could we sticky this so people see it upon their first viewing of bitcoin.org's forums? I believe it will leave a lasting impression of much goodwill.

Losing bitcoin is the first things people should see on a forum such as this. Huzzah, sir!

you seem to think that the purpose of the forums is to market the currently prominent block chain to potentially unsuspecting buyers. that would be an unfortunate view, and it's not one to which we all subscribe.

[Bind]

Who protects the other personal wealth in your home ?

you do.

even if you believe this (though it sounds like an untenably strong view of property rights - stronger than those of any legal system in existence), many people would want to choose tools that help them protect their 'wealth' rather than encourage theft.

there are many things bitcoin could do better in this respect. for example, the block chain could easily record commitments that prevent spending beyond a certain amount from an address in an certain time. why force end users to set up complex and potentially fragile 'savings' wallets when bitcoin could simply support a voluntary declaration, recorded in the block chain, that transfers beyond some particular fraction of the wealth of an address (or some fixed amount) in a particular period are invalid? surely some people would want to use a feature like that, and it would be relatively straightforward to implement.

there are other possibilities. for example, users can record commitments using nLockTime in the block chain as a sort of 'forced savings', though at present that probably wouldn't help much with security unless the user could ensure unique possession of the target address in the future. other script-based mechanisms can aid security as well. but there's no reason bitcoin can't improve in this regard, and i'll criticize yet again the remarkable complacency, cultural conservatism, and fear of change that's been on exhibit in these forums for well over a year now. (i've seen it in literally no other open-source project i've ever worked on, and it's remarkably dysfunctional.) 'personal responsibility' is a pretty silly mantra from the perspective of a systems designer.

You are correct that it is a strong view of property rights. I am not a socialist. I do not believe in a pure mob-rule democracy, which is indespensible to socialism, and redistribution of wealth. I believe in un-a-lien-able birth rights that can never be taken away. I believe it is my responsibility to protect my rights, my property, and my wealth which I have collected and paid for with my blood, sweat, and tears. I believe I have the right to donate and share my wealth, just as firmly as I believe that I have the right not to. I do not believe that is stronger than any legal system in existence.

I have never disagreed with a software design more protecting of the BTC wallet, but it does not exist, and i do not believe bitcoin holds any responsibility to create one. They have everything you need in their documentation and wiki to help you protect your wallet. To say they do, is to say the central banks holds the responsibility to protect the cash in your home. Same goes for all other posessions and wealth in the home.

So the onus is on the user to protect their home, property, wealth, and bitcoin wallet.

Those are the facts. That is reality.

Just because you feel it should be different does not negate that fact that it isnt different, and bitcoin holds absolutely no responsibility in that regard.

Yes, personal responsibility. Its all about personal responsibility.

That means you are responsible for yourself and what you own. Sure the police can investigate and possibly catch the perpetrators, but they do not prevent the theft as exemplified by the OP.

I protect what I have earned ... with deadly force if necessary. Part of that protection is prevention so force, deadly or otherwise, is hopefully never required to begin with. I dont leave $25k laying out in the open for someone to steal.

I don't believe anyone else has the responsibility to protect what is mine unless I enter into contract with them to protect it.

I must congratulate bitcoin for putting that protection information on their website to help you protect your wallet. They had no responsibility to do that either.

Problem is few take personal responsibility seriously. They dont research. They dont read. They need instant gratification and steam in head first without any understanding, even when all the information they need is right on the screen in front of them. Then they blame someone else for their own failures.

It is unfortunate, but the only one to blame is the one in the mirror.

[unk]

You are correct that it is a strong view of property rights. I am not a socialist. I do not believe in a pure mob-rule democracy, which is indespensible to socialism, and redistribution of wealth. I believe in un-a-lien-able birth rights that can never be taken away. I believe it is my responsibility to protect my rights, my property, and my wealth which I have collected and paid for with my blood, sweat, and tears. I believe I have the right to donate and share my wealth, just as firmly as I believe that I have the right not to. I do not believe that is stronger than any legal system in existence.

right, my point is that this sort of extremism still doesn't matter; you ought to agree with practical suggestions for bitcoin regardless, or at least provide a reason they wouldn't improve the product.

(at least, that's true unless your political philosophy is so extreme that you actually want there to be strife caused by the product because it promotes a kind of social darwinism. the way many people in this forum talk, you'd think they'd like the idea of harsh legal rules that cause suffering even, hypothetically, if resources weren't scarce and there weren't a need for their capitalistic allocation in the first place. it's as if the mechanism in response to scarce resources is accepted as a moral primitive on faith as a positive thing in its own right. that is a bizarre political philosophy held by almost nobody except those with unstudied intuitions on the matter, but i'd rather not debate political philosophy in detail here; it's exceedingly frustrating to do so.)

in any event, i'm not talking about impressing jeff garzik or gavin andresen into service to add a feature i like; i'm giving them a suggestion that would help many end users. i'd code it myself, but the coding is not difficult, nor is it the main barrier to adoption; it would require a somewhat coordinated decision because it could lead to disagreements among clients about valid transactions in future. that is not, of course, a weighty reason against its adoption in the present.

[MeSarah]

Im sceptical of the OP's claims. The glairing waving red flag for me is that he hasnt filed a police report. Who looses $500k and doesnt run to the police? I think that a police report being filed and the OP providing the name of the detective would provide some credibility. With the detectives name a reputable journalist would be able to confirm a police report being filed.

With recent hoaxs I am inclined to think that this is a hoax.

http://www.youtube.com/watch?v=mTTwcCVajAc

[allinvain]

Im sceptical of the OP's claims. The glairing waving red flag for me is that he hasnt filed a police report. Who looses $500k and doesnt run to the police? I think that a police report being filed and the OP providing the name of the detective would provide some credibility. With the detectives name a reputable journalist would be able to confirm a police report being filed.

With recent hoaxs I am inclined to think that this is a hoax.

http://www.youtube.com/watch?v=mTTwcCVajAc

Why do you assume that I have not?