When generating a brain wallet, you MUST use something like DICEWARE and have at least 96 bits of entropy. Only then will you be "safe".
Your password had very low entropy - it was just a matter of time. Repeating words in patterns does NOTHING against an attack.
Password123 and the same repeated 10x is worthless.
Topic: Brain Wallet hacked, suspect bitcoin talk hackers. - page 4. (Read 5564 times)
@OP I have one more question:
Did you not change your forum password after the hack?
Theymos made it clear that it is better to change your password to be on the safe side.
Did you not change your forum password after the hack?
Theymos made it clear that it is better to change your password to be on the safe side.
I did change my password asap after the hack.
After the forum hack or your wallet hack?
If it was after the forum hack, then why didn't you change your wallet password as well?
-snip-
As such, you should change your password here and anywhere else you used that same password. You should disable your secret question and assume that the attacker now knows your answer to your secret question. You should prepare to receive phishing emails at your forum email address.
-snip-
As such, you should change your password here and anywhere else you used that same password. You should disable your secret question and assume that the attacker now knows your answer to your secret question. You should prepare to receive phishing emails at your forum email address.
-snip-
Well, silly me, I should have changed it. But having received that email saying the hacker probably only had a hash of my password I thought it would be fine since the brain wallet was furthermore in the form of passwordpasswordpassword. The address was emptied just hours after I deposited the funds. I had deposited 0.1btc beforehand without trouble. spooky.
to use or not to use brain wallet I think is a careful choice you need brainpower to make.
@OP I have one more question:
Did you not change your forum password after the hack?
Theymos made it clear that it is better to change your password to be on the safe side.
Did you not change your forum password after the hack?
Theymos made it clear that it is better to change your password to be on the safe side.
I did change my password asap after the hack.
After the forum hack or your wallet hack?
If it was after the forum hack, then why didn't you change your wallet password as well?
-snip-
As such, you should change your password here and anywhere else you used that same password. You should disable your secret question and assume that the attacker now knows your answer to your secret question. You should prepare to receive phishing emails at your forum email address.
-snip-
As such, you should change your password here and anywhere else you used that same password. You should disable your secret question and assume that the attacker now knows your answer to your secret question. You should prepare to receive phishing emails at your forum email address.
-snip-
The hacker could be the one that hacked bitcointalk because most of our password are compromised and I dont see many people claim that they lost their account because of the server compromised. It seems like his target is this, to hack the brain wallet of the bitcoin address that may have the same password with bitcointalk password
if only websites had some common sense and not store clear-text passwords..
all passwords should be hashes of a password that is converted at login but the cleartext is never stored.
The hacker could be the one that hacked bitcointalk because most of our password are compromised and I dont see many people claim that they lost their account because of the server compromised. It seems like his target is this, to hack the brain wallet of the bitcoin address that may have the same password with bitcointalk password
if only websites had some common sense and not store clear-text passwords..
all passwords should be hashes of a password that is converted at login but the cleartext is never stored.
Some website has this feature but I think at bitcointalk, this is not the way they store our password. Because of the server compromised, alot of old VIP account that never posted come back to post . I think this make sense this is the hacker target because if he hack a usual account , theymos can easily restore it back. I guess the hacker hit a jackpot
Isn't this what BitcoinTalk did though? Passwords were never stored in plaintext but were instead stored in cryptographic hashes. Had this not been the case, there would be far more compromised accounts than what we're seeing right now:
Quote
Compromised password hashes means that your actual passwords have not been revealed but their hash has. What that can do is link passwords across different accounts. For example the most common password hash algorithm is the md5 which is used to store a one way hash of a password. The md5 hash of the password “abc123″ would be “e99a18c428cb38d5f260853678922e03″. It is a good idea to change the password on any accounts that used the same password as your bitcointalk account because an attacker can try to access your alternate accounts by authenticating to the server by sending packets of your hashed password and username.
Link: http://themerkle.com/psa/bitcointalk-server-compromised-due-to-a-social-engineering-attack/
Quote
At 09:00 UTC on 24 of May I received an email telling me that the owner of the server of bitcointalk.org had lost control of among other things the password hashes. Since the passwords were not stored themselves the hacker couldn't get the passwords but could confirm a given word to be a password by comparing its hash to the hashes that were stolen.
Link: http://letstalkbitcoin.com/forum/post/bitcointalk-hacked
An older article:
Quote
Fortunately, Bitcointalk.org stores passwords in cryptographic hashes meaning that clear passwords would not have been leaked to the attacker. Given enough time and energy a determined attacker can still decrypt the passwords; but using hashes is still an excellent practice that gives establishments and forum users enough time to get them changed to help reduce the damage from a password leak.
http://siliconangle.com/blog/2011/09/12/forum-user-passwords-possibly-stolen-in-bitcointalk-org-bill-cosby-hack/
The hacker could be the one that hacked bitcointalk because most of our password are compromised and I dont see many people claim that they lost their account because of the server compromised. It seems like his target is this, to hack the brain wallet of the bitcoin address that may have the same password with bitcointalk password
if only websites had some common sense and not store clear-text passwords..
all passwords should be hashes of a password that is converted at login but the cleartext is never stored.
Some website has this feature but I think at bitcointalk, this is not the way they store our password. Because of the server compromised, alot of old VIP account that never posted come back to post . I think this make sense this is the hacker target because if he hack a usual account , theymos can easily restore it back. I guess the hacker hit a jackpot
@OP I have one more question:
Did you not change your forum password after the hack?
Theymos made it clear that it is better to change your password to be on the safe side.
Did you not change your forum password after the hack?
Theymos made it clear that it is better to change your password to be on the safe side.
I did change my password asap after the hack.
@OP I have one more question:
Did you not change your forum password after the hack?
Theymos made it clear that it is better to change your password to be on the safe side.
Did you not change your forum password after the hack?
Theymos made it clear that it is better to change your password to be on the safe side.
Perfect example why everyone should change their passwords on all platforms if they were the same as their bitcointalk one.
There is also a chance it was bitaddress.org that was compromised but Ive never had that trouble before.
You used the live version of bitaddress or did you download the github repository and created your address from that?
Also, did you scan your PC for keyloggers, trojans, etc?
I used the live version of bitaddress. Im not very computer savy, I dont know how to tell if I have key loggers on my computer. I am using Ubuntu 14.04, be that as it may. Ive never had trouble on linux (except possibly this occasion)
That sucks, I hope you didn't have all of your bitcoin in that one wallet, though obviously 12 bitcoin is a hell of a lot to lose anyway
Bitcointalk should probably use 2fa to protect the users, I can't see much reason not to offer it at least.
Bitcointalk should probably use 2fa to protect the users, I can't see much reason not to offer it at least.
Its wasnt too much of my total btc worth, but plenty enough to make me cringe.
I was thinking of buying a new laptop but Im not feeling that rich any more. [/quote]
I think it is wise to run a good antivirus progrm. I would try hit man pro. It has a 30 day free trial for its full version
in addition, install hit man pro alert, which monitors and blocks any suspicious browser activity. (I think it blocks stuff like browser hijackers etc).
The hacker could be the one that hacked bitcointalk because most of our password are compromised and I dont see many people claim that they lost their account because of the server compromised. It seems like his target is this, to hack the brain wallet of the bitcoin address that may have the same password with bitcointalk password
if only websites had some common sense and not store clear-text passwords..
all passwords should be hashes of a password that is converted at login but the cleartext is never stored.
lesson to learn dont use
example123example123example123example123
if anything
3x4mp731233x4mp731233x4mp731233x4mp731233x4mp731233x4mp731233x4mp731233x4mp7312 33x4mp731233x4mp731233x4mp731233x4mp73123
3x4mp731233x4mp731233x4mp731233x4mp731233x4mp731233x4mp731233x4mp731233x4mp7312 33x4mp731233x4mp731233x4mp731233x4mp73123
use really long passphrases and not with dictionary words spelled out exactly as found in the dictionary.
if its not atleast 50 characters long, you might aswell say goodbye to it within a couple months
example123example123example123example123
if anything
3x4mp731233x4mp731233x4mp731233x4mp731233x4mp731233x4mp731233x4mp731233x4mp7312 33x4mp731233x4mp731233x4mp731233x4mp73123
3x4mp731233x4mp731233x4mp731233x4mp731233x4mp731233x4mp731233x4mp731233x4mp7312 33x4mp731233x4mp731233x4mp731233x4mp73123
use really long passphrases and not with dictionary words spelled out exactly as found in the dictionary.
if its not atleast 50 characters long, you might aswell say goodbye to it within a couple months
The hacker could be the one that hacked bitcointalk because most of our password are compromised and I dont see many people claim that they lost their account because of the server compromised. It seems like his target is this, to hack the brain wallet of the bitcoin address that may have the same password with bitcointalk password
Sorry to hear that..
May I ask how many characters your bitcointalk password was ? I'll use X.
So the attack 'could' have been :
1) Hack bitcointalk and download the hash of all the passwords.
2) Check password hashes against known hashes in rainbow tables and then brute force all combinations up to X letters still missing.
3) If you find a valid password/hash combo try it in brainwallet and see if the address exists. Try many combinations of the password, including stringing multiple copies together. Maybe billions.
4) Empty any funds found.
..
Very harsh my friend.
I use a brainwallet too, but the password is VERY loonnggg.. (over 200 characters symbols/number/characters etc..). not repeated strings. never used in part or in full anywhere else. ever...
..GRUDDDAMMM HACCKKKERRSSS@!!!@£$!
May I ask how many characters your bitcointalk password was ? I'll use X.
So the attack 'could' have been :
1) Hack bitcointalk and download the hash of all the passwords.
2) Check password hashes against known hashes in rainbow tables and then brute force all combinations up to X letters still missing.
3) If you find a valid password/hash combo try it in brainwallet and see if the address exists. Try many combinations of the password, including stringing multiple copies together. Maybe billions.
4) Empty any funds found.
..
Very harsh my friend.
I use a brainwallet too, but the password is VERY loonnggg.. (over 200 characters symbols/number/characters etc..). not repeated strings. never used in part or in full anywhere else. ever...
..GRUDDDAMMM HACCKKKERRSSS@!!!@£$!
There is also a chance it was bitaddress.org that was compromised but Ive never had that trouble before.
You used the live version of bitaddress or did you download the github repository and created your address from that?
Also, did you scan your PC for keyloggers, trojans, etc?
[/quote]
I used the live version of bitaddress. Im not very computer savy, I dont know how to tell if I have key loggers on my computer. I am using Ubuntu 14.04, be that as it may. Ive never had trouble on linux (except possibly this occasion)
That sucks, I hope you didn't have all of your bitcoin in that one wallet, though obviously 12 bitcoin is a hell of a lot to lose anyway
Bitcointalk should probably use 2fa to protect the users, I can't see much reason not to offer it at least.
Bitcointalk should probably use 2fa to protect the users, I can't see much reason not to offer it at least.
Its wasnt too much of my total btc worth, but plenty enough to make me cringe.
I was thinking of buying a new laptop but Im not feeling that rich any more. 
Even bank-, governement- massive shop sites and systems are not safe.
Let me remind you nasa, fbi and cia has been victim as well.
Yes its often a small gap, but they seem allways find that small fail in the systems.
Nothing is absolute safe against these attacks.
Its for most people too much to stay safe small mistakes by any person using your system can make a big hole in your security.
Some girlfriend of my wife was a real facebook lover and opened up all kinda sites and never refused any of the java and adobe stuff, its obvious that my system got infiltrated.
So even though some are trying to make it hard to get hacked, a friend or girlfriend could easily make the same mistake.
I have huge problems to get people to use different passes on different sites and programs, they simply refuse because they can not remember more than 2 passwords.....
Even today i noticed a group of workers who shared the system passes freely, everywhere stickers with the passwords from all of them.
Its time we find better ways to secure our programs/sites whatever from these problems.
I was hoping biometrics would solve alot, but i found even these have flaws and sometimes am worse than having passwords.
Let me remind you nasa, fbi and cia has been victim as well.
Yes its often a small gap, but they seem allways find that small fail in the systems.
Nothing is absolute safe against these attacks.
Its for most people too much to stay safe small mistakes by any person using your system can make a big hole in your security.
Some girlfriend of my wife was a real facebook lover and opened up all kinda sites and never refused any of the java and adobe stuff, its obvious that my system got infiltrated.
So even though some are trying to make it hard to get hacked, a friend or girlfriend could easily make the same mistake.
I have huge problems to get people to use different passes on different sites and programs, they simply refuse because they can not remember more than 2 passwords.....
Even today i noticed a group of workers who shared the system passes freely, everywhere stickers with the passwords from all of them.
Its time we find better ways to secure our programs/sites whatever from these problems.
I was hoping biometrics would solve alot, but i found even these have flaws and sometimes am worse than having passwords.
And how he found that this address is yours?
He must have hacked my bitcoin talk password, like most of us, and tried many combinations to produce my private key.
Sorry to hear that.
I don't understand exactly how that happened to you, what information did you have on your bitcointalk account that helped them hack your brain wallet?
It is the number one reason why bitcoin hasn't taken off as we all hope, security is much harder to perfect than almost everyone thinks
I don't understand exactly how that happened to you, what information did you have on your bitcointalk account that helped them hack your brain wallet?
It is the number one reason why bitcoin hasn't taken off as we all hope, security is much harder to perfect than almost everyone thinks
I received an email from bitcoin talk that the hacker who brought bitcoin talk for a few days could have stolen my password hash amongst other things. This same password in the form of 'passwordpasswordpassword' was my brain wallet. Its a pretty random password, I dont believe it was brute force hacked. Im really baffled, I think it must have been the bitcoin talk hacker targeting me. There is also a chance it was bitaddress.org that was compromised but Ive never had that trouble before.
You used the live version of bitaddress or did you download the github repository and created your address from that?
Also, did you scan your PC for keyloggers, trojans, etc?
That sucks, I hope you didn't have all of your bitcoin in that one wallet, though obviously 12 bitcoin is a hell of a lot to lose anyway
Bitcointalk should probably use 2fa to protect the users, I can't see much reason not to offer it at least.
Bitcointalk should probably use 2fa to protect the users, I can't see much reason not to offer it at least.
And how he found that this address is yours?
He must have hacked my bitcoin talk password, like most of us, and tried many combinations to produce my private key.
Sorry to hear that.
I don't understand exactly how that happened to you, what information did you have on your bitcointalk account that helped them hack your brain wallet?
It is the number one reason why bitcoin hasn't taken off as we all hope, security is much harder to perfect than almost everyone thinks
I don't understand exactly how that happened to you, what information did you have on your bitcointalk account that helped them hack your brain wallet?
It is the number one reason why bitcoin hasn't taken off as we all hope, security is much harder to perfect than almost everyone thinks
I received an email from bitcoin talk that the hacker who brought bitcoin talk for a few days could have stolen my password hash amongst other things. This same password in the form of 'passwordpasswordpassword' was my brain wallet. Its a pretty random password, I dont believe it was brute force hacked. Im really baffled, I think it must have been the bitcoin talk hacker targeting me. There is also a chance it was bitaddress.org that was compromised but Ive never had that trouble before.
Sorry to hear that.
I don't understand exactly how that happened to you, what information did you have on your bitcointalk account that helped them hack your brain wallet?
It is the number one reason why bitcoin hasn't taken off as we all hope, security is much harder to perfect than almost everyone thinks
I don't understand exactly how that happened to you, what information did you have on your bitcointalk account that helped them hack your brain wallet?
It is the number one reason why bitcoin hasn't taken off as we all hope, security is much harder to perfect than almost everyone thinks
Jump to: