Hacked - 22 BTC stolen from Bitcoin-QT v0.8.1-beta wallet on OS X 10.7.5 - page 2.

Kouye

sr. member

Activity: 336

Merit: 250

Cuddling, censored, unicorn-shaped troll.

The source code on https://github.com/trevory/bitvanity was a perfectly legit vanity generator. The pre-compiled one included a malware.

Quote from: chanba on May 01, 2013, 12:42:17 PM

Edit: The source code version is clean and has nothing scary. I was hoping to find something in the compiled binary and found this, so it's very clearly malware:
/Users/satoshinakamoto/Desktop/BitVanity Hacked/BitVanity/main.m/

Edit : Removed a quote which I didn't notice was completely irrelevant to this thread. Thanks for pointing this out, Remember remember the 5th of November

vlees

full member

Activity: 196

Merit: 100

Quote from: ajk on August 03, 2013, 12:24:51 AM

Just read through this entire thread, Extremely sorry to hear about your loss

is this only for Mac computers? I have a linux machine with vanity gen on it and this machine has not all but a fair amount of coins on it, is this only bad if your a Mac user?

This is about the tool "BitVanity" which exists for Mac OS X only.

VanityGen (many platforms) is completely safe as far as I know. If you want to be sure, download the source code, review it and compile the tool yourself (VERY IMPORTANT; don't code review and then use the precompiled version).

ajk

donator

Activity: 447

Merit: 250

Just read through this entire thread, Extremely sorry to hear about your loss

is this only for Mac computers? I have a linux machine with vanity gen on it and this machine has not all but a fair amount of coins on it, is this only bad if your a Mac user?

tabbek

member

Activity: 116

Merit: 10

Oh, dont interpret my post as some form of 'pro-bitvanity'. just reports of the issue are enough to make me avoid it like the plague.

That being said, I think vanitygen is a different author, different program. I dont keep any btc on the machine I use to generate vanity addresses, but I do have a wallet on it, and havent had any issues.

as always, always a good idea to review something yourself (like source) to evaluate the risks.

E.Sam

sr. member

Activity: 393

Merit: 250

Quote from: tabbek on August 02, 2013, 11:11:24 PM

im definitely not an 'expert' in code review, but https://github.com/samr7/vanitygen seems ok.

I would seems strange that 2 of us got all our BTCs stolen in a similar fashion while using Bitvanity. This said, I m scouting around the web trying to find similar cases and see it they were using bitvanity.
Would be great if someone knowledgeable could have a look at the code.

tabbek

member

Activity: 116

Merit: 10

im definitely not an 'expert' in code review, but https://github.com/samr7/vanitygen seems ok.

E.Sam

sr. member

Activity: 393

Merit: 250

Just found out where I first read about bitvanity: http://www.btcpedia.com/generate-bitcoin-vanity-address/

Also, seems like this "Trevor Muller" (his Github pseudonym) has done other interesting things https://discussions.apple.com/thread/5045842?start=0&tstart=0

DannyHamilton

legendary

Activity: 3416

Merit: 4658

Quote from: E.Sam on August 02, 2013, 09:06:00 PM

It looks like Github took down the app:

Glad to hear it. Thanks for the update.

E.Sam

sr. member

Activity: 393

Merit: 250

Quote from: DannyHamilton on August 02, 2013, 03:32:03 PM

I gave it a try as well. Here's what I sent them:

Quote

After testing the executable binaries distributed through github in the following location:
https://github.com/trevory/bitvanity

It has been determined that these executable binaries are falsely advertised as providing a specific purpose, while in reality being intentionally designed to maliciously steal account information and destroy contents on the user's computer.

Multiple users have reported having valuable content stolen from their computer by this software.

This would appear to be in direct violation of the github Terms Of Service. Specifically:

A.8. You may not use the Service for any illegal or unauthorized purpose. You must not, in the use of the Service, violate any laws in your jurisdiction (including but not limited to copyright or trademark laws).

G.7. We may, but have no obligation to, remove Content and Accounts containing Content that we determine in our sole discretion are unlawful, offensive, threatening, libelous, defamatory, pornographic, obscene or otherwise objectionable or violates any party's intellectual property or these Terms of Service.

and

G.11. You must not transmit any worms or viruses or any code of a destructive nature.

As such I expect you to immediately terminate the user's access to GitHub and remove their hosted content before any other users are unknowingly duped into installing this illegal malware.

I'll update with whatever feedback I receive.

Very nicely handled - Thanks for getting involved.

It looks like Github took down the app:

Quote

This repository has been disabled.
Access to this repository has been disabled by GitHub staff due to excessive use of resources. Contact support to restore access to this repository. Read here to learn more about decreasing the size of your repository.

I suppose stating the truth would have been bad publicity.

DannyHamilton

legendary

Activity: 3416

Merit: 4658

Quote from: E.Sam on August 02, 2013, 02:58:20 PM

Just got an answer from Github:

Quote

Hi Eric,

If the project in question doesn't behave as expected, I'd suggest opening an issue and discussing it with the maintainer.

Cheers,
Steven!

I m not sure if I should laugh or cry at this point.....

I gave it a try as well. Here's what I sent them:

Quote

After testing the executable binaries distributed through github in the following location:
https://github.com/trevory/bitvanity

It has been determined that these executable binaries are falsely advertised as providing a specific purpose, while in reality being intentionally designed to maliciously steal account information and destroy contents on the user's computer.

Multiple users have reported having valuable content stolen from their computer by this software.

This would appear to be in direct violation of the github Terms Of Service. Specifically:

A.8. You may not use the Service for any illegal or unauthorized purpose. You must not, in the use of the Service, violate any laws in your jurisdiction (including but not limited to copyright or trademark laws).

G.7. We may, but have no obligation to, remove Content and Accounts containing Content that we determine in our sole discretion are unlawful, offensive, threatening, libelous, defamatory, pornographic, obscene or otherwise objectionable or violates any party's intellectual property or these Terms of Service.

and

G.11. You must not transmit any worms or viruses or any code of a destructive nature.

As such I expect you to immediately terminate the user's access to GitHub and remove their hosted content before any other users are unknowingly duped into installing this illegal malware.

I'll update with whatever feedback I receive.

E.Sam

sr. member

Activity: 393

Merit: 250

Quote from: Kouye on August 02, 2013, 02:46:56 PM

There is a chance the malware just took advantage of your wallet unlocking to push a TX, and not steal your private keys along.
I would keep the wallet just in case, since you might receive payments on one of his addresses, but start a fresh one anyway, too.

That might be it since the all wallet was emptied as soon as I entered my passphrase.
I don't think I will receive any more payments, will empty the remaining 0.0095 BTC and delete the all thing.

I m not using Time Machine, but I will keep this terminal offline until I m sure the threat is taken care of.

Just got an answer from Github:

Quote

Hi Eric,

If the project in question doesn't behave as expected, I'd suggest opening an issue and discussing it with the maintainer.

Cheers,
Steven!

I m not sure if I should laugh or cry at this point.....

Moebius327

hero member

Activity: 770

Merit: 500

Quote from: E.Sam on August 02, 2013, 02:43:57 PM

Quote from: Moebius327 on August 02, 2013, 02:38:54 PM

Quote from: E.Sam on August 02, 2013, 02:34:44 PM

Quote from: DannyHamilton on August 02, 2013, 02:29:14 PM

Quote from: E.Sam on August 02, 2013, 02:17:02 PM

I was just made aware of this: https://bitcointalksearch.org/topic/m.1995725

Yep, sounds like the Vanity Generator that you installed was a trojan. I assume your Bitcoin-Qt wallet wasn't password protected either? Or did the vanity generator manage to capture your keyboard input and get your password that way?

It was protected (25 random characters) - I think it waited for me to enter my password. As soon as that happened, it just sent the all wallet content.

I have now contacted Github and asked for this "app" to be taken down.

Hard lesson.

Sorry to hear that. I experienced the same thing using the Mac OS app of Electrum.

Thanks, good to know. I will from now on become way more paranoid.

I suppose my all wallet is now compromised. The best thing is just to delete the all thing since I have no BTCs left, no?
Also, any suggestions on how to be sure I fully delete the app from my system?

You should format or use Time Machine? I am not sure about the second.

Kouye

sr. member

Activity: 336

Merit: 250

Cuddling, censored, unicorn-shaped troll.

There is a chance the malware just took advantage of your wallet unlocking to push a TX, and not steal your private keys along.
I would keep the wallet just in case, since you might receive payments on one of his addresses, but start a fresh one anyway, too.

E.Sam

sr. member

Activity: 393

Merit: 250

Quote from: Moebius327 on August 02, 2013, 02:38:54 PM

Quote from: E.Sam on August 02, 2013, 02:34:44 PM

Quote from: DannyHamilton on August 02, 2013, 02:29:14 PM

Quote from: E.Sam on August 02, 2013, 02:17:02 PM

I was just made aware of this: https://bitcointalksearch.org/topic/m.1995725

Yep, sounds like the Vanity Generator that you installed was a trojan. I assume your Bitcoin-Qt wallet wasn't password protected either? Or did the vanity generator manage to capture your keyboard input and get your password that way?

It was protected (25 random characters) - I think it waited for me to enter my password. As soon as that happened, it just sent the all wallet content.

I have now contacted Github and asked for this "app" to be taken down.

Hard lesson.

Sorry to hear that. I experienced the same thing using the Mac OS app of Electrum.

Thanks, good to know. I will from now on become way more paranoid.

I suppose my all wallet is now compromised. The best thing is just to delete the all thing since I have no BTCs left, no?
Also, any suggestions on how to be sure I fully delete the app from my system?

Moebius327

hero member

Activity: 770

Merit: 500

Quote from: E.Sam on August 02, 2013, 02:34:44 PM

Quote from: DannyHamilton on August 02, 2013, 02:29:14 PM

Quote from: E.Sam on August 02, 2013, 02:17:02 PM

I was just made aware of this: https://bitcointalksearch.org/topic/m.1995725

Yep, sounds like the Vanity Generator that you installed was a trojan. I assume your Bitcoin-Qt wallet wasn't password protected either? Or did the vanity generator manage to capture your keyboard input and get your password that way?

It was protected (25 random characters) - I think it waited for me to enter my password. As soon as that happened, it just sent the all wallet content.

I have now contacted Github and asked for this "app" to be taken down.

Hard lesson.

Sorry to hear that. I experienced the same thing using the Mac OS app of Electrum.

E.Sam

sr. member

Activity: 393

Merit: 250

Quote from: DannyHamilton on August 02, 2013, 02:29:14 PM

Quote from: E.Sam on August 02, 2013, 02:17:02 PM

I was just made aware of this: https://bitcointalksearch.org/topic/m.1995725

Yep, sounds like the Vanity Generator that you installed was a trojan. I assume your Bitcoin-Qt wallet wasn't password protected either? Or did the vanity generator manage to capture your keyboard input and get your password that way?

It was protected (25 random characters) - I think it waited for me to enter my password. As soon as that happened, it just sent the all wallet content.

I have now contacted Github and asked for this "app" to be taken down.

Hard lesson.

DannyHamilton

legendary

Activity: 3416

Merit: 4658

Quote from: E.Sam on August 02, 2013, 02:17:02 PM

I was just made aware of this: https://bitcointalksearch.org/topic/m.1995725

Yep, sounds like the Vanity Generator that you installed was a trojan. I assume your Bitcoin-Qt wallet wasn't password protected either? Or did the vanity generator manage to capture your keyboard input and get your password that way?

E.Sam

sr. member

Activity: 393

Merit: 250

I was just made aware of this: https://bitcointalksearch.org/topic/m.1995725

E.Sam

sr. member

Activity: 393

Merit: 250

Quote from: DannyHamilton on August 02, 2013, 11:38:02 AM

Was the 1936Ej4GZeJ4LBsjHQ6U8v2tooTTa1jDFf address generated with a vanity gen program, imported after receiving the private key from someone, or imported after being created as a brain wallet of some sort?

No, it was an address generated by Bitoin-QT wallet. I only generated a few vanity address so to experiment, and imported a couple in my wallet. I used an OSX application found on the net https://github.com/trevory/bitvanity - I scanned it and it came clean. This said, I wasn't going to trust the source and didn't intend to use generated address for any transaction.

Now that I look at this app, it does look a bit suspicious.

DannyHamilton

legendary

Activity: 3416

Merit: 4658

Was the 1936Ej4GZeJ4LBsjHQ6U8v2tooTTa1jDFf address generated with a vanity gen program, imported after receiving the private key from someone, or imported after being created as a brain wallet of some sort?

Topic: Hacked - 22 BTC stolen from Bitcoin-QT v0.8.1-beta wallet on OS X 10.7.5 - page 2. (Read 10755 times)