Possible CampBX Hack

[CaptainAK]

I am going to give them the benefit of the doubt, but I just logged in to CampBX.comr website and ALL of my funds were gone, cash and BTC. Almost $3500 worth. I am using 2FA and a less than week old random 14 character password, so my guess is that there is something wrong with their site or it got hacked last night. All of the transactions were done within a few minutes of each other, so I assume this was someone who had a bot and found a backdoor in their API, the only problem is, I do not have the API active on my account. Still doesn't explain how they could transfer out without either an email or using 2FA. Most likely a database bug and I will accept that, as long as they reverse the transactions. I will come back and post more once I get a response. I will give them 24hrs to fix this.

I guess we will all find out how CampBX responds to emergency situations.

[1713990722]

1713990722

[1713990722]

1713990722

[1713990722]

1713990722

[1713990722]

1713990722

[not.you]

Ouch!  Unfortunately I think I can predict your experience...no response for days.  I certainly hope I am wrong.  Their support system is a joke.  In addition to the support ticket that will probably be ignored you should PM the facebook account.  I have been monitoring the facebook page since my own issue (still unresolved) from over 3 weeks ago and you are far more likely to get a personalized response from the facebook account.  The support system seems to just give generic canned responses (after waiting many, many days).  But I also saw the facebook account advise someone to PM them about an issue they raised on the facebook page.  My own issue with missing BTC has not been resolved but I have at least gotten them to tell me some version of "we are swamped but we will get to it" by posting on the facebook page about it.

[epetroel]

Just checked my account and all my money is there, so maybe it's just you?

[CaptainAK]

It could very well be just me. DB corruption can occur anywhere at any time. It could have been a bad session cookie that someone else got and decided to make the most of. But even if was an attack through my account, they would still have needed my phone to get the 2FA code to enable BTC-SendTo.

The other possibility is that they used the API, which was not active on my account. Hypothetically, if they did it that way, that means that either they still had to bypass 2FA or 2FA is not in use for BTC-SendTo in the API, which makes the entire 2FA worthless. I mean, if they cannot login to website without 2FA, great, but if they can get around that by doing a man-in-the-middle to obtain a password and then use that password to perform a BTC-SendTo withdrawal, then 2FA on their site is meaningless. On the other hand if 2FA IS needed for the API, then either 2FA does not work on their site in it's entirety or the attacker has a different method of attack.

Either way I am still hoping this is just a db issue, if not, then I am very wary of continuing to use their system for fear of another breach.

[quone17]

Hi, I just checked my account and everything is still normal.  I assume there was an error of some kind.  What I will say though is that I have taken screenshots of my information on Campbx in case anything goes awry, because it's been so shady lately.

[MPOE-PR]

Thanks for the details OP. Please keep documenting this either way.

[CaptainAK]

Not much to update yet, but I did get a short message from Keyur asking what my username was and if 2FA was still active on the account. Answered him and that was about 4-5 hours ago. Still waiting to hear what they are going to do. Oh, but I DID verify that I do not have the API turned on, so that was not it. I am starting to lean more towards someone got it my session accidentally via some sort of redirection/cookie error and decided to make the most of it.

Only other option is that someone got my password (EXTREMELY UNLIKELY) and ALSO found a way to bypass 2FA.

Come on, Keyur....  Give me something to work with here.

[davout]

Two other possibilities :

• Your machine is compromised (you seem a bit quick to shrug this one off)
• Someone at Cloudflare decided to have some hookers & blow

[Jcw188]

Not much to update yet, but I did get a short message from Keyur asking what my username was and if 2FA was still active on the account. Answered him and that was about 4-5 hours ago. Still waiting to hear what they are going to do. Oh, but I DID verify that I do not have the API turned on, so that was not it. I am starting to lean more towards someone got it my session accidentally via some sort of redirection/cookie error and decided to make the most of it.

Only other option is that someone got my password (EXTREMELY UNLIKELY) and ALSO found a way to bypass 2FA.

Come on, Keyur....  Give me something to work with here.

THe odd thing is you say the stuff disappeared...when was the last you had logged on before it was gone?  I ask that because a lot of people are having issues withdrawing from there so it seems unlikely someone would be able to log in, or accidentally get in, and withdraw all your funds before you could see that it was "pending."

[CaptainAK]

The reason I shrugged off the possible compromise is because both machines are brand new installation that get automated AV, rootkit, and secondary spyware scans weekly. No extra programs get put on them (other than MS Office, which some would argue are viruses by themselves ), for just the reason of preventing a possible compromise. Both have firewalls locally and at a router/gateway level. And I am the only one with any sort of logon access to them. Yes I am quite "retentive" about anything regarding password security.

Can't give any response to the Cloudflare comment as I have yet to be invited to one of their parties 

All that aside, it has been definitely verified that I do not have api access, so that leaves web access. Assuming my machine was compromised, the order of things necessary to do what was done would be this:

1. Login to computer or use something like RAT to control system.
2. Open web browser and login to CampBX with the weekly, unique-to-that-site, 14 char alpha/num/special character password.
3. Get my phone and enter the 2FA code to finish login.
4. Cancel all pending orders/withdrawal/ACH transfers.
5. Convert all assets into BTC.
5. Transfer BTC to alternate address and verify it using 2FA again.

So unless I was sleep trading and sending my BTC to random address that were getting a lot of other BTC funneled into them, it is unlikely anyone could pull off this kind of withdrawal.

Even if I logged into my account, sold off everything, sat a hacker down at my computer, took them to the transfer screen, and told them to take my BTC, they still would not have been able to perform a BTC-SendTo without physical access to my phone which has my 2FA auth on it. And no, I sincerely doubt someone has cloned my phone, apps and all.

As for timing on login, my last login was roughly 10.5 hours before this happened, and the whole thing happened in a timeframe of about 12 minutes. The withdrawl was to another BTC address, so it was a fast situation. I did not logon again until late the next day to find the issue.

[not.you]

Maybe you have malware on the phone.  Is there any way someone who had full access to your phone could get the website login info?  Is the same email used to login to the website setup on the phone?

[davout]

brand new installation [...] scans weekly

Not to nitpick, but after a couple of weeks I wouldn't consider them "brand new" anymore :-)
Either way, good luck with all this.

[CaptainAK]

Agreed on the brand new install thing. They are approaching 3 weeks on one and almost 4 on the other, but oh well. Oh and phone went through factory reset in the past week after I got a new version of Android rolled out to me. Was just easier to install it and then do a factory rest and reinstall apps. Oh and  no on the phone password. Separate passwords for everything.

Will update thread as needed once I have more info.

Moved everything in other posts into this so I can everything in order....

Will be honest... less than concerned about 3.5 BTC... more concerned about continuing to use the service. All other things aside, if someone can bypass 2FA, that is bad....  I would be perfectly happy if they would just verify what IP the actual BTC-SendTo came from and if it had to enter a 2FA to finish the transaction.