Bitcoin Forum
December 04, 2016, 08:15:06 AM *
News: To be able to use the next phase of the beta forum software, please ensure that your email address is correct/functional.
 
   Home   Help Search Donate Login Register  
Pages: [1] 2 3 4  All
  Print  
Author Topic: Hacker got to my MTGOX account, he converted the USD I had......  (Read 12650 times)
NO_SLAVE
Jr. Member
*
Offline Offline

Activity: 56


DEBT IS SLAVERY


View Profile
June 14, 2011, 02:10:00 AM
 #1

Found this tidbit in the "BTC stolen" thread. Who else is just mildly interested in these goings on?  If MTGox has been hacked the entire BTC "economy" is at risk.
If this is given no serious inquiry, I think its time to close out mtgox accounts. How are normals going to overlook these issues in considering adoption of BTC?

http://forum.bitcoin.org/index.php?topic=16457.msg215164#msg215164

Full Member
***
Online Online
Posts: 133
View Profile Personal Message (Online)
   
Re: I just got hacked - any help is welcome!
June 13, 2011, 11:01:51 pm
   Reply with quote  #86
allinvain, you're not the only one.
Same hacker got to my mtgox account, he converted the USD i had to bitcoins and transfered them to the same address.

I'm not sure how he got in, if my pc is compromised or how this happened, i've been scanning and analyzing my pc for the past hours but nothing indicates a virus or whatever...
   
1480839306
Hero Member
*
Offline Offline

Posts: 1480839306

View Profile Personal Message (Offline)

Ignore
1480839306
Reply with quote  #2

1480839306
Report to moderator
Advertised sites are not endorsed by the Bitcoin Forum. They may be unsafe, untrustworthy, or illegal in your jurisdiction. Advertise here.
finack
Jr. Member
*
Offline Offline

Activity: 56


View Profile
June 14, 2011, 02:16:04 AM
 #2

Occam's razor suggests that one mt. gox account being compromised indicates a client computer getting hacked or an account password getting phished and not some compromise of the exchange's server.
kwukduck
Legendary
*
Offline Offline

Activity: 1564


View Profile
June 14, 2011, 02:16:45 AM
 #3

Let's  not panic over this, MtGox is informed and probably looking into it.
Most likely just something stupid i got on my machines...

14b8PdeWLqK3yi3PrNHMmCvSmvDEKEBh3E
SomeoneWeird
Hero Member
*****
Offline Offline

Activity: 700


View Profile
June 14, 2011, 02:18:12 AM
 #4

Yeah, as the others said, it's probably your computer, not MtGox being hacked. Try running a couple of different antivirus products, I'd recommend Avira, Comodo and possibly Malware Bytes.
Dude65535
Full Member
***
Offline Offline

Activity: 126


View Profile
June 14, 2011, 02:24:28 AM
 #5

There is also the issue of password reuse.

kwukduck did you use the same password for Mt.gox and anywhere else?

1DCj8ZwGZXQqQhgv6eUEnWgsxo8BTMj3mT
matt.collier
Member
**
Offline Offline

Activity: 105



View Profile
June 14, 2011, 02:35:54 AM
 #6

You're going to have to do better than running off the shelf AV software.  If this is the action of some malware, it has to be captured before a sample can even be submitted AV software company.  A previous poster named some of the less effective AV programs according to this report: http://www.av-test.org/certifications

You need to have someone who knows what they are doing look at your system.

Don't count on AV software to save you from any bitcoin related payloads at this point.  Bitcoin related actions won't be part of any heuristic scanning at this point.
Anonymous
Guest

June 14, 2011, 02:42:39 AM
 #7

Just use a Linux OS when it comes to Bitcoin, gentlemen. Windows is not for finances.
kinghajj
Member
**
Offline Offline

Activity: 66


View Profile
June 14, 2011, 02:56:53 AM
 #8

Yes, Linux should be more secure and it mines faster. There's no reason not to invest <$100 for a new hard drive to install some Linux distro onto if you're gonna invest heavily into Bitcoin.
CoinMan
Member
**
Offline Offline

Activity: 104



View Profile
June 14, 2011, 03:02:22 AM
 #9

Just use a Linux OS when it comes to Bitcoin, gentlemen. Windows is not for finances.

Well said.

My Bitcoin Identity
Bitcoin: 183DFFQXR4xCyseBXzmh3XWc22izDWE5Dw
SomeoneWeird
Hero Member
*****
Offline Offline

Activity: 700


View Profile
June 14, 2011, 03:09:19 AM
 #10

Just use a Linux OS when it comes to Bitcoin, gentlemen. Windows is not for finances.

Well said.

+1
NO_SLAVE
Jr. Member
*
Offline Offline

Activity: 56


DEBT IS SLAVERY


View Profile
June 14, 2011, 03:14:09 AM
 #11

I saw mentioned a user dedicating a non networked laptop for anything relating to BTC. Well worth the sacrifice of a laptop turned into a wallet.
jbmiller10
Full Member
***
Offline Offline

Activity: 134



View Profile
June 14, 2011, 04:12:07 AM
 #12

This exact same thing happened to me earlier.
I think my password was brute-forced.

Lesson learned is, use complex alphanumeric+symbols passwords, and change them frequently.

Mt. Gox also really needs to add some sort of secondary verification.

I go by threestar most places.
Join us in the Digitalcoin Chatroom!
hugolp
Hero Member
*****
Offline Offline

Activity: 742



View Profile
June 14, 2011, 05:30:47 AM
 #13

I saw mentioned a user dedicating a non networked laptop for anything relating to BTC. Well worth the sacrifice of a laptop turned into a wallet

Mmmmm. How are you going to connect to the Bitcoin network with a non-networked laptop?
Capitan
Member
**
Offline Offline

Activity: 112


View Profile
June 14, 2011, 05:35:02 AM
 #14

Just use a Linux OS when it comes to Bitcoin, gentlemen. Windows is not for finances.

Are there truly no vulnerabilities in Linux?
Dude65535
Full Member
***
Offline Offline

Activity: 126


View Profile
June 14, 2011, 05:38:20 AM
 #15

Mmmmm. How are you going to connect to the Bitcoin network with a non-networked laptop?

You only need to connect for the brief period needed to send bitcoins to you less secure spending wallet. Also you don't need to connect to the internet just to your primary machine that is running bitcoin. The main machine will relay transaction to the rest of the bitcoin network. You could even connect the two while your home network was disconnected from the internet. After the main machine is connected to the internet it can then rebroadcast the transaction.

1DCj8ZwGZXQqQhgv6eUEnWgsxo8BTMj3mT
kinghajj
Member
**
Offline Offline

Activity: 66


View Profile
June 14, 2011, 05:39:35 AM
 #16

Just use a Linux OS when it comes to Bitcoin, gentlemen. Windows is not for finances.

Are there truly no vulnerabilities in Linux?

There must certainly are some yet to be found and fixed, but Linux is not as big of target as Windows. Though it's true that Linux is highly used in corporate infrastructure, those systems are usually well-secured with other layers. Windows, by contrast, attracts criminals because it's the operating system of the computer incompetent. Windows boxes are easier "marks."
hugolp
Hero Member
*****
Offline Offline

Activity: 742



View Profile
June 14, 2011, 05:46:41 AM
 #17

Mmmmm. How are you going to connect to the Bitcoin network with a non-networked laptop?

You only need to connect for the brief period needed to send bitcoins to you less secure spending wallet. Also you don't need to connect to the internet just to your primary machine that is running bitcoin. The main machine will relay transaction to the rest of the bitcoin network. You could even connect the two while your home network was disconnected from the internet. After the main machine is connected to the internet it can then rebroadcast the transaction.

But you dont need a laptop for this. Just get a USB memory, install linux and boot from there.

As for the other suggestion is way too complicated for the average user.
fcmatt
Legendary
*
Offline Offline

Activity: 1106


View Profile
June 14, 2011, 05:57:51 AM
 #18

Just use a Linux OS when it comes to Bitcoin, gentlemen. Windows is not for finances.

Are there truly no vulnerabilities in Linux?

there are of course. over the years linux was basically swiss cheese. all nix in general.

local roots are quite common with a true remote root/or user access being quite uncommon now days.
one has to have some type of port listening. but even a kernel root is no longer unheard of. a proof
of concept was released a couple of years ago. if you hang around with the right circle of people
you come to the realization that a few folks have the knack for auditing code for vunls. For some
it is their job. Others a hobby.

the thing that has changed now days is that attackers no longer audit sendmail or ftp daemons for
issues... they are reviewing web browsers, plug ins, mail clients, flash, pdf, etc...
so it may not be linux at fault but other software ran on it.

why does an attacker need root? i bet permissions as your username would be just fine to do any
dirty deed. If not.. wait until spender releases another local root ;-)
lemonginger
Full Member
***
Offline Offline

Activity: 210


firstbits: 121vnq


View Profile
June 14, 2011, 06:03:20 AM
 #19

Just use a Linux OS when it comes to Bitcoin, gentlemen. Windows is not for finances.

If BTC adoption is tied to Linux adoption we're all doomed Tongue
Nescio
Jr. Member
*
Offline Offline

Activity: 56


View Profile
June 14, 2011, 08:42:04 AM
 #20

You only need to connect for the brief period needed to send bitcoins to you less secure spending wallet. Also you don't need to connect to the internet just to your primary machine that is running bitcoin. The main machine will relay transaction to the rest of the bitcoin network. You could even connect the two while your home network was disconnected from the internet. After the main machine is connected to the internet it can then rebroadcast the transaction.

None of this negates the possibility of a trojan already sitting on the networked machine intercepting everything.

Running from a USB stick is no guarantee either, an attacker who got access to your networked machine has various non-volatile attack avenues: such as BIOS rootkits: http://www.infoworld.com/d/security-central/hackers-find-new-place-hide-rootkits-252 - there is also working code for inserting modules into network card BIOS code (e.g. for disk password entry if your BIOS does not support it), this could easily be coopted as well.

Not many people are aware that BIOSes have a privileged execution mode (SMI/SMM) for running code in the background, used for low level hardware stuff (e.g. hw watchdogs), which is basiclly undetectable from within an OS running on top of it. It doesn't matter whether you use Windows or Linux (although for obvious reasons Windows is more likely to get compromised).

It's very likely Bitcoin specific malware is already out in the wild, perhaps as a module to an existing crimeware kit, perhaps something targeted. Virus scanners are useless in general since they work on the basis of guarding against infections that usually become known after the fact, and target masses, not spearhead phishing. And most of them have a somewhat poor detection rate even for generic attacks.
Pages: [1] 2 3 4  All
  Print  
 
Jump to:  

Sponsored by , a Bitcoin-accepting VPN.
Powered by MySQL Powered by PHP Powered by SMF 1.1.19 | SMF © 2006-2009, Simple Machines Valid XHTML 1.0! Valid CSS!