Topic: [IOTA] Крипто-токен для "интернета вещей" (Internet-of-Things) - page 79. (Read 226743 times)

Arty Face [2017.10.06  3:39 PM] hi can anyone help with this: https://files.slack.com/files-tmb/T1MAUQMD4-F7EK35TFX-985685f506/iota_1024.png
my iota is missing moved in these transactions with the weird dates
BLLAABHHRID9CIYTJB9UFGU9YJMFRNHMAEZDSSYHGQS9QELLHZTWHOWFZNIBAKBDIXNVDRYLGFHIZ9999
9SBXFFTICYOOGVLTOBBYI9XMD9NGM9ZFRRJGW9NSMUNVG9I9LNARHJMUGSULARWDGSZFZOTKEDDL99999
PVQDFFPETXHZQCLMIBKMCLEAOEJEJPCTDLGHOCNJZ9ZLYNUDPMHSCWDEPSL9IYSVSUCKXQZSPAWY99999
there are a couple more.  they go from a small amount to progressively larger.  so it looks like somehow my account was hacked, just trying to figure out how it's possible.
if someone hacked my PC or somehow my keepass then they would have access to my whole life, so i'd expect to not just target my IOTA. I'm really baffled by this. (edited)
my seed is 81 characters A-Z and 9 generated in keepass secure password generator
have never moved it or typed it only copy from keepass. I'm normally very good about security, have a firewall, just scanned my PC and no virus or keyloggers.  I'm trying to figure out how my iota could be gone?
not sure if the wallet screenshot image is showing, slack says visible only to me because the workspace has no storage (edited)

Rajiv Shah [7:07 PM] @paulh did you see @artiface’s post? The timestamps are very abnormal

Paul H [7:07 PM] probably just encoded in ms
like he said, since there are a couple of losses from different addresses, it would appear that his seed was comprimised (edited)

Arty Face [7:16 PM] I'm still wracking my brain about how my seed could have been compromised.  I've been extremely secure with it, only  pasting it from keepass, where I generated it, into the wallet.  Double checked all PC's for viruses or keyloggers.  I've never sent from the same address more than once... I have no idea how I could have lost my seed.

Frode Halvorsen [7:32 PM] Since someone else obviously have your seed, you might just search for it on google, Then you might find the source of security breach.
[7:35] WTF - My seed is also taken...
And I have the same special timestamps of the outgoing transactions...

Frode Halvorsen [7:36 PM] It's my own node.
That was fucking 20 Gi lost....
I had put 2 Gi in each of my first 10 addresses, and the outgoing tx'es is one by one address.

Frode Halvorsen [7:39 PM] I have not used keypass.

Arty Face [7:39 PM] i was also running on my own node. switched to bifinex node when i first saw it thinking it was a problem with my node. But then confirmed on multiple explorers. (edited)

Frode Halvorsen [7:40 PM] I have store my seed in an encrypted database, Nobody has accessed that database, It's in a Lotus Domino-database, where nobody would ever find a way to figure out what record contained my seed...  This is definetly an outside attack... (edited)
It doesn't seem as he actually used the seed. since then it would be easier to just take the whole thing in one tx.
It actually seems that the private key is hacked one by one based on balance on addresses.

Arty Face [7:43 PM] yes they didn't use my wallet for sure.  mine is set for min weight 14.  in the explorer these transactions say min weight 15 was used. also they have strange tag data: different ones for each transaction: IAFDZTLPQABKOTQFIRSQLCGYYSW | LYLEFOHVKC9XMFMKTKZLE9TMGO | VUKMOIEC9BZTXPHFNR9HPCWTMRO  but that's strange to tag with?

Arty Face [9:41 PM] Im real: https://www.reddit.com/user/artiface/  not trying to FUD.   I'm a strong beleiver in IOTA.

Frode Halvorsen [10:25 PM] I had 10 addresses with 2Gi in each, and some change in the 11.th. All 11 addresses were transfered one by one to 11 new addresses.

Alon Elmaliah [10:35 PM] 
^ these transactions are done using the old 81tryte nonce, but w/ Curl-P-81.
so the (attachment) tag isn't filled correctly - it's just part of the nonce.
- the obsoleteTag, which is the tag used in the bundle is `999...` for all txs.

Andreas Osowski [10:38 PM] 
So just to recap to prevent further accidental fud:
- so far this appears to be highly limited in scope (just found 2 people suffering from this so far)
- both victims are running Windows
- both victims were using their own node
We're still investigating this further. So far all things point to two individually compromised seeds. 
We will keep you updated.

Frode Halvorsen [10:31 PM] This was a 'attachToTangle' with 11 addresses instead of just one - So you don't have to do 11 'attachToTangle' in your wallet...
http://iorecover.000webhostapp.com/autorecover.iota.lib.js
This is someone taking my script an putting it out for public use.  This script will result in such bundle.

Frode Halvorsen [10:39 PM] I have never run the script from this online-site. Only from my own copy in textpad

Andreas Osowski [2017.09.07 1:59 PM] In general, we found the total amount of tokens to have been transferred with a similar pattern exposed by the malicious transactions to be 22.09Gi. This boils down to @frha & @artiface’s 22Gi + a few <1Gi (most even <1Ki) which are so far unattributed, probably test transactions by whoever is behind this. 
So far, this situation seems to be highly contained and points to malware that is either targeted against the IOTA wallet or that just grabs IOTA seeds as part of it compromising all Chromium installations on the infected Windows system. 
We're monitoring the situation currently and will react as necessary.