Bitcoin Forum
September 15, 2019, 01:31:41 PM *
News: If you like a topic and you see an orange "bump" link, click it. More info.
 
   Home   Help Search Login Register More  
Pages: [1] 2 »  All
  Print  
Author Topic: LocalBitcoins vulnerability: 6 case of stolen funds confirmed as of now  (Read 232 times)
mjglqw
Hero Member
*****
Offline Offline

Activity: 1064
Merit: 823


https://coinsources.io/bitcoin


View Profile WWW
January 26, 2019, 01:16:46 PM
Last edit: January 26, 2019, 04:06:38 PM by mjglqw
Merited by romero121 (2), vapourminer (1), OmegaStarScream (1), o_e_l_e_o (1)
 #1

WARNING: DO NOT LOGIN TO LOCALBITCOINS
LocalBitcoins seems to be fine now.


Typing this on mobile right now. Just saw this on Reddit.

Thread:
Quote
When visiting the localbitcoins forum: https://localbitcoins.com/forums/

Users are prompted to log into their account, as if they have been logged out. This only seems to happen if you are already logged in. This is is a PHISHING SITE and 2FA codes are being used to empty customer accounts. Withdrawals have since been suspended by LocalBitcoins.

https://www.reddit.com/r/Bitcoin/comments/ajzym3/psa_localbitcoinscom_compromised_do_not_attempt/

For now we currently have little to no information about what happened/what's happening.



EDIT: Currently not confirmed, but the hackers wallet was said to be this address: 13WaahhsiGph4ysmQtjVhVTdgQUSL62KJr

7.95205862 BTC was sent to this address as of this moment.



EDIT #2: Still no announcement from LocalBitcoins as of now. Will be editing the title of this thread after the things clear up.

https://twitter.com/LocalBitcoins



EDIT #3 Finally an update from LocalBitcoins. Edited the topic title.

Quote
LocalBitcoins' report on the security vulnerability 26.01.2019

We would like to inform that today 26.01.2019 at approximately 10:00:00 UTC, LocalBitcoins has detected a security vulnerability - an unauthorised source was able to access and send transactions from a number of affected accounts. Outgoing transactions were temporarily disabled while we investigated the case.

We were able to identify the problem, which was related to a feature powered by a third party software, and stop the attack. At the moment, we are determining the correct number of users affected - so far six cases have been confirmed. For security reasons, the forum feature has been disabled until further notice.

Outgoing transactions have already been re-enabled and we have taken a number of measures to address this issue and secure the limited number of accounts that might have been at risk.

Your LocalBitcoins accounts are currently safe to log in and use - we encourage you to enable Two-factor authentication, if you have not yet.

We sincerely apologise for any inconvenience this might have caused.

Kind Regards, LocalBitcoins

https://www.reddit.com/r/localbitcoins/comments/ak1u8m/localbitcoins_report_on_the_security/

1568554301
Hero Member
*
Offline Offline

Posts: 1568554301

View Profile Personal Message (Offline)

Ignore
1568554301
Reply with quote  #2

1568554301
Report to moderator
1568554301
Hero Member
*
Offline Offline

Posts: 1568554301

View Profile Personal Message (Offline)

Ignore
1568554301
Reply with quote  #2

1568554301
Report to moderator
Advertised sites are not endorsed by the Bitcoin Forum. They may be unsafe, untrustworthy, or illegal in your jurisdiction. Advertise here.
1568554301
Hero Member
*
Offline Offline

Posts: 1568554301

View Profile Personal Message (Offline)

Ignore
1568554301
Reply with quote  #2

1568554301
Report to moderator
1568554301
Hero Member
*
Offline Offline

Posts: 1568554301

View Profile Personal Message (Offline)

Ignore
1568554301
Reply with quote  #2

1568554301
Report to moderator
1568554301
Hero Member
*
Offline Offline

Posts: 1568554301

View Profile Personal Message (Offline)

Ignore
1568554301
Reply with quote  #2

1568554301
Report to moderator
100bitcoin
Sr. Member
****
Offline Offline

Activity: 586
Merit: 270


View Profile
January 26, 2019, 01:27:01 PM
 #2

Reports of lots of coin loss are surfacing. No official update on their twitter as of yet - https://twitter.com/LocalBitcoins

HippiePyro
Full Member
***
Offline Offline

Activity: 434
Merit: 107

A non technical guy in a technical world


View Profile
January 26, 2019, 01:37:55 PM
 #3

Forum has been disabled. Here we go again.

HELIOS PROTOCOL ★ ✅[DAG]✅[BLOCKCHAIN]✅[PoS]✅[Masternodes] ✈✈✈[weekly Airdrop][join our discord to qualify]✈✈✈
 ▬▬  Mainnet Launched  |  Parallel Blockchain  ▬▬ 
 ▐▐▐▐▐▐▐▐ Website  |  Github  |  Bitcointalk  |  Bounties  |Discord  |  telegram▐▐▐▐▐▐▐▐
jademaxsuy
Member
**
Offline Offline

Activity: 532
Merit: 23

★777Coin.com★ Fun BTC Casino!


View Profile WWW
January 26, 2019, 01:46:45 PM
 #4

WARNING: DO NOT LOGIN TO LOCALBITCOINS

Typing this on mobile right now. Just saw this on Reddit.

Thread:
"When visiting the localbitcoins forum: https://localbitcoins.com/forums/

Users are prompted to log into their account, as if they have been logged out. This only seems to happen if you are already logged in. This is is a PHISHING SITE and 2FA codes are being used to empty customer accounts. Withdrawals have since been suspended by LocalBitcoins."

https://www.reddit.com/r/Bitcoin/comments/ajzym3/psa_localbitcoinscom_compromised_do_not_attempt/
another exchanges attack. Bitcoin may be vulnerable from.decrypting but its exchanges are not safe and it is vulnerable from hijacking or hacking it from someone. The problem now starts when a user has stored some of its crypto in the exchanges. Probably you will going to wake up one day losing all the crypto in the exchange wallet.

OmegaStarScream
Staff
Legendary
*
Offline Offline

Activity: 1778
Merit: 1446



View Profile
January 26, 2019, 01:49:22 PM
 #5

From the look of it, there have been few reports and the damage is not that big (or still not reported from the users yet). If that's the case and the team is as professional as they claim to be, they should reimburse the users. Just another reason on why you shouldn't keep your funds in exchanges by the way.

mjglqw
Hero Member
*****
Offline Offline

Activity: 1064
Merit: 823


https://coinsources.io/bitcoin


View Profile WWW
January 26, 2019, 01:54:33 PM
 #6

From the look of it, there have been few reports and the damage is not that big (or still not reported from the users yet). If that's the case and the team is as professional as they claim to be, they should reimburse the users. Just another reason on why you shouldn't keep your funds in exchanges by the way.

From the looks of it based on the discussions, it seems like the forum-side of LocalBitcoins was compromised and the hacker is using the login to phish the forum accounts, for the hacker to be able to withdraw the funds of the users. Hopefully it stopped here as the forum has been disabled. Not 100% sure though.

bellamente
Member
**
Offline Offline

Activity: 420
Merit: 10


View Profile WWW
January 26, 2019, 02:05:30 PM
 #7

How long will this go on? Another cryptocurrency exchange has been cracked. Phishing, one of the most experienced viruses. I hope the team of the LOCALBITCOINS project will do everything to ensure that the cryptocurrency remains with the owners

leninay
Jr. Member
*
Offline Offline

Activity: 78
Merit: 1


View Profile
January 26, 2019, 02:49:01 PM
 #8

How long will this go on? Another cryptocurrency exchange has been cracked. Phishing, one of the most experienced viruses. I hope the team of the LOCALBITCOINS project will do everything to ensure that the cryptocurrency remains with the owners

Not surprising, every year they hack the exchanges, just recently there was information about breaking into large crypto exchanges and selling verified user documents

https://www.ccn.com/hacked-customer-data-from-world-leading-cryptocurrency-exchanges-for-sale-on-the-dark-web/

How do you not understand that to keep money even in the bank is unsafe and especially on the exchanges

My advice to you is to keep your cryptocurrency in cold wallets on your computer and this will not protect you from hacking by 100%

In my opinion this is the safest place
mjglqw
Hero Member
*****
Offline Offline

Activity: 1064
Merit: 823


https://coinsources.io/bitcoin


View Profile WWW
January 26, 2019, 04:07:48 PM
 #9

How long will this go on? Another cryptocurrency exchange has been cracked. Phishing, one of the most experienced viruses. I hope the team of the LOCALBITCOINS project will do everything to ensure that the cryptocurrency remains with the owners
As long as exchanges are around, hacks will happen whether we like it or not.



Update: edited the topic to include the message from LocalBitcoins.

o_e_l_e_o
Hero Member
*****
Offline Offline

Activity: 686
Merit: 2698



View Profile
January 26, 2019, 04:25:25 PM
 #10

Looks like localbitcoins managed to shut this down pretty quickly after it started up actually, but the hackers still managed to make off with just shy of 8 BTC ($28,000) from 5 users (assuming that 1 address is the only address they used). Wonder if localbitcoins will compensate the users affected?

Once again, we have to wonder why users keep leaving large amount of funds on exchanges. Say it with me now: Not your keys, not your bitcoin. Not your keys, not your bitcoin. Not your keys, not your bitcoin. Not your keys, not your bitcoin.

romero121
Legendary
*
Offline Offline

Activity: 1568
Merit: 1019


World's Best Fully Featured Cryptocurrency Casino


View Profile
January 26, 2019, 04:58:51 PM
 #11

Localbitcoins.com was one among the best platform that has got its service around the world. Quite often bitcoin fraudulent activities happen through localbitcoins. This time the same has taken place in large scale as more and more hackers have focused over the cryptocurrency network. Two year back I lost through a hack that was completely because of not enabling two factor authentication.




.




  ▄▄▄▄▄▄▄▄▄▄▄▄▄
▄████████▀▀▀▀███▄
███████▀     ████
███████   ███████
█████        ████
███████   ███████
▀██████   ██████▀
  ▀▀▀▀▀   ▀▀▀▀▀

  ▄▄▄▄▄▄▄▄▄▄▄▄▄
▄██▀▀▀▀▀▀▀▀▀▀▀██▄
██    ▄▄▄▄▄ ▀  ██
██   █▀   ▀█   ██
██   █▄   ▄█   ██
██    ▀▀▀▀▀    ██
▀██▄▄▄▄▄▄▄▄▄▄▄██▀
  ▀▀▀▀▀▀▀▀▀▀▀▀▀

            ▄▄▄
█▄▄      ████████▄
 █████▄▄████████▌
▀██████████████▌
  █████████████
  ▀██████████▀
   ▄▄██████▀
    ▀▀▀▀▀

    ██  ██
  ███████████▄
    ██      ▀█
    ██▄▄▄▄▄▄█▀
    ██▀▀▀▀▀▀█▄
    ██      ▄█
  ███████████▀
    ██  ██




               ▄
       ▄  ▄█▄ ▀█▀      ▄
      ▀█▀  ▀   ▄  ▄█▄ ▀█▀
███▄▄▄        ▀█▀  ▀     ▄▄▄███       ▐█▄    ▄█▌   ▐█▌   █▄    ▐█▌   ████████   █████▄     ██    ▄█████▄▄   ▐█████▌
████████▄▄           ▄▄████████       ▐███▄▄███▌   ▐█▌   ███▄  ▐█▌      ██      █▌  ▀██    ██   ▄██▀   ▀▀   ▐█
███████████▄       ▄███████████       ▐█▌▀██▀▐█▌   ▐█▌   ██▀██▄▐█▌      ██      █▌   ▐█▌   ██   ██          ▐█████▌
 ████████████     ████████████        ▐█▌    ▐█▌   ▐█▌   ██  ▀███▌      ██      █▌  ▄██    ██   ▀██▄   ▄▄   ▐█
  ████████████   ████████████         ▐█▌    ▐█▌   ▐█▌   ██    ▀█▌      ██      █████▀     ██    ▀█████▀▀   ▐█████▌
   ▀███████████ ███████████▀
     ▀███████████████████▀
        ▀▀▀█████████▀▀▀
FIND OUT MORE AT MINTDICE.COM
goldexp83
Member
**
Offline Offline

Activity: 225
Merit: 10

quarkchain.io


View Profile
January 26, 2019, 04:59:55 PM
 #12

wow this is pretty scary, was it the first time happening???

I like localbitcoin and always thought its a pretty good site, not that fancy but usability is totally there

I hope more safe system will be in place to avoid this kind of scary hacks

mjglqw
Hero Member
*****
Offline Offline

Activity: 1064
Merit: 823


https://coinsources.io/bitcoin


View Profile WWW
January 26, 2019, 05:32:20 PM
 #13

Wonder if localbitcoins will compensate the users affected?
They should just compensate the stolen bitcoin in my opinion. While 8 BTC is definitely a lot for me, it's probably not that much for them when taking into account how much they're potentially earning. Compensating the stolen BTC would be a great PR move too.

wow this is pretty scary, was it the first time happening???

I like localbitcoin and always thought its a pretty good site, not that fancy but usability is totally there

I hope more safe system will be in place to avoid this kind of scary hacks
It's the first time for LocalBitcoins as far as I know. In the hackers point of view, getting past LocalBitcoins itself is probably difficult, hence the attacker went for the weaker link: the forum software. Correct me if I'm wrong, but the LocalBitcoins exchange itself and the LocalBitcoins forum has accounts that are connected; so the attacker took advantage of this. Quite smart really.

FedorIzmailov
Jr. Member
*
Offline Offline

Activity: 238
Merit: 1


View Profile
January 26, 2019, 06:00:56 PM
 #14

I once said that you need to store Bitcoin, namely, you knew about your cold wallets, but you used other exchanges.
o_e_l_e_o
Hero Member
*****
Offline Offline

Activity: 686
Merit: 2698



View Profile
January 26, 2019, 08:01:12 PM
 #15

Whats about our personal information are they are safe too or the attackers take it too ?
This was a man-in-the-middle type attack on individual users' accounts, stealing their 2FA keys via the forum to log in to their LBC accounts and transfer out their funds. There was no hack on the main LBC wallets or databases, so your personal information won't be affected. I would encourage everyone, however, to think twice before performing KYC with any service online. Just because your documents weren't accessed with this attack, doesn't mean they won't be accessed in the future.


They should just compensate the stolen bitcoin in my opinion.
According to this reddit post, one of the affected users has already had his lost balance reimbursed.

pixie85
Sr. Member
****
Offline Offline

Activity: 1022
Merit: 277


View Profile
January 26, 2019, 08:36:15 PM
 #16

I once said that you need to store Bitcoin, namely, you knew about your cold wallets, but you used other exchanges.

You can't expect everything to be stored in cold wallets. They stole a very small number of coins and as long as the loss is small it can be reimbursed and won't affect the business that much. If you have 1000 Bitcoin on your platform it's natural that up to 10% will be in hot wallets but some businesses like that Korean exchange that was hacked had all of their money in hot wallets.

kelz1
Copper Member
Jr. Member
*
Offline Offline

Activity: 140
Merit: 3


View Profile
January 26, 2019, 09:17:34 PM
 #17

These hackers are becoming very sophisticated, i wouldn't be surprised if it was the same team behind the electrum wallet hack as it follows the same pattern of phishing for login details. Bad day for bitcoiners as localbitcoins is a good website

DarkPayCoin - [100% community governed and built]
[-] Website  [-] ANN Thread  [-] Discord  [-] Twitter  [-] Telegram
\ HIGH ROI, Low supply / - \ A privacy focused MN/PoS coin /
squatter
Hero Member
*****
Offline Offline

Activity: 1218
Merit: 890


STOP SNITCHIN'


View Profile
January 27, 2019, 12:13:35 AM
 #18

Quote
We were able to identify the problem, which was related to a feature powered by a third party software, and stop the attack.

Are there any more details about this third party software and what the vulnerability was exactly?

I read a couple articles about the attack and I was led to believe this was a DNS spoofing attack on the forum subdomain. It sounds like that's not actually the case?

They should just compensate the stolen bitcoin in my opinion.
According to this reddit post, one of the affected users has already had his lost balance reimbursed.

Glad to hear it. If the losses were really limited to 8 BTC, they should just compensate the victims out of goodwill.

nc50lc
Hero Member
*****
Online Online

Activity: 714
Merit: 527


Self-proclaimed Genius ㊙️


View Profile WWW
January 27, 2019, 04:07:39 AM
Last edit: January 27, 2019, 11:04:25 AM by nc50lc
 #19

I once said that you need to store Bitcoin, namely, you knew about your cold wallets, but you used other exchanges.
Typical... you know that those bitcoins are in an Exchange because users want/need to trade right? (Apparently, obviously, surely, most of them got their "own" wallet)
You can't easily use a Cold wallet that was buried 20-feet under a random area guided with a "X" on a map to buy a HYPEd shitcoin before it get pumped.

If that's the case and the team is as professional as they claim to be, they should reimburse the users. Just another reason on why you shouldn't keep your funds in exchanges by the way.
I'm afraid that keeping most of the coins in a hot/cold wallet not possible for someone who's day trading. Personally, I prefer keeping higher exchange balance than in cold wallet since highly-priced orders yield higher profit.
Specially now that the price is on its (*typo edit) best buy, predictable low-liqudity and mostly everyone is expecting a rise.

Usually, it goes like this:
Source (ex.Mining)---→(HotWallet)--→EXCHANGE---(Mixer)---→Cold Wallet (Savings)
Other Sources-------⤴---------------⤴                 ↪-----→Hot Wallet  (Expenses)

Fortunately, legitimate exchanges today are heavily regulated and problems such as missing funds can be legally resolved.

          ███████
      ██   ▀███▀   ██
  ▄█▄  ▄▄█████████▄▄  ▄█▄
 ▄███▄██▀▀       ▀▀██▄███▄
 ██▀███    ▄▄█▄█    ███▀██
    ██      █▀▀██    ██
██  ██     █████▀    ██  ██
    ██   ▄▄█▄▄▄██    ██
 ██▄███    █▀█▀▀    ███▄██
 ▀███▀██▄▄       ▄▄██▀███▀
  ▀██  ▀▀█████████▀▀  ██▀
      ██   ▄███▄   ██
          ███████
bspin   ███████████████████████
███████████████████████████
███████████████████████████
███████▀█▀    ▀▀▀██▀███████
███████            ▄███████
███████ ▄██▄▄▄▄▄▀ ▄████████
███ ▀  ▀  ██▀▀   ▄▀  ▀  ███
███▄▄█▀  █▀     █▄▄█▀  ████
█████   █▀       ██   █████
████▄▄▄▄█▄▄▄▄▄▄▄▄█▄▄▄▄█████
███████████████████████████
███████████████████████████
  ███████████████████████
       ▄▄█████████▄▄
    ▄█████████████████▄
  ▄█████████████████████▄
 ▄█████████  █  █████████▄
▄████████        █████████▄
███████████  ██  ██████████
███████████       █████████
███████████  ███  █████████
▀████████        ▄████████▀
 ▀█████████  █  █████████▀
  ▀█████████████████████▀
    ▀█████████████████▀
       ▀▀█████████▀▀
..PLAY NOW..
mjglqw
Hero Member
*****
Offline Offline

Activity: 1064
Merit: 823


https://coinsources.io/bitcoin


View Profile WWW
January 27, 2019, 04:28:59 AM
 #20

Are there any more details about this third party software and what the vulnerability was exactly?

I read a couple articles about the attack and I was led to believe this was a DNS spoofing attack on the forum subdomain. It sounds like that's not actually the case?

I don't think they have given specific information about this matter as of now, but I don't think it's a DNS attack. But for what it looks like in my opinion, I'm personally leaning more on a javascript/XSS injection on the forum software. Probably omething like:

User visits forum --> script executes --> probably redirects the user to a phishing site(?)

Just my rough guess.

Pages: [1] 2 »  All
  Print  
 
Jump to:  

Sponsored by , a Bitcoin-accepting VPN.
Powered by MySQL Powered by PHP Powered by SMF 1.1.19 | SMF © 2006-2009, Simple Machines Valid XHTML 1.0! Valid CSS!