E.Sam (OP)
|
|
August 02, 2013, 01:59:20 PM Last edit: August 03, 2013, 12:51:13 PM by E.Sam |
|
So here is what happened. Yesterday night, I withdrew BTCs from BTCT.co
Transferred: 22.65118847 BTC Payment Address: 1936Ej4GZeJ4LBsjHQ6U8v2tooTTa1jDFf Transaction ID: 248fefca0bae07642a39830d6f86a436c18f33855ec86e18794577f16421f5e7 Site Fee: 0 BTC bitcoind Fee: 0.0005 BTC
Received them into my wallet and decided to send them to BTC-e (couldn't do it directly from BTCT.co as I had a locked withdrawal address). Entered the all amount for transaction (previous to this, my wallet was empty as I rarely use it), entered my passphrase (around 25 random characters) and proceeded to send. At this point Bitcoin-QT became unresponsive. I forced quit and restarted the application, and I got the message: "wallet.dat corrupt, salvage failed". I retrieve the dat file from my daily backup and replace the corrupted one. The wallet starts to sync, and my 22.65118847 BTC are still there. I start again the process to send BTC to BTC-e, enter the passphrase, and at this point the app tells me I don't have enough funds. I go to transaction and can see that the entire wallet is being transferred to 12YabLfo4W51EqU6amYNtopPJZjRJfU46U
I really don't want anyone to go through what I went in the last 14 hours. I therefore would very much appreciate any input from the community so as to understand where I messed up.
When that happened, I had Vanitygen Bitvanity running in the background. I also had Chrome running (gmail, btct, btc-e, coindesk, etc. No dodgy websites). I m just trying to give any relevant info - let me know if I can provide anything more.
I m scanning the entire system with SOPHOS - it has done around 95% and found nothing.
Thank you all in advance for your input.
E.
[EDIT: Sorry, due to lack of sleep I just realised I had written Vanitygen instead of Bitvanity. Apology for the confusion to samr7, author of Vanitygen on Github]
|
|
|
|
|
|
|
|
Each block is stacked on top of the previous one. Adding another block to the top makes all lower blocks more difficult to remove: there is more "weight" above each block. A transaction in a block 6 blocks deep (6 confirmations) will be very difficult to remove.
|
|
|
Advertised sites are not endorsed by the Bitcoin Forum. They may be unsafe, untrustworthy, or illegal in your jurisdiction.
|
|
|
|
DannyHamilton
Legendary
Offline
Activity: 3388
Merit: 4653
|
|
August 02, 2013, 03:38:02 PM |
|
Was the 1936Ej4GZeJ4LBsjHQ6U8v2tooTTa1jDFf address generated with a vanity gen program, imported after receiving the private key from someone, or imported after being created as a brain wallet of some sort?
|
|
|
|
E.Sam (OP)
|
|
August 02, 2013, 04:03:26 PM |
|
Was the 1936Ej4GZeJ4LBsjHQ6U8v2tooTTa1jDFf address generated with a vanity gen program, imported after receiving the private key from someone, or imported after being created as a brain wallet of some sort?
No, it was an address generated by Bitoin-QT wallet. I only generated a few vanity address so to experiment, and imported a couple in my wallet. I used an OSX application found on the net https://github.com/trevory/bitvanity - I scanned it and it came clean. This said, I wasn't going to trust the source and didn't intend to use generated address for any transaction. Now that I look at this app, it does look a bit suspicious.
|
|
|
|
E.Sam (OP)
|
|
August 02, 2013, 06:17:02 PM |
|
|
|
|
|
DannyHamilton
Legendary
Offline
Activity: 3388
Merit: 4653
|
|
August 02, 2013, 06:29:14 PM |
|
Yep, sounds like the Vanity Generator that you installed was a trojan. I assume your Bitcoin-Qt wallet wasn't password protected either? Or did the vanity generator manage to capture your keyboard input and get your password that way?
|
|
|
|
E.Sam (OP)
|
|
August 02, 2013, 06:34:44 PM |
|
Yep, sounds like the Vanity Generator that you installed was a trojan. I assume your Bitcoin-Qt wallet wasn't password protected either? Or did the vanity generator manage to capture your keyboard input and get your password that way? It was protected (25 random characters) - I think it waited for me to enter my password. As soon as that happened, it just sent the all wallet content. I have now contacted Github and asked for this "app" to be taken down. Hard lesson.
|
|
|
|
Moebius327
|
|
August 02, 2013, 06:38:54 PM |
|
Yep, sounds like the Vanity Generator that you installed was a trojan. I assume your Bitcoin-Qt wallet wasn't password protected either? Or did the vanity generator manage to capture your keyboard input and get your password that way? It was protected (25 random characters) - I think it waited for me to enter my password. As soon as that happened, it just sent the all wallet content. I have now contacted Github and asked for this "app" to be taken down. Hard lesson. Sorry to hear that. I experienced the same thing using the Mac OS app of Electrum.
|
|
|
|
E.Sam (OP)
|
|
August 02, 2013, 06:43:57 PM |
|
Yep, sounds like the Vanity Generator that you installed was a trojan. I assume your Bitcoin-Qt wallet wasn't password protected either? Or did the vanity generator manage to capture your keyboard input and get your password that way? It was protected (25 random characters) - I think it waited for me to enter my password. As soon as that happened, it just sent the all wallet content. I have now contacted Github and asked for this "app" to be taken down. Hard lesson. Sorry to hear that. I experienced the same thing using the Mac OS app of Electrum. Thanks, good to know. I will from now on become way more paranoid. I suppose my all wallet is now compromised. The best thing is just to delete the all thing since I have no BTCs left, no? Also, any suggestions on how to be sure I fully delete the app from my system?
|
|
|
|
Kouye
Sr. Member
Offline
Activity: 336
Merit: 250
Cuddling, censored, unicorn-shaped troll.
|
|
August 02, 2013, 06:46:56 PM |
|
There is a chance the malware just took advantage of your wallet unlocking to push a TX, and not steal your private keys along. I would keep the wallet just in case, since you might receive payments on one of his addresses, but start a fresh one anyway, too.
|
[OVER] RIDDLES 2nd edition --- this was claimed. Look out for 3rd edition! I won't ever ask for a loan nor offer any escrow service. If I do, please consider my account as hacked.
|
|
|
Moebius327
|
|
August 02, 2013, 06:47:24 PM |
|
Yep, sounds like the Vanity Generator that you installed was a trojan. I assume your Bitcoin-Qt wallet wasn't password protected either? Or did the vanity generator manage to capture your keyboard input and get your password that way? It was protected (25 random characters) - I think it waited for me to enter my password. As soon as that happened, it just sent the all wallet content. I have now contacted Github and asked for this "app" to be taken down. Hard lesson. Sorry to hear that. I experienced the same thing using the Mac OS app of Electrum. Thanks, good to know. I will from now on become way more paranoid. I suppose my all wallet is now compromised. The best thing is just to delete the all thing since I have no BTCs left, no? Also, any suggestions on how to be sure I fully delete the app from my system? You should format or use Time Machine? I am not sure about the second.
|
|
|
|
E.Sam (OP)
|
|
August 02, 2013, 06:58:20 PM |
|
There is a chance the malware just took advantage of your wallet unlocking to push a TX, and not steal your private keys along. I would keep the wallet just in case, since you might receive payments on one of his addresses, but start a fresh one anyway, too.
That might be it since the all wallet was emptied as soon as I entered my passphrase. I don't think I will receive any more payments, will empty the remaining 0.0095 BTC and delete the all thing. I m not using Time Machine, but I will keep this terminal offline until I m sure the threat is taken care of. Just got an answer from Github: Hi Eric,
If the project in question doesn't behave as expected, I'd suggest opening an issue and discussing it with the maintainer.
Cheers, Steven! I m not sure if I should laugh or cry at this point.....
|
|
|
|
DannyHamilton
Legendary
Offline
Activity: 3388
Merit: 4653
|
|
August 02, 2013, 07:32:03 PM |
|
Just got an answer from Github: Hi Eric,
If the project in question doesn't behave as expected, I'd suggest opening an issue and discussing it with the maintainer.
Cheers, Steven! I m not sure if I should laugh or cry at this point..... I gave it a try as well. Here's what I sent them: After testing the executable binaries distributed through github in the following location: https://github.com/trevory/bitvanityIt has been determined that these executable binaries are falsely advertised as providing a specific purpose, while in reality being intentionally designed to maliciously steal account information and destroy contents on the user's computer. Multiple users have reported having valuable content stolen from their computer by this software. This would appear to be in direct violation of the github Terms Of Service. Specifically: A.8. You may not use the Service for any illegal or unauthorized purpose. You must not, in the use of the Service, violate any laws in your jurisdiction (including but not limited to copyright or trademark laws). G.7. We may, but have no obligation to, remove Content and Accounts containing Content that we determine in our sole discretion are unlawful, offensive, threatening, libelous, defamatory, pornographic, obscene or otherwise objectionable or violates any party's intellectual property or these Terms of Service. and G.11. You must not transmit any worms or viruses or any code of a destructive nature. As such I expect you to immediately terminate the user's access to GitHub and remove their hosted content before any other users are unknowingly duped into installing this illegal malware. I'll update with whatever feedback I receive.
|
|
|
|
E.Sam (OP)
|
|
August 03, 2013, 01:06:00 AM |
|
I gave it a try as well. Here's what I sent them: After testing the executable binaries distributed through github in the following location: https://github.com/trevory/bitvanityIt has been determined that these executable binaries are falsely advertised as providing a specific purpose, while in reality being intentionally designed to maliciously steal account information and destroy contents on the user's computer. Multiple users have reported having valuable content stolen from their computer by this software. This would appear to be in direct violation of the github Terms Of Service. Specifically: A.8. You may not use the Service for any illegal or unauthorized purpose. You must not, in the use of the Service, violate any laws in your jurisdiction (including but not limited to copyright or trademark laws). G.7. We may, but have no obligation to, remove Content and Accounts containing Content that we determine in our sole discretion are unlawful, offensive, threatening, libelous, defamatory, pornographic, obscene or otherwise objectionable or violates any party's intellectual property or these Terms of Service. and G.11. You must not transmit any worms or viruses or any code of a destructive nature. As such I expect you to immediately terminate the user's access to GitHub and remove their hosted content before any other users are unknowingly duped into installing this illegal malware. I'll update with whatever feedback I receive. Very nicely handled - Thanks for getting involved. It looks like Github took down the app: This repository has been disabled. Access to this repository has been disabled by GitHub staff due to excessive use of resources. Contact support to restore access to this repository. Read here to learn more about decreasing the size of your repository.
I suppose stating the truth would have been bad publicity.
|
|
|
|
DannyHamilton
Legendary
Offline
Activity: 3388
Merit: 4653
|
|
August 03, 2013, 02:17:56 AM |
|
It looks like Github took down the app:
Glad to hear it. Thanks for the update.
|
|
|
|
|
|
E.Sam (OP)
|
|
August 03, 2013, 03:36:28 AM |
|
I would seems strange that 2 of us got all our BTCs stolen in a similar fashion while using Bitvanity. This said, I m scouting around the web trying to find similar cases and see it they were using bitvanity. Would be great if someone knowledgeable could have a look at the code.
|
|
|
|
tabbek
Member
Offline
Activity: 116
Merit: 10
|
|
August 03, 2013, 04:24:45 AM |
|
Oh, dont interpret my post as some form of 'pro-bitvanity'. just reports of the issue are enough to make me avoid it like the plague.
That being said, I think vanitygen is a different author, different program. I dont keep any btc on the machine I use to generate vanity addresses, but I do have a wallet on it, and havent had any issues.
as always, always a good idea to review something yourself (like source) to evaluate the risks.
|
|
|
|
ajk
Donator
Sr. Member
Offline
Activity: 447
Merit: 250
|
|
August 03, 2013, 04:24:51 AM |
|
Just read through this entire thread, Extremely sorry to hear about your loss
is this only for Mac computers? I have a linux machine with vanity gen on it and this machine has not all but a fair amount of coins on it, is this only bad if your a Mac user?
|
|
|
|
vlees
|
|
August 03, 2013, 10:03:40 AM |
|
Just read through this entire thread, Extremely sorry to hear about your loss
is this only for Mac computers? I have a linux machine with vanity gen on it and this machine has not all but a fair amount of coins on it, is this only bad if your a Mac user?
This is about the tool "BitVanity" which exists for Mac OS X only. VanityGen (many platforms) is completely safe as far as I know. If you want to be sure, download the source code, review it and compile the tool yourself (VERY IMPORTANT; don't code review and then use the precompiled version).
|
BEEP BEP
|
|
|
Kouye
Sr. Member
Offline
Activity: 336
Merit: 250
Cuddling, censored, unicorn-shaped troll.
|
|
August 03, 2013, 11:34:44 AM Last edit: August 03, 2013, 12:32:13 PM by Kouye |
|
The source code on https://github.com/trevory/bitvanity was a perfectly legit vanity generator. The pre-compiled one included a malware. Edit: The source code version is clean and has nothing scary. I was hoping to find something in the compiled binary and found this, so it's very clearly malware: /Users/satoshinakamoto/Desktop/BitVanity Hacked/BitVanity/main.m/
Edit : Removed a quote which I didn't notice was completely irrelevant to this thread. Thanks for pointing this out, Remember remember the 5th of November
|
[OVER] RIDDLES 2nd edition --- this was claimed. Look out for 3rd edition! I won't ever ask for a loan nor offer any escrow service. If I do, please consider my account as hacked.
|
|
|
Remember remember the 5th of November
Legendary
Offline
Activity: 1862
Merit: 1011
Reverse engineer from time to time
|
|
August 03, 2013, 12:22:10 PM |
|
The code was a perfectly legit vanity generator. The pre-compiled one included a malware. Edit: The source code version is clean and has nothing scary. I was hoping to find something in the compiled binary and found this, so it's very clearly malware: /Users/satoshinakamoto/Desktop/BitVanity Hacked/BitVanity/main.m/
VanityGen != BitGen. Please quote properly next time to avoid any confusion.
|
BTC:1AiCRMxgf1ptVQwx6hDuKMu4f7F27QmJC2
|
|
|
E.Sam (OP)
|
|
August 03, 2013, 12:41:29 PM |
|
The code was a perfectly legit vanity generator. The pre-compiled one included a malware. Edit: The source code version is clean and has nothing scary. I was hoping to find something in the compiled binary and found this, so it's very clearly malware: /Users/satoshinakamoto/Desktop/BitVanity Hacked/BitVanity/main.m/
VanityGen != BitGen. Please quote properly next time to avoid any confusion. Sorry, that was my mistake - I have just edited the TS.
|
|
|
|
ajk
Donator
Sr. Member
Offline
Activity: 447
Merit: 250
|
|
August 03, 2013, 04:44:10 PM |
|
thank you vlees and others for clarification,
I am still extremely sorry to hear about the loss, I think that in order to prevent the situation from happening next time it would be best to use Linux based operating systems as to my knowledge there are far few workable viruses for it since it is a OS that not many use,
if you got a BTC address ill send over a donation to you if youll accept it, again sorry to hear about this, blackhat hackers really are some pieces of shit
|
|
|
|
Kouye
Sr. Member
Offline
Activity: 336
Merit: 250
Cuddling, censored, unicorn-shaped troll.
|
|
August 03, 2013, 06:41:42 PM |
|
I am still extremely sorry to hear about the loss, I think that in order to prevent the situation from happening next time it would be best to use Linux based operating systems as to my knowledge there are far few workable viruses for it since it is a OS that not many use,
Unfortunately, this is not a virus in the common accepted sense. It's a malware designed to steal from you, that most likely won't be detected by any standard anti-virus, and that is likely to succeed on linux as well - even though the global security (requiring root access) might help lower the risk. As Vlees said, the safest way, when using those kind of software, is to have the code reviewed by someone - I'm sure lots of people around would be glad to help, and then to compile those sources yourself. Basic compiling is not that tricky, really, especially using linux.
|
[OVER] RIDDLES 2nd edition --- this was claimed. Look out for 3rd edition! I won't ever ask for a loan nor offer any escrow service. If I do, please consider my account as hacked.
|
|
|
E.Sam (OP)
|
|
August 05, 2013, 01:46:59 PM |
|
I am still extremely sorry to hear about the loss, I think that in order to prevent the situation from happening next time it would be best to use Linux based operating systems as to my knowledge there are far few workable viruses for it since it is a OS that not many use,
Unfortunately, this is not a virus in the common accepted sense. It's a malware designed to steal from you, that most likely won't be detected by any standard anti-virus, and that is likely to succeed on linux as well - even though the global security (requiring root access) might help lower the risk. As Vlees said, the safest way, when using those kind of software, is to have the code reviewed by someone - I'm sure lots of people around would be glad to help, and then to compile those sources yourself. Basic compiling is not that tricky, really, especially using linux. I can confirm this. Running Mac Sophos anti-virus didn't raise any red flags. if you got a BTC address ill send over a donation to you if youll accept it, again sorry to hear about this, blackhat hackers really are some pieces of shit
That's very altruist of you ajk, thanks. I accept responsibility for downloading/using an app from an untrusted source, and therefore bear the blame... So it's really nice of you to think I deserve some help to get back on my feet! 1dxkU8qjpZvFBL1uz2EhgaCMbgFTEMbWR
|
|
|
|
E.Sam (OP)
|
|
August 15, 2013, 10:56:58 AM |
|
From Github Hi Eric,
We've taken action against the repository. Thanks for reporting this. Let us know if you find any other projects we should be aware of.
Thanks,
-Austin
|
|
|
|
Rampion
Legendary
Offline
Activity: 1148
Merit: 1018
|
|
August 22, 2013, 03:48:18 PM |
|
Did Bitvanity ask you to enter your administrator password?
|
|
|
|
|
Malexo
Newbie
Offline
Activity: 56
Merit: 0
|
|
February 03, 2014, 04:27:03 AM |
|
this should probably be moved or reposted inthe scam accusations forum? mightget more aid there. **** my space bar is tripping balls.
|
|
|
|
E.Sam (OP)
|
|
February 03, 2014, 05:08:54 AM |
|
Yes you're right, I was actually thinking of mentioning this. When I started this thread, I wasn't sure if this was due to a malware or not. I guess it is quite clear now.
|
|
|
|
|
fishy
Sr. Member
Offline
Activity: 476
Merit: 250
What do you call a fish with no eyes? A Fsh!
|
|
February 05, 2014, 03:06:06 AM |
|
Sorry to hear that. I experienced the same thing using the Mac OS app of Electrum.
Was your electrum compromised or were you running bitvanity? @E.Sam Sorry about your loss, if you contact bitstamp do you think you will be able to recover your BTC?
|
|
|
|
E.Sam (OP)
|
|
February 05, 2014, 03:16:11 AM |
|
Sorry to hear that. I experienced the same thing using the Mac OS app of Electrum.
Was your electrum compromised or were you running bitvanity? @E.Sam Sorry about your loss, if you contact bitstamp do you think you will be able to recover your BTC? Bitstamp wouldn't give client's information without a court order. Since they are based in EU, theoretically that shouldn't be too difficult. I would still have to prove a correlation, and since the stolen funds transferred via another address, that could be tricky. Anyway, I came to term with my loss, just trying to prevent others from falling for it. Edit: I was running bitvanity in the background (was not using the generated vanity addresses from it. As for Electrum, it was not even installed)
|
|
|
|
SgtMoth
|
|
February 05, 2014, 03:34:15 AM |
|
srry to about your loss too. i got hacked on the 30th. i clicked on a news story in my email, it took me to a site to watch a video, window popped up telling me to update flash, downloaded a trojan and began to get fkd...they went into my bitminter account and took 374 namecoins...but before i noticed that was gone, the bastard kept popping a window up telling me to update my wallet password, it expired, i had 10 btc in it. ran a scan found the trojan, went around changed every password, good thing, that night they tried to get into all my accounts, sold my btc, lesson learned, i do only my account stuff on one computer now, no surfing.
|
|
|
|
Sonny
|
|
February 07, 2014, 04:03:41 PM |
|
Sorry to hear your loss
|
|
|
|
E.Sam (OP)
|
|
February 07, 2014, 04:18:08 PM |
|
Sorry to hear your loss Thanks, from now on if I have an offline wallet on 2 raspberry pi (with a few satoshi). Learn and live I would really appreciate if any one around has some coding knowledge in OSX to have a look into the (presumed) hacker's new app - Stealthbit (mentioned in previous post - https://github.com/thomasrevor/StealthBit). I have been in contact with reedit mods, and this is what they said: I didn't see any hard-coded bitcoin addresses when I looked through. But, I didn't exactly understand how the code worked either. If you're typing in a private key, it may be transmitting that key to another server that runs code to quickly move funds to a hard coded wallet. So, I can't say we need to take it down, but I say we leave it for others more experienced to test out. I have also been in contact with Github, but they are always reluctant in taking down an app that is not proven to be a malware. and they din't seem to have the resources (or incentive) to look into it. Github: Thanks for reaching out to us again. Can you describe the malicious activity of StealthBit? My answer: I m not a specialist unfortunately (...) The only thing I m quite positive of, is that ThomasRevor and Trevory are the same person. There are too few coders writing bitcoin OSX applications for this to be a coincidence. Maybe cross check their IP address? although it would seem very amateurish for him no to use VPN or Thor. Anyway, I posted my concerns as an issue for stealthbit. I have been trying to get in contact with him for 4 days, have been posting warnings in his threads, but no answers up to now. Which is a bit concerning. Can't some of your team have a look into the code? Anyone here good/care enough to have a look?
|
|
|
|
E.Sam (OP)
|
|
February 09, 2014, 04:00:12 PM |
|
|
|
|
|
2double0
Legendary
Offline
Activity: 2618
Merit: 1105
|
|
February 09, 2014, 04:12:52 PM |
|
Yes, looks like it was. There should have been more coverage on the software when it was released.
|
|
|
|
Rampion
Legendary
Offline
Activity: 1148
Merit: 1018
|
|
February 10, 2014, 11:09:42 AM |
|
Good job OP by warning people about this malware.
Making malware for OSX has to be a very profitable niche: virtually no use of AV software among OSX users, and anyhow I don't think that such targeted malware would trigger any alarm.
|
|
|
|
|
|