Pages:
Author

Topic: Have I been hacked? how? - page 2. (Read 11894 times)

hero member
Activity: 630
Merit: 500
Bitgoblin
July 07, 2013, 03:04:58 PM
#22
First, it is only an idea that I don't know how to resolve all the problems with it.

What I thought of is to block the address of the thief, that way he won't be able to pay anyone so there is no problem with confiscating money from uninvolved party.
[...]
As I wrote before, now someone needs to find a way to prove that it is really a theft.
This makes no sense.
Again, cash is cash is cash.
If you appoint some "higher authority" to decide that some cash is no longer cash, the whole currency becomes worthless.

Again, this is not a problem that has yet to be solved, this is a problem that cannot be solved.
It is not a problem with no known solution, it is a problem which is known to have no solution.
newbie
Activity: 15
Merit: 0
July 07, 2013, 02:38:39 PM
#21
Though, big money transfers are being done with marked bills, which gives the option to catch the thief.
You can catch the thief, but you can't confiscate them from a third party if he was uninvolved and just happened to be paid with one such bills.

And you can already try to do that with bitcoin: the ledger is public and you can look at the path that those coins will follow, eventually hitting a known address.
Which might or might not be related with the thief.
It likely won't.

First, it is only an idea that I don't know how to resolve all the problems with it.

What I thought of is to block the address of the thief, that way he won't be able to pay anyone so there is no problem with confiscating money from uninvolved party.
Take the theft from MT.Gox, the addresses are known and the coins are untouched, so if miners will refuse to mine transactions from these addresses only the thief will be harmed, it won't get the coins back but it will reduce the incentive from stealing.
As I wrote before, now someone needs to find a way to prove that it is really a theft.
hero member
Activity: 630
Merit: 500
Bitgoblin
July 07, 2013, 02:32:54 PM
#20
Though, big money transfers are being done with marked bills, which gives the option to catch the thief.
You can catch the thief, but you can't confiscate them from a third party if he was uninvolved and just happened to be paid with one such bills.

And you can already try to do that with bitcoin: the ledger is public and you can look at the path that those coins will follow, eventually hitting a known address.
Which might or might not be related with the thief.
It likely won't.
fxj
newbie
Activity: 28
Merit: 0
July 07, 2013, 02:29:13 PM
#19
IF your computer was hacked, there are so many ways this could have happened. You can't expect to find out how by asking here on the forum. To stand a realistic chance of getting the answer, you'd have to let somebody in the know examine your computer.

Read up on best practices for computer security and BC security, re-install your OS, get a new start.
newbie
Activity: 15
Merit: 0
July 07, 2013, 02:26:09 PM
#18
Next question, where did you get your keypair?  In other words, did you generate the keypair externally and then import the private key or did blockchain.info generate the keypair (using javascript on your computer)?
The keypair was generated in blockchain.info, I don't remember how (probably javascript)
newbie
Activity: 15
Merit: 0
July 07, 2013, 02:25:06 PM
#17
I guess in the future, the network can develop a mechanism to mark "bad" address and then avoid taking payments from such address, today there is no such mechanism (I guess bigger thefts can be tracked and nothing can be done with them).
No, bitcoins are cash, there is no possible way to make such a thing work.
I disagree with this statement, though I'm aware to the fact that there are many problems with such approach - mainly, how do I prove that this is theft and not transaction I did.
Resolving these problems will make Bitcoin theft irrelevant and enable better security, and from feasibility point of view it is not hard at all.
No, this cannot be solved, period.
Cash is cash is cash. Or it's not cash anymore.

If someone steals 1 dollar and then uses to pay a few apples at the groceries, you can't take that dollar from the grocery store, or the concept itself of cash is dead.
So, no tainted coins.

Though, big money transfers are being done with marked bills, which gives the option to catch the thief.
hero member
Activity: 630
Merit: 500
Bitgoblin
July 07, 2013, 02:17:39 PM
#16
I guess in the future, the network can develop a mechanism to mark "bad" address and then avoid taking payments from such address, today there is no such mechanism (I guess bigger thefts can be tracked and nothing can be done with them).
No, bitcoins are cash, there is no possible way to make such a thing work.
I disagree with this statement, though I'm aware to the fact that there are many problems with such approach - mainly, how do I prove that this is theft and not transaction I did.
Resolving these problems will make Bitcoin theft irrelevant and enable better security, and from feasibility point of view it is not hard at all.
No, this cannot be solved, period.
Cash is cash is cash. Or it's not cash anymore.

If someone steals 1 dollar and then uses to pay a few apples at the groceries, you can't take that dollar from the grocery store, or the concept itself of cash is dead.
So, no tainted coins.
legendary
Activity: 2646
Merit: 1137
All paid signature campaigns should be banned.
July 07, 2013, 02:09:11 PM
#15
Next question, where did you get your keypair?  In other words, did you generate the keypair externally and then import the private key or did blockchain.info generate the keypair (using javascript on your computer)?
newbie
Activity: 15
Merit: 0
July 07, 2013, 02:08:30 PM
#14
I guess in the future, the network can develop a mechanism to mark "bad" address and then avoid taking payments from such address, today there is no such mechanism (I guess bigger thefts can be tracked and nothing can be done with them).
No, bitcoins are cash, there is no possible way to make such a thing work.

I disagree with this statement, though I'm aware to the fact that there are many problems with such approach - mainly, how do I prove that this is theft and not transaction I did.
Resolving these problems will make Bitcoin theft irrelevant and enable better security, and from feasibility point of view it is not hard at all.
hero member
Activity: 630
Merit: 500
Bitgoblin
July 07, 2013, 02:03:00 PM
#13
I guess in the future, the network can develop a mechanism to mark "bad" address and then avoid taking payments from such address, today there is no such mechanism (I guess bigger thefts can be tracked and nothing can be done with them).
No, bitcoins are cash, there is no possible way to make such a thing work.
newbie
Activity: 15
Merit: 0
July 07, 2013, 01:51:48 PM
#12
I don't think it is the ap but I have to ask, where did you get the ap?

Assuming it is not the ap itself can you check your phone for malware?

I still have to wonder, what the hell is up with the change?  Why is there change?  Where did it go?  Strange.  It is still sitting there.  I guess you can monitor that address for movement.
The app is the formal blockchain.info app, I think I got it from the Play Store.

I will try to look for malwares on the phone, will get some reading.

The change is a good question indeed.  Sad
Although both payment still sit in the receiver accounts and I can track them, I don't really have what to do with it. This is the essence of Bitcoin, anonymity, isn't it?

I guess in the future, the network can develop a mechanism to mark "bad" address and then avoid taking payments from such address, today there is no such mechanism (I guess bigger thefts can be tracked and nothing can be done with them).
legendary
Activity: 2646
Merit: 1137
All paid signature campaigns should be banned.
July 07, 2013, 01:41:17 PM
#11
Are you using the web site only, android application only or a combination of the two?
Both, the transaction in question happened after some usage of the Android app.

This line of thinking might be worth some checking.  The keylogger/thief/bad mojo may be on your phone.

I don't think it is the ap but I have to ask, where did you get the ap?

Assuming it is not the ap itself can you check your phone for malware?

I still have to wonder, what the hell is up with the change?  Why is there change?  Where did it go?  Strange.  It is still sitting there.  I guess you can monitor that address for movement.
newbie
Activity: 15
Merit: 0
July 07, 2013, 01:35:03 PM
#10
Thanks for the assistance.

If you go to the "Receive Money" tab in your blockchain.info wallet how many addresses are listed under each of the sub tabs "Active", "Archived" and "Shared"

Make sure you go through all three and see if either of the addresses in question are listed there (especially the change address)
I have only 3 active addresses, 2 of them never had coins, and all of them are empty

Now more interesting questions:

Do you have any remaining balance in your wallet or did they take everything from all addresses in that wallet?
Currently I have balance of 0.00.

Are you using the web site directly or using a plug in (plug in is a bit safer)?
I used the web interface, from Firefox and Chrome and from several computers...
Which raise the question of where is the keylogger, if this is the explanation...  Huh

Are you using two factor authentication?
No, though, I guess it wouldn't help for keylogger.

Are you using the web site only, android application only or a combination of the two?
Both, the transaction in question happened after some usage of the Android app.

Do you have any other wallets besides your blockchain.info wallet?
I created few addresses on my computer when I played with the client, nothing alive or with coins.

Do you use the password you use at blockchain.info at any other web site anywhere?
Not on the web, I won't use it anymore...

Thanks.
legendary
Activity: 2646
Merit: 1137
All paid signature campaigns should be banned.
July 07, 2013, 01:22:52 PM
#9
I am interested in the change address.  Did they really clean you out but leave 0.0015629 in change on one of your addresses?

Is this one of your addresses?   https://blockchain.info/address/1GhrHe13nFhAHMJ5UZLJJN1uaGHF6n4hN8

I agree the change is weird, it is not my address.
I hate to ask such a simple question but I do not know exactly how much of a noob you are (or are not).

If you go to the "Receive Money" tab in your blockchain.info wallet how many addresses are listed under each of the sub tabs "Active", "Archived" and "Shared"

Make sure you go through all three and see if either of the addresses in question are listed there (especially the change address)

Now more interesting questions:

Do you have any remaining balance in your wallet or did they take everything from all addresses in that wallet?
Are you using the web site directly or using a plug in (plug in is a bit safer)?
Are you using two factor authentication?
Are you using the web site only, android application only or a combination of the two?
Do you have any other wallets besides your blockchain.info wallet?
Do you use the password you use at blockchain.info at any other web site anywhere?

hero member
Activity: 524
Merit: 502
July 07, 2013, 12:43:28 PM
#8
Second, can anyone help me understand what happened? I used blockchain.info both on my computer and my Android smartphone.
Do you have a strong passphrase?

Did you contact blockchain.info's support?


Thanks for the reply.

Yes, I used strong passphrase but only single password...  Sad
I contacted the support but haven't got response yet, I assume that they can do nothing about that.

You may have a key logger.
newbie
Activity: 15
Merit: 0
July 07, 2013, 11:19:11 AM
#7
I am interested in the change address.  Did they really clean you out but leave 0.0015629 in change on one of your addresses?

Is this one of your addresses?   https://blockchain.info/address/1GhrHe13nFhAHMJ5UZLJJN1uaGHF6n4hN8

I agree the change is weird, it is not my address.
newbie
Activity: 15
Merit: 0
July 07, 2013, 11:17:54 AM
#6
Second, can anyone help me understand what happened? I used blockchain.info both on my computer and my Android smartphone.
Do you have a strong passphrase?

Did you contact blockchain.info's support?


Thanks for the reply.

Yes, I used strong passphrase but only single password...  Sad
I contacted the support but haven't got response yet, I assume that they can do nothing about that.
legendary
Activity: 2646
Merit: 1137
All paid signature campaigns should be banned.
July 07, 2013, 11:01:53 AM
#5
legendary
Activity: 2646
Merit: 1137
All paid signature campaigns should be banned.
July 07, 2013, 11:00:33 AM
#4
I am interested in the change address.  Did they really clean you out but leave 0.0015629 in change on one of your addresses?

Is this one of your addresses?   https://blockchain.info/address/1GhrHe13nFhAHMJ5UZLJJN1uaGHF6n4hN8
hero member
Activity: 630
Merit: 500
Bitgoblin
July 07, 2013, 10:45:29 AM
#3
Second, can anyone help me understand what happened? I used blockchain.info both on my computer and my Android smartphone.
Do you have a strong passphrase?

Did you contact blockchain.info's support?
Pages:
Jump to: