Wallet Hack on 4/25

[glitch003]

For storing large numbers of bitcoins an online bitcoin bank is needed. Unfortunately it will only be a matter of time before it is hacked or the owner of the site absconds with users bitcoins.

Why?  If you're really that worried about losing your coins, do a paper wallet and put it in a safe deposit box.

[1715596920]

1715596920

[1715596920]

1715596920

[1715596920]

1715596920

[1715596920]

1715596920

[Anenome5]

Update - after speaking some more with my affected customer I am no longer convinced his password was indeed strong enough.

Maybe passwords were brute-forced after all? silvereagle - just how strong was your password?

Will be happy to hear about any progress in figuring this out.

Alias was very short so may have been hackable.  Password was 15 characters long but made up of multiple words that may have been found in dictionary.  Possible but permutations to put that many words together would still be extremely high.

Still, imagine that they have downloaded every wallet on Blockchain or at least very many. They can run each password against each wallet in turn, which may make for a viable / profitable attack.

[coastermonger]

Timeout, strong password or not, wouldn't complete 2 factor authentication have saved him here?

[bozak]

Yet again, 2-factor authentication would have saved the day.  It really should be standard for on-line wallets forcing users to turn it off instead of requiring them to turn it on. 

[tolsetty]

Oh -- is this that BTC-e (hope I'm remembering this right -- sorry if I didn't) chatroom javascript hack we saw a week or two ago, anyone? IIRC, it used a keylogger, too.

javascript or java?

[LuaKT]

Was there any more progress on what caused this? Only noticed today that the small amount I keep on Blockchain was taken.

[scooter]

Sort of relevant.
This article at ARS shows how hackers are increasingly able to crack passwords that we would think are strong.
http://arstechnica.com/security/2013/05/how-crackers-make-minced-meat-out-of-your-passwords/

I hope in the near future someone comes up with a viable solution for the authentication problems we face.
2 factor authentication is a big help. But, getting services to offer it is a challenge, and then an even bigger challenge to get users to adopt it.

[FatMagic]

Sort of relevant.
This article at ARS shows how hackers are increasingly able to crack passwords that we would think are strong.
http://arstechnica.com/security/2013/05/how-crackers-make-minced-meat-out-of-your-passwords/

I hope in the near future someone comes up with a viable solution for the authentication problems we face.
2 factor authentication is a big help. But, getting services to offer it is a challenge, and then an even bigger challenge to get users to adopt it.

Excellent article, thanks for this.