Instawallet Hacked

http://notice.instawallet.org/

by LiveTheDream • 13 years ago

111 116 13 years ago

notice.instawallet.org

dcc1• 13 years ago

What made Instawallet better than Blockchain for an online wallet? why did people use it? what was the selling point??

acebarry2• 13 years ago

Burner bitcoin addresses. When you loaded the site you got a fresh wallet with one address. It would help people stay anonymous.

bdcravens• 13 years ago

Looks like the address isn't all that was burning...

GigabyteCoin8• 13 years ago

Who ever said that it was better?

No online wallets are secure, nobody should be using them, but unfortunately the bitcoin system is still a bit too complicated for a lot of people.

adrr• 13 years ago

This what i don't get. Banks can secure themselves, large e-commerce sites as well. Do any of these guys run Hardware security modules and use them to manage encryption of the keys?

acebarry2• 13 years ago

Instawallet always made it clear that no one should keep anything more than spare change there.

tlrobinson• 13 years ago

It's not that it's impossible to for online wallets to be secure, it's that most of the people implementing them are amateurs when it comes to security.

The Bitcoin industry needs bank level security. They're doing some things right (most exchanges offer 2FA), but they've got a long ways to go.

haakon• 13 years ago

When depositing to Instawallet, your money would be stored in a common pool, so upon withdrawal you'd get different coins back. So it functioned as a "mixing service", which helps improve anonymity for those who need that. And it was super easy to use, which made it popular with newbies with little understanding of how foolish it is to give a service like this full control over your money.

facorreia• 13 years ago

From the description, it sounds like a money laundering service.

MacsHeadroom2• 13 years ago

Blockchain.info does this for a small fee.

jerguismi2• 13 years ago

It wasn't better as in more secure, it was instant and easy. It was a low-security wallet designed for trying out bitcoin.

afreak• 13 years ago

https://bitcointalk.org/index.php?topic=83794.0

A good look at previous thefts. The last page contains links to the current Instawallet issue.

error54• 13 years ago

I know it's been said many times before, but we're only going to see a rise in bitcoin thefts. With the price being over $100/coin and you're stealing virtually untraceable currency, I'm honestly just surprised that there hasn't been more thefts. I'm sure the security team at Mt. Gox is top notch as they probably have dozens of hack attempts per day.

emgre• 13 years ago

Which is going to be a huge limit on sustained value/adoption, for better or worse. Bitcoin's rooted in the community most capable of stealing it.

nym2• 13 years ago

The bitcoin community spends a ton of time trying to educate people on cold-storage wallets and two-factor authentication for online wallets.

MtGox has even given away free YubiKeys in the past to help keep people's accounts secure. Does Chase or BofA anyone else offer that kind of security? :)

https://en.bitcoin.it/wiki/Cold_storage https://mtgox.com/press_release_20120215.html

yasth• 13 years ago

Eh that is nothing, just imagine when people who have no ability to steal it and thus no awareness of how it might be stolen get pulled in by the hype.

Not to mention the costs that security brings, a friend of mine is locked out of what is now $50k worth of bitcoins, just can't remember the password on the encrypted store.

GigabyteCoin8• 13 years ago

I for one believe the barrage of attacks and attempted thefts will inevitably make Bitcoin safer. Just like Google Chrome's pwning contests, eventually nobody will be capable of claiming the prize.

nym2• 13 years ago

Growing pains.

ebbv• 13 years ago

It's not really comparable to Pwn2Own. Pwn2Own's only vector of attack is by finding flaws in the software directly.

All of these wallet service companies employ people and many, many successful hacks are performed by exploiting the people involved / mistakes the people make.

So while software with enough hardening can eventually get to a state that's quite safe, as long as people are an active part of the security chain, you're going to have valid attack vectors.

jellicle2• 13 years ago

How are attacks on $yourbitcoinservice supposed to make $mynewbitcoinservice safer?

bluetooth2• 13 years ago

I expect nothing less from Instawallet. Previously, they used to keep private keys in the URL and allowed google to index these URLs. It took a lot of pestering and hand-holding to get this fixed. I should have figured this would have happened sooner or later, given their incompetency regarding security.

stcredzero6• 13 years ago

Dunning-Kruger is an order of magnitude stronger for security.

danielweber7• 13 years ago

If you are doing security for a Bitcoin site, your motto should be "I am an idiot and am forgetting something very basic." Then you should try to figure out how to protect yourself from your own idiocy despite being stupid.

And you should never assume you just got smart.

jonjohn84• 13 years ago

logo link on this notice page points to localhost:3000, looks like dev/prod mixup

X-Istence2• 13 years ago

Or reverse proxy not sending the right Host header.

lucb1e2• 13 years ago

They seem to be physically relocating (or at least a new server).

shocks• 13 years ago

How many more times do we need to go through this?

People: Only keep an amount you are willing to lose in an online wallet. Keep the rest offline and encrypted.

GigabyteCoin8• 13 years ago

If only "Keep the rest offline and encrypted." didn't sound like Charlie Brown's teacher speaking to 99% of the world...

danielweber7• 13 years ago

If you are using it as a currency, "offline and encrypted" is "unusable."

If you are using it as a commodity to trade, well, it's perfect.

bigiain• 13 years ago

Maybe. Perhaps it might be useful to compare online bitcoin storage with cash in your pocket. You wouldn't convert your entire nett worth to cash, stick it in your pocket (or for "added security", hide it in your sock!) then go out clubbing.

Unless you're about to buy a car or a house with bitcoin, there's no need to store tens or hundreds of thousands of dollars worth in an immediately useable (and hence potentially stealable) status.

GigabyteCoin8• 13 years ago

Given the fact that instawallet was rarely used in the previous few years, I doubt this will have much of an impact on the Bitcoin market: http://www.alexa.com/siteinfo/instawallet.org

itsprofitbaron2• 13 years ago

FWIW Alexa isn't accurate and can easily be gamed.

GigabyteCoin8• 13 years ago

I am aware, but at least it doesn't look like this: http://www.alexa.com/siteinfo/bitcoin.org

Faking a high alexa ranking may be possible, but faking a low alexa ranking is not.

You can't fake the fact that next to nobody went to instawallet.

MacsHeadroom2• 13 years ago

About 0.4% of all Bitcoins currently in existence are stored there. Hopefully most of them find their way back to their rightful owners.

jcoder2• 13 years ago

How would that happen?

lucb1e2• 13 years ago

> rarely used in the previous few years

Yeah it's only worth $1 800 000. Nothing to worry about.

Sources: https://blockchain.info/address/1LrPYjto3hsLzWJNstghuwdrQXB9... (btc amount) https://blockchain.info/stats (current price)

scottrblock• 13 years ago

Also troubling is their logo links to localhost:3000. Why would you hard link that in the first place?

joecurry• 13 years ago

>> If several claims have been filed for the same url, we will process those claims on a case by case basis, under the presumption that the claim we received first belongs to the legitimate balance holder.

Is this a joke? They can't be serious.

GigabyteCoin8• 13 years ago

And when all of their wallet URLs were indexed in Google, I am pretty sure they're saying that nobody is getting a refund here.

vshastry• 13 years ago

This type of incident is a key reason the US Treasury's Financial Crimes Enforcement Network ("FinCEN") issued sensible guidance requiring those who offer wallet (bitcoin transfers between persons and/or merchants) and currency conversion services to be regulated as money transmitters. While money transmitter regulation isn't perfect and is expensive for providers, it can provide some consumer protections in these scenarios.

Edit: Forgot to link to their guidance

http://fincen.gov/statutes_regs/guidance/html/FIN-2013-G001....

justplay• 13 years ago

shit

ChuckMcM• 13 years ago

This [https://news.ycombinator.com/item?id=5475389] conversation suggests that there might have been a very large withdrawal of funds just prior to the system shutdown.

It points out again how careful you have to be when suddenly there is "real money" on the line.

I've yet to see the "exit strategy" where an enterprising crook sets up an exchange and then loots it once its net value is high enough. But I would not be surprised to see that happen. It has happened in the brick and mortar world with banks, no reason it shouldn't be any different in the digital world.

gesman3• 13 years ago

So everyone knows the destination address of fraudulent transfer. I wonder if it would make sense to mark it as "dirty" and mark as "dirty" every other address where the funds will be transferred from this address. And then every legitimate merchant, after receiving bitcoin payment would validate incoming address against "dirty" list to allow tracking of thief? This of course works only if every merchant and service in bitcoin world would do that.

Just an idea ...

erikpukinskis2• 13 years ago

I doubt the miners would accept this idea. It goes against a key principle of Bitcoin: that transactions are irreversible and no authority can appropriate your coins.

Even the 0.8->0.7 reversal was hard for some miners to swallow. And in that case it was only accepted because only doubly-spent transactions would be reversed. Singly-spend transactions would just transfer over to the new chain.

I don't expect to ever see a Bitcoin fork where a cryptographically valid, singly-spent, included-in-a-block transaction is reversed.

kamkazemoose• 13 years ago

Isn't the whole point of bitcoins to get away from that kind of thing though? Someone has to maintain a list of what is 'dirty' and that maintainer becomes a central authority in the market. And, as I understand it, part of the philosophy of bitcoins is to have an open and free market. So while your idea is theoretically possible, once things like that start I fail to see how bitcoins are different from any other currency.

zorpner• 13 years ago

The counterattack to this is to transfer small amounts of the "tainted" btc to the addresses of the people who are leading the effort (or to outgoing addresses for large exchanges, faucets, and so on). This is effectively the same as laundering through dice/the late instawallet/et cetera

lenazegher• 13 years ago

>and mark as "dirty" every other address where the funds will be transferred from this address

One problem is that bitcoin launderers could intentionally send a portion of stolen coins to legitimate wallets. That would make a blacklist difficult to maintain, to say the least.

bencevans• 13 years ago

Clicking the logo directs the user to http://localhost:3000.

On a side note... New Business plan:

1. Setup an online Bitcoin wallet service 2. Wait a while till people actually trust/use it 3. "We got hacked"

jcoder2• 13 years ago

>On a side note... New Business plan: > >1. Setup an online Bitcoin wallet service 2. Wait a while till people actually trust/use it 3. "We got hacked"

Something tells me you're not the first to come up with this.

TillE• 13 years ago

Very high risk for moderate reward, assuming you're based in a country with functioning law enforcement.

gcb0• 13 years ago

not suggesting this is what happened as it's the first time i even hear about them.

but i've seen people do worse illegal risk/reward decisions before. much worse.

iaw• 13 years ago

Depends on the countries laws. What makes you think anyone attorney is going to prosecute the theft of a "digital currency." At this time in the world most people when informed of bitcoin think it's a toy currency.

makomk3• 13 years ago

Law enforcement aren't necessarily terribly keen on pursuing difficult crimes, especially when the victims are as uncooperative with the investigation as Bitcoin users have historically been

jerguismi2• 13 years ago

It is impossible to prove either way.

drivebyacct25• 13 years ago

stop. storing. your. wallet. online. (I wanted to write this in caps, but I resisted)

I'll add this to my list of things that people know they should do but are too lazy to take a few minutes and setup: don't repeat passwords, use a password manager, make regular backups, don't use GoDaddy.

Stop thinking you're the exception dammit, these things don't take that much effort to do properly.

tensafefrogs2• 13 years ago

To me, this signals a strong need for more secure bitcoin storage options, and since this is hacker news, perhaps some of us should get started on that :)

drivebyacct25• 13 years ago

Paper wallets are easy to make and relatively easy to use. Slightly harder to spend money with.

I suppose someone could customize a small Linux live CD to boot, not touch the hard drives, load an encrypted wallet off a secure jump drive and encourage backups. It's fairly straightforward if you use a dm-crypted jumpdrive and, say for example, Tails.

danielweber7• 13 years ago

I think I could do a pretty good job keeping wallets secure. But it would need to be a full-time job, not a side project, and it would need a big budget.

You don't bootstrap a bank.

(Plus I did some basics with Bitcoin a few years ago and got pissed off at the protocol and moved onto less annoying things.)

stcredzero6• 13 years ago

I may be spending a little karma in saying so, but this is exactly what DRM would be most useful for, when utilized by individuals in their own interest, as opposed to corporations using it to exercise power over individuals. This is exactly where being able to detect if an iPhone is non-jailbroken would be useful.

Or, we can dispense with having DRM on hardware we personally won. How about a protocol for providing a secure bitcoin wallet in the cloud? Basically, everyone runs their own open source mini-OS in their own obfuscated VM (1), which a smartphone app sets up for you and to which a smartphone app only acts as an interface. The wallet information is never on the smartphone, and the DRM is never on your own hardware.

Such an infrastructure would have many other uses, not just bitcoin.

(1) The security of each VM instance would be on an economic basis. Each one might be breakable within a week, say, but the system could be set up in a such a way that the week old information isn't work enough to motivate the effort.

erikpukinskis2• 13 years ago

I have my coins split between a wallet that I control and an online wallet that I have some faith in.

Because honestly, I don't actually fully trust myself. The chance is not negligible that I get a trojan with a keylogger that watches for me to open my wallet. So I store some of my coins online as a hedge against my own stupidity and the inherent insecurity of desktop computing.

I may, in the future, move a large portion of my coins into a fully offline (generated on a machine that's never seen the internet), safety-deposit-box stored wallet. But that's a little bit excessive at this point.

drivebyacct25• 13 years ago

Yeah, it's really not too hard to use a live linux disc to boot into to do transactions, etc. Keep the wallet encrypted in the client, keep the USB drive you store the wallet on dm-crypted. Keep the wallet (and it's daily backups) backed up to your DropBox in case you lose your jump drive.

The weakest link is then DropBox + your BTC-client password. Or I guess if someone has modified the live environment on your jump drive or if they have a sophisticated attack on your UEFI/BIOS.

jonny_eh• 13 years ago

Wouldn't a keylogger watch you open your online wallet too, and therefore provide the criminal access to your online wallet as well?

rashkov• 13 years ago

Hmmm, how about paypal linked to a bank account? Just as bad probably. They have a two factor authentication available with your phone, but perhaps even that is a bad idea.

reaclmbs• 13 years ago

Can you then please provide specific, step-by-step steps, for turning online BTC (in say, Coinbase or MtGox) into an offline, printed, "paper wallet"?

Thanks.

drivebyacct25• 13 years ago

This isn't "perfect" in my mind, but it's close: https://blockchain.info/wallet/paper-tutorial

I like BlockChain. There's still an amount of trust and I can think of ways it could be compromised, but they do a pretty good job architecturally of preventing your loss in the case they're compromised (well, depends on how they're compromised)

Anyway, those instructions will give you a secure paper wallet and an account that will enable you to still check your balance through blockchain.info.

(Note, this method keeps your private keys on the paper wallet, and the public key with Blockchain which enables balance checking but prevents compromise via blockchain.info)

jellicle2• 13 years ago

> Instawallet hacked

Another alternative is that the Instawallet people just decided to keep the "money" you had stored there, and retire to a small Caribbean island.

You'll never know.

Ixiaus• 13 years ago

In an authority-less and irreversible transaction currency it still surprises me when I hear about someone losing money to a service such as this - without an authority the burden of security truly is on the user themselves and they are at the mercy of the (supposed) security of whatever exchange or service they are attempting to use. In this case, having someone manage your wallet for you.

I personally keep my bitcoin wallet encrypted with GPG, I manually (like a safe) decrypt it when I want to make a bitcoin transaction and encrypt it when I'm done.

marshallford• 13 years ago

I use coinbase. How long until they are hacked? Who can I trust! This is the one con to bitcoin.

SkyMarshal• 13 years ago

Wow, could become a clusterfuck of epic proportions:

1. It takes three months to get you BTC back, and only up to a max of 50. If you have more, it will take longer.

2. If the hackers can figure out your url and key, they can dispute your claim. If they actually get their claim in before your legit claim, their claim is favored.

Yikes. I would not want to be either an Instawallet employee having to sort that mess, or a client with their BTC frozen for months and potentially at risk of being stolen.

"Important information on claims submission:

For the first 90 days we will accept claims for individual Instawallets. Your wallet's URL and key will be used to pre-populate a form to file the claim.

After 90 days, if no other claim has been received for the same url, your Instawallet balance under 50 BTC will be refunded. If several claims have been filed for the same url, we will process those claims on a case by case basis, under the presumption that the claim we received first belongs to the legitimate balance holder.

Claims for wallets that hold a balance greater than 50 BTC will be processed on a case by case and best efforts basis."

shabble• 13 years ago

If this is what it sounds like, and the "exploit" was google indexing a bunch of URLs which allowed direct access to the funds they referenced, how did google discover them in the first place?

There was mention of a missing/broken robots.txt which allowed GoogleBot to index them, but what I'm stuck on is how it learned about them in the first place; where they actually doing something utterly insane like autopublishing a sitemap, or was there some bug allowing g'bot to sniff/guess the URLs?

I've seen odd behaviour in my logs from google crawls in the past, like g'bot traffic within minutes of adding a new DNS entry/vhost to a domain, with absolutely assuredly no mention of it publicly available. I suppose it's possible they're watching DNS zone changes and scheduling a tentative probe, but it's a bit creepy (especially if you're disorganised and haven't got the robots.txt set up right away)

Instawallet Hacked

Related Stories