Bitcoin Forum>Other>Meta
Author

Topic: This account has been compromised. (Read 2066 times)

binaryFate
legendary
Activity: 1512
Merit: 1012
Still wild and free
This account has been compromised.
June 18, 2013, 03:36:11 AM
#12
Quote from: ssbtoday on June 16, 2013, 01:05:40 AM
There was a post on March 29th with an address of 19wAGPypBu61s28k1hRx5nF6EZMTfMiF5b with my name on it. I will send any moderator bitcoins from that address to prove my identity

You could just cryptographically signe a message with that address to prove ownership, no need to send coins of yours!
bitcoin-qt has this option, it's easy to use.
ct1aic
hero member
Activity: 714
Merit: 500
Are ฿itcoins Radioactive?
Re: This account has been compromised.
June 17, 2013, 06:49:42 AM
#11
Quote from: bitspill on June 17, 2013, 12:06:38 AM
Quote from: ct1aic on June 16, 2013, 03:14:20 AM
I don't know if Bitcoinplus.com and the site Browsermine.com are related (the IP is not the same), as the text of the page is the same, including a syntax error: 'transfered' instead 'transferred'.
Browserminer.com is someone saving the html from bitcoinplus.com and rehosting it with their own java applet being loaded

Located near the top of the page source is a comment inserted stating it was saved from bitcoinplus.com and all of the links throughout the page link back to bitcoinplus.

Yep... I forgot to see page source of www.browserminer.com scammer site...

Code:


All links point to the original site, except the pishing java script and a iframe:

Code:


bitspill
legendary
Activity: 2088
Merit: 1015
Re: This account has been compromised.
June 17, 2013, 12:06:38 AM
#10
Quote from: ct1aic on June 16, 2013, 03:14:20 AM
I don't know if Bitcoinplus.com and the site Browsermine.com are related (the IP is not the same), as the text of the page is the same, including a syntax error: 'transfered' instead 'transferred'.
Browserminer.com is someone saving the html from bitcoinplus.com and rehosting it with their own java applet being loaded

Located near the top of the page source is a comment inserted stating it was saved from bitcoinplus.com and all of the links throughout the page link back to bitcoinplus.
ct1aic
hero member
Activity: 714
Merit: 500
Are ฿itcoins Radioactive?
Re: This account has been compromised.
June 16, 2013, 03:14:20 AM
#9
Quote from: 🏰 TradeFortress 🏰 on June 16, 2013, 02:33:26 AM
And Bitcoinplus is the scam site that gives you an error when you try to cash out.

I don't know if Bitcoinplus.com and the site Browsermine.com are related (the IP is not the same), as the text of the page is the same, including a syntax error: 'transfered' instead 'transferred'.

Quote
Bitcoin Generation

New: you can generate bitcoin for a friend.

You must have Java installed to use the bitcoin generator.
If your browser asks you to run the applet, or to install Java, say yes.
Waiting for Java applet to load...
If it does not start (refresh "F5") and press run again!
Step 1: Click "Start Generating"
Step 2: Wait while your computer works (leave this page open)
Step 3: Earn bitcoin

It's that easy. Want the explanation? Read how bitcoin works, but click "Start Generating" first so you'll earn bitcoin while you read.

New: The bitcoin miner for websites is available.

You are not logged in. You can start generating now and your coins will be transfered to your account when you sign up. If you close your browser your coins may be lost.
Already have an account? Log in.

Last 21 May, several seconds after I authorized the run of the Java @ www dot browserminer dot com, something posted 2 messages in the 2 Bitcoin Forums I was logged in, this forum and also Butterflylabs forum, with a 21 seconds interval. The only diference between the 2 messages was the link, as the first one was in error (browerminer.com instead browserminer.com). I received a auto-ban in this forum and a ban for life in BFL one. I could gain access to both, appealing to the bans, a week later.

As a security measure, I replaced the password in both (and others) sites, but I think the exploit only sent the spam messages, nothing more. But we never know...


The message of SPAM:
Code:
http://www.browserminer.com
Mine BTC from your browser! Very cool tool. As long as you have your browser open it will mine BTC.
Let me know how you like it

Thanks  :)

BTCBTCBTC
🏰 TradeFortress 🏰
vip
Activity: 1316
Merit: 1043
👻
Re: This account has been compromised.
June 16, 2013, 02:33:26 AM
#8
And Bitcoinplus is the scam site that gives you an error when you try to cash out.
ssbtoday
full member
Activity: 122
Merit: 100
Re: This account has been compromised.
June 16, 2013, 02:31:20 AM
#7
Now that I think of it... I used Bitcoinplus for the shortest duration before in the end of may... .-.
ct1aic
hero member
Activity: 714
Merit: 500
Are ฿itcoins Radioactive?
Re: This account has been compromised.
June 16, 2013, 02:27:54 AM
#6
Quote from: theymos on June 16, 2013, 02:16:54 AM
An account-stealing Java exploit has been going around lately. You might have run into this, though I'm not sure whether this exploit allows the attacker to change your account settings.

My account was also hacked in first days after registering in this (and another) forum, as I also run a java of a page that invited us to "mine BTC online"! What a naive I was... But I could recover the account and replace the password.
theymos
administrator
Activity: 5222
Merit: 13032
Re: This account has been compromised.
June 16, 2013, 02:16:54 AM
#5
An account-stealing Java exploit has been going around lately. You might have run into this, though I'm not sure whether this exploit allows the attacker to change your account settings.
ssbtoday
full member
Activity: 122
Merit: 100
Re: This account has been compromised.
June 16, 2013, 02:09:21 AM
#4
Theymos, the email I have setup now is the one I use daily, it is protected with two factor auth, so if the hacker somehow got in, they must have bruteforced or somehow got the password other ways. I have a copy of every single email on that email forwarded to a second account which has an even longer password then the first and is also two factor auth'd.

And to answer your question, yes it is under my control to the best of my understanding. (Not sure if old sessions still exist)
theymos
administrator
Activity: 5222
Merit: 13032
Re: This account has been compromised.
June 16, 2013, 02:03:22 AM
#3
Is it under your control now? Your email address is currently the same as it was before.
BadBear
legendary
Activity: 1652
Merit: 1128
Re: This account has been compromised.
June 16, 2013, 01:51:03 AM
#2
I moved the threads you mentioned to archival until it gets sorted out. You need to contact theymos, he's the only one who can help you.
ssbtoday
full member
Activity: 122
Merit: 100
Re: This account has been compromised.
June 16, 2013, 01:05:40 AM
#1
There has been several posts originating from my account "ssbtoday" since June 4th. Please report them to the moderators as they were NOT me. I barely logged in to find these 'scammy' posts with atrocious English and it is rather annoying. Help please.

Proof I am the original owner of the account:
There was a post on March 29th with an address of 19wAGPypBu61s28k1hRx5nF6EZMTfMiF5b with my name on it. I will send any moderator bitcoins from that address to prove my identity, as that has been my bitcointalk address since the creation of this account.

More information:
Apparently by checking google, the e-mail on this account (which was changed) now has an e-mail that does not exist. I even checked Google's forgotten password and it clearly states it's not an account, how could someone have changed the e-mail on my account without even sending me an e-mail? This is outrageous!

Bitcoin Forum>Other>Meta
Jump to: