PC hacked, QT robbed, MtGox account hacked on the same time- how?

[grabber]

Here is the story - you might able to help.

A friend of mine today he realised there's some strange things happens on his PC. Webcam starts, emails opens etc. Than he shutted down all the apps and later on some even more stranger things happened - Bitcoin QT asked for a new password. Like a normal user he changed his password - it seemed like the wallet itself asked for it - gave the old one and set up a new pass. (that was a huge mistake)

Later on, he received an email from MtGox that they are started to process his withdrawal - he doesnt even started one. The password was not stored on the pc, but there were a 2FA so we have no idea how they logged in. (we were thinking about with the RTBTC api code, but it seems like it wasnt able to do withdrawals) He also has 2 withdrawals from the mtgox account, we wrote to the support for the confirmation emails that he did NOT requested any payouts, hopefully it will be stopped by MtGox (almost 10 BTC) -

As he changed the password of the QT, it seemed like they simply recorded his password, and you can see here the transaction( https://blockchain.info/address/1CpiFiAtwr2TcF6X7TTRVzNUbkqnbVwKxJ ) 3.95 BTC is missing.

Now we took the PC offline and try to find out how was it made. It was a trojan for sure, but the exact method was something that we havent seen before. The owner is not an IT guy, but quite far from the noobs. So if you have any idea, any knowledge on that we'd be really happy if you share with us, it was quite an expensive experience on crypto currencies for him.

But the main question is still on: How to login to mtgox if you have the pass and dont have the device for 2FA. How login into a PC without any sign? (no known remote desktop apps were used) - The last part is quite easy, to dump a private key for a wallet if you know the key.

Any help appreciated! Of yourse, he stll has 2 unconfirmed withfrawals from Mtgox. If they dont aprove it, it will kind of save the day. (plenty tickets and emails submitted) Still dont know how it can happen, antivirus software firewall etc was on a well configured pc.

UPDATE 1: MTgox replied that they see a usual login and withdraw, o they dont do anything we should call the police. WTF? They send an email in case of withsrawals if that wasnt you... WE TOLD THEM IT WASN US! So they have to cancel the transaction. It still seems on Blockchain that the transaction wasnt started yet

[suryokecu]

It is very bad.... Almost 10 BTC ??

I am not an IT guy, so I can't help anything. Just feel sorry to hear this sad news. I do really hope MtGox could cancel those withdrawal.

[Foxpup]

How login into a PC without any sign?

Without any sign?

A friend of mine today he realised there's some strange things happens on his PC. Webcam starts, emails opens etc.

The webcam is a dead giveaway. The only reason your webcam will start is if a person want to record video of you. If that person is someone other than yourself, you should start freaking out at this point. The correct response is to pull the network cable, nuke the hard drive, and restore everything from backups.

(no known remote desktop apps were used)

Remote desktop apps generally work better (for the person using them) when you don't know they're there.

[empoweoqwj]

Cripes- that's a total PC takeover. Kind of scary how sophisticated malware is getting. Glad I don't run Windows

[bitgeek]

Sorry to hear that. Check for unknown processes running in the background, your virus software should've prompted when a process tried to establish a connection.

[empoweoqwj]

Sorry to hear that. Check for unknown processes running in the background, your virus software should've prompted when a process tried to establish a connection.

Once Windows has been taken over to that extent, you need to start again, right from the beginning, wipe the drive, clean install.

[Kluge]

Breaking 2FA is difficult to determine the cause of, and it's pretty rare. Is the phone rooted (assuming you use a phone)? What protects it from unauthorized access? Was it connected to the PC in the past few weeks? Is the phone connected on the same WiFi network as the PC? Is the WiFi connection protected with a strong password?

How long ago did he see the QR code or key for the Gox 2FA? Did he save it anywhere?

ETA: Oh - now that I think about it... Doesn't Gox use Yubikeys exclusively?

[EasyD]

This is why it is important to have a dedicated secure PC for your wallet. I personally keep the PC with my wallet offline and do not browse the internet with it, its too risky.

When I do go online with it, it is a hard wired connection, never wi-fi. Sounds like paranoia but it will safeguard you.

[empoweoqwj]

Breaking 2FA is difficult to determine the cause of, and it's pretty rare. Is the phone rooted (assuming you use a phone)? What protects it from unauthorized access? Was it connected to the PC in the past few weeks? Is the phone connected on the same WiFi network as the PC? Is the WiFi connection protected with a strong password?

How long ago did he see the QR code or key for the Gox 2FA? Did he save it anywhere?

ETA: Oh - now that I think about it... Doesn't Gox use Yubikeys exclusively?

Gox had 2FA last time I used Gox - which was when I got all my BTC out in December

[empoweoqwj]

This is why it is important to have a dedicated secure PC for your wallet. I personally keep the PC with my wallet offline and do not browse the internet with it, its too risky.

When I do go online with it, it is a hard wired connection, never wi-fi. Sounds like paranoia but it will safeguard you.

I personally prefer never to use a PC, if by PC you mean Windows. 100x more malware / trojans on Windows systems than Linux, or even OSX for that matter.

[Kluge]

Breaking 2FA is difficult to determine the cause of, and it's pretty rare. Is the phone rooted (assuming you use a phone)? What protects it from unauthorized access? Was it connected to the PC in the past few weeks? Is the phone connected on the same WiFi network as the PC? Is the WiFi connection protected with a strong password?

How long ago did he see the QR code or key for the Gox 2FA? Did he save it anywhere?

ETA: Oh - now that I think about it... Doesn't Gox use Yubikeys exclusively?

Gox had 2FA last time I used Gox - which was when I got all my BTC out in December

Yubikeys are for 2FA, but a service generally only permits Yubikeys or OAuth (or short SMS codes, but those are a joke anymore). Compared to a phone, a Yubikey is much more secure in most cases, but I don't know for sure if Gox only does Yubikeys or both Yubikeys and OAuth. If only Yubikeys, this's something I've never heard of.

[empoweoqwj]

Breaking 2FA is difficult to determine the cause of, and it's pretty rare. Is the phone rooted (assuming you use a phone)? What protects it from unauthorized access? Was it connected to the PC in the past few weeks? Is the phone connected on the same WiFi network as the PC? Is the WiFi connection protected with a strong password?

How long ago did he see the QR code or key for the Gox 2FA? Did he save it anywhere?

ETA: Oh - now that I think about it... Doesn't Gox use Yubikeys exclusively?

Gox had 2FA last time I used Gox - which was when I got all my BTC out in December

Yubikeys are for 2FA, but a service generally only permits Yubikeys or OAuth (or short SMS codes, but those are a joke anymore). Compared to a phone, a Yubikey is much more secure in most cases, but I don't know for sure if Gox only does Yubikeys or both Yubikeys and OAuth. If only Yubikeys, this's something I've never heard of.

Gox does 2FA via OAuth as well as YubiKeys

[escrow.ms]

I am not sure about mtgox 's security but 2factor authentication can be bypassed via session hijacking.

Ps: withdrawal can be done via api too probably or It's also possible that OP's friend left his pc open (while being  logged in on mtgox ) for some time and hacker took advantage of it.

[escrow.ms]

Not so long ago 2factor authentication was bypassed by by same session hijacking  aka cookie stealing attack. http://iandunn.name/security-reward-for-new-google-authenticator-plugin/

[EasyD]

This is why it is important to have a dedicated secure PC for your wallet. I personally keep the PC with my wallet offline and do not browse the internet with it, its too risky.

When I do go online with it, it is a hard wired connection, never wi-fi. Sounds like paranoia but it will safeguard you.

I personally prefer never to use a PC, if by PC you mean Windows. 100x more malware / trojans on Windows systems than Linux, or even OSX for that matter.

Very good point.

[empoweoqwj]

I am not sure about mtgox 's security but 2factor authentication can be bypassed via session hijacking.

Ps: withdrawal can be done via api too probably or It's also possible that OP's friend left his pc open (while being  logged in on mtgox ) for some time and hacker took advantage of it.

Yep. Good point. Always log out of accounts after using them. Personally I run sites I know and trust in one browser (chrome) and anything "new" in Safari. Not sure if it helps against attacks but I feel safer

[vm_mpn]

Almost seems like some sort of RDP or VNC type remote access...Could you ask Mt.Gox support if they can trace IP address matching that particular withdrawal transaction? I just wonder if IP address will match public IP of your friend's router or it's an external IP.

[empoweoqwj]

Almost seems like some sort of RDP or VNC type remote access...Could you ask Mt.Gox support if they can trace IP address matching that particular withdrawal transaction? I just wonder if IP address will match public IP of your friend's router or it's an external IP.

You've obviously not tried Gox support recently ... they don't even spend time doing normal stuff they should do, like processing withdrawals.

[Sonny]

Almost seems like some sort of RDP or VNC type remote access...Could you ask Mt.Gox support if they can trace IP address matching that particular withdrawal transaction? I just wonder if IP address will match public IP of your friend's router or it's an external IP.

You've obviously not tried Gox support recently ... they don't even spend time doing normal stuff they should do, like processing withdrawals.

USD withdrawal delays are considered normal in mtgox lol 

[Mivexil]

This is why it is important to have a dedicated secure PC for your wallet. I personally keep the PC with my wallet offline and do not browse the internet with it, its too risky.

When I do go online with it, it is a hard wired connection, never wi-fi. Sounds like paranoia but it will safeguard you.

I personally prefer never to use a PC, if by PC you mean Windows. 100x more malware / trojans on Windows systems than Linux, or even OSX for that matter.

Very good point.

Standard issue malware won't steal your bitcoins, and a targeted attack (which seems to be the case here) is just as likely to happen on Windows as it is on Linux.

Besides, nothing can save someone who willingly runs malicious software on his computer, Linux, OSX, Windows or whatnot.

[empoweoqwj]

This is why it is important to have a dedicated secure PC for your wallet. I personally keep the PC with my wallet offline and do not browse the internet with it, its too risky.

When I do go online with it, it is a hard wired connection, never wi-fi. Sounds like paranoia but it will safeguard you.

I personally prefer never to use a PC, if by PC you mean Windows. 100x more malware / trojans on Windows systems than Linux, or even OSX for that matter.

Very good point.

Standard issue malware won't steal your bitcoins, and a targeted attack (which seems to be the case here) is just as likely to happen on Windows as it is on Linux.

Besides, nothing can save someone who willingly runs malicious software on his computer, Linux, OSX, Windows or whatnot.

You saying there isn't more malware / viruses / keyloggers on an average Windows machine than an average OXS or Linux machine? Joking right???

[frankenmint]

I remembered hearing a really great presentation where the person, I forgot his name but he was very knowledgeable about IT security said that 2fa is useless if you have an infected PC - Man in the Middle attack will login with your 2fa and initiate a withdrawal in the same execution timeframe with the same 2fa key - I think that laymans explanation of what he had stated.  It was basically that, if you're using a malware device on either end, the MITM attack would exploit your key like an elaborate phishing attempt of sorts.

Your QT was emptied because of of the new password request.  which was obviously a spoof - it could have been tied to the other mitm attack that caused the mt gox withdrawals - if someone else has the correct or a better explanation, I am all ears.

[Ploo]

I remembered hearing a really great presentation where the person, I forgot his name but he was very knowledgeable about IT security said that 2fa is useless if you have an infected PC - Man in the Middle attack will login with your 2fa and initiate a withdrawal in the same execution timeframe with the same 2fa key - I think that laymans explanation of what he had stated.  It was basically that, if you're using a malware device on either end, the MITM attack would exploit your key like an elaborate phishing attempt of sorts.

Your QT was emptied because of of the new password request.  which was obviously a spoof - it could have been tied to the other mitm attack that caused the mt gox withdrawals - if someone else has the correct or a better explanation, I am all ears.

2FA is useless if your computer is compromised, that is if all the 2FA does is provide an ephemeral auth token to 'authorise' an action. Since there's no way to know what it is that you are in fact authenticating - it could be the withdrawal that you're seeing on the screen, or it could be that the attacker is manipulating web page content and doing something else with the token you provide.

For 2FA to be secure (assuming the 2FA device is secure), it needs to sign some data that'll only authorize the very specific withdrawal that you wish to make, so:
- destination address
for convenience this could be just the first 10 characters for example, just enough so that it is inpractical to brute force it in a reasonable time frame using vanitygen
- number of coins
in case the attacker is able to both infect your machine AND socially engineer a scenario in which you willingly send money to an address he controls, except he'll adjust the number of coins once the victim authorises the tx and destination address.

[HellDiverUK]

100x more malware / trojans on Windows systems than Linux, or even OSX for that matter.

Only if you're a moron and go browsing on dodgy sites with shitty or outdated antivirus, or a moron and using IE.


Personally I have a 'working' wallet on my PC, and my 'cold storage' wallet is on a Windows 7 install in a VM, which has it's virtual drive on an external hard-drive.  No way in hell that's ever being accessed unless I'm there to plug it in, fire it up, sync the wallet and shut it down again.

[Ins]

Your friend didnt turn off his computer when webcam starts, or disconnect it from internet, because you said "Bitcoin QT asked for a new password".
Trojan just open new dialog where it asking for password. But no password changed, or changed, but sent to hacker.
Or key-logged, because webcam start's as you said