Bitcoin trojan caught in the wild

http://www.symantec.com/connect/blogs/all-your-bitcoins-are-ours

by mike_esspe • 15 years ago

94 64 15 years ago

codex• 15 years ago

Ah, Bitcoin: the new incentive to breach computer security. Why risk stealing credit card or bank information when you can steal Bitcoins safely and anonymously?

weavejester3• 15 years ago

On the other hand, it's also a powerful incentive to improve computer security.

rick888• 15 years ago

No matter how much you improve it, there will be a never ending supply of end users that won't install the proper updates.

Groxx• 15 years ago

>it has one motive: to locate your Bitcoin wallet.dat file and email it to the attacker.

Craziness. They could just send the coins to a Bitcoin address, and it wouldn't identify them at all.

kinghajj• 15 years ago

Sending bitcoins is a more involved process than simply copying the wallet.dat file, though. If the author is smart, the email cannot be tied to him anyways.

illumin8• 15 years ago

Stealing your wallet.dat is easier. With a copy of your private keys they can spend your coins from anywhere, without having to get remote access to your PC and send them locally.

olivercameron3• 15 years ago

This is exactly why Bitcoin will never take off outside of the geek world. Can you imagine, in a world where millions used Bitcoin, the media fallout if users were being robbed with zero way to reclaim their money?

Knowing how little "regular" people protect their devices, this scares me.

truthout• 15 years ago

Bitcoin would function as a backend and the payment would be done through processors like banks and credit card companies. What's the difference between bitcoin and dollars in that respect. The average person still has the ability to move coins trough the system but I'm sure processors will be regulated.

kmfrk• 15 years ago

You just described PayPal.

olivercameron3• 15 years ago

Not at all. PayPal could not be more different than Bitcoin (centralised, insured etc.).

Edit: I'm not defending PayPal, I'm saying Bitcoin and PayPal are two different systems.

shazow4• 15 years ago

Here's some ways to fix this and why it won't be a problem:

- Add encryption of the wallet and a password to the Bitcoin client and daemon. This is already being worked on and there is working prototype. It should be in the mainstream client very soon. Wallet Private Key Encryption: http://forum.bitcoin.org/index.php?topic=8728.0

- Start trusted centralized institutions that hold your Bitcoins and protect them (maybe even give you a bit of interest growth). There are already numerous online eWallets that you can use—if you choose to keep your cash on your person then it's your decision and you should acknowledge the risks. List of eWallets: https://en.bitcoin.it/wiki/Category:EWallets

gojomo4• 15 years ago

Wallet encryption isn't any help against keyloggers and other local malware that can observe your use of the wallet. And wallet encryption simple enough for average folks — a short passphrase of their own choosing - is easy for digital pickpockets to crack.

rmc3• 15 years ago

(maybe even give you a bit of interest growth)

You can't really do interest with BitCoins, since it's a fixed amount. Deflation is built in, so in way just holding the BTC will make them 'grow' in value.

creativeembassy• 15 years ago

Bitcoins are a digital currency without a bank. If you kept all your money in cash at your house, and failed to secure your house, then someone could steal it. Sure, you could try to catch them based on the evidence they leave behind (fingerprints for cash, logfiles for bitcoin wallets), but once they have the cash, it's nearly untraceable.

But if you have banks that store Bitcoins for you, then you're trusting their security processes, not your own. We don't have Bitcoin banks yet. For BC users, maybe that's worth looking into.

cookiecaper• 15 years ago

It actually would not necessarily be difficult to trace the thief of your bitcoins. All btc transactions are logged publicly; a victim can watch the blockchain and record every address that receives his stolen coins, and this may produce good leads as to the thief's identity.

ssharp• 15 years ago

I've read this real-life money / storing all your money at your house analogy a few times related to BitCoin. It seems disingenuous. There are just too many physical things that separate the dangers of BitCoin and hoarding money somewhere in your house.

- I don't have to worry about 6,500,000,000 people having access to my house. At most, there is a market of around a million or so who would live in close enough proximately to me.

- I don't have thousands of people across the world tapping on my windows to find out how easy they are to break into.

- I'd trust the chances of a local thief being caught more than a hacker across the globe stealing BitCoins being caught.

I could go on and on.

Right now, the BitCoin landscape is like the Wild West, probably even worse. Systems simply aren't in place to really protect people, and you have the potential to steal from anyone in the entire world.

In real currencies, we have systems in place to protect holders. In the U.S. we have the FDIC, which insures bank accounts up to a certain amount. This insurance incentives people to keep their money in banks instead of the house because it's safe (both physically safe from theft and safe from bank failure). My understanding is that there are BitCoin "banks" but there is nothing guaranteeing these deposits. There are also established systems in place to help prevent theft. Police departments, close physical proximity to others (neighbors being able to see odd activities), etc. to prevent thefts.

mike_esspe• 15 years ago

1) This is a problem. 2) It can be solved with the help of internet service. 3) It's easy to get started because you don't need a banking license.

My conclusion - we will see a lot of startups solving this problem.

nextparadigms• 15 years ago

The technology is still in its beta period basically. Really, all this should've been expected, especially since we're talking about a currency and money. It was an early adopter risk, and I think most decided the risk was ok, because they could earn 10x,100x or even 1000x more money than they put in.

The only mistake was to believe Bitcoin was 100% safe. The technology will mature.

gasull3• 15 years ago

A possible solution:

http://forum.bitcoin.org/index.php?topic=18141.0

tl;dr: Create a bitcoin address, backup wallet.dat, delete wallet.dat from your HD, and send your bitcoins to that address.

gojomo4• 15 years ago

Works until the malware scans the disk for keydata remnants from 'deleted' files (or even old swap pages).

And this guy was trying to implement this 'offline savings' strategy, but didn't completely understand the privacy lifecycle and transaction details — and thus last the keys to a $180K balance:

http://forum.bitcoin.org/index.php?topic=11104.0;all

Vanished in a poof of pure logic!

gasull3• 15 years ago

> Works until the malware scans the disk for keydata remnants from 'deleted' files

http://srm.sourceforge.net/

I don't use Windows but there's probably something similar for it.

maeon3• 15 years ago

I have an idea that may fix this broken model of Bitcoin. Make sure each penny has a "history" on it on a public server. You can't spend the money unless it is posted for everyone to see. Each transfer of money is documented, and the reason for the transfer and other data. And in order to spend it, you have to validate and review each transfer of money before it. If there is anyone stealing money, it is just a matter of looking at the history of each penny and then tracking down the unique id to the offender who spent the money they didn't earn.

A safe online currency can be done, but if you champion this, the United States government are going to find you, and squish you like the insignificant bug you are. You would be circumventing the primary income stream of the united states with a global standardized currency.

ghshephard• 15 years ago

Every bitcoin in existence has its history tracked back to it's origin on every single bitcoin node.

There is an optimization for some clients to to pare down that history, but, in general, when you start up a bitcoin node, you have the history of every bitcoin ever created and all of it's transactions that occurred after it.

This history, in fact, is how you can be confident that the bitcoin is authentic - unless you have greater than 50% of the computing power of the network, you can't substitute an alternative history which would result in the coin landing in your hands.

vegai• 15 years ago

That seems like a highly non-scalable solution.

27182818284• 15 years ago

The BTC clients should encrypt the wallet too.

ck2• 15 years ago

This is why we can't have nice things.

olalonde• 15 years ago

Uh? Aren't Bitcoin wallets encrypted?

gasull3• 15 years ago

They will be in the coming version.

haberman• 15 years ago

Don't worry, we've identified the thief! Put out an arrest warrant for: f7c956f566b11751c4d3f5ca077c0406

More seriously, it's interesting that the people who have been robbed from could observe in detail exactly where their stolen money is flowing to. So close, yet so far away.

conductr• 15 years ago

Any one else find the FTP password amusing?

andrewcooke• 15 years ago

what's with the random number generation at the start? how does rand() + 3*rand() improve on just rand()?

mootothemax• 15 years ago

There's a great series of answers to this on StackOverflow:

http://stackoverflow.com/questions/3956478/understanding-ran...

In short: doing things like this actually reduces the randomness of the end result.

BasDirks• 15 years ago

Problem with bitcoin: it's an eternal beta. Can't be solved either.

simias• 15 years ago

Mmh, the "underground code snippet" looks very fishy, unless I'm missing something:

  char * appdata = getenv("APPDATA");
  char * truepath = strcat(appdata, "\\Bitcoin\\wallet.dat");

Bitcoin trojan caught in the wild

Related Stories