Pages:
Author

Topic: Trojan Wallet stealer be careful (Read 25869 times)

newbie
Activity: 21
Merit: 0
September 20, 2011, 09:47:52 AM
#96
Vladimir's inference was that this 'solving' the issue at the client level would be giving a false sense of security, which is the worst of all worlds.

An age-old fallacy. Anything that helps, helps.

Do you not install locks and burglar alarms because they aren't 100 % proof?
Should we not install airbags in cars even though they don't guarantee survival?
etc etc
I could come up with hundreds of examples.

Having wallet.dat encrypted is just the last wall of defence, which could potentially give its owner enough time to realize his computer has been compromised, and allow him to move the coins to a safe wallet. The private keys really only need to be unencrypted when payments are made, so the attack surface is reduced by much more than most people probably realize. It also requires the thief to target Bitcoin specifically, pretty much eliminating opportunity-made-thieves, and reducing the risk from random break-ins.

It's also somewhat easy to implement.

No, it's not 100 % hacker-proof, but to have any usability wallet.dat needs to be available relatively easily. All the suggestions of having an extra computer not routed to the internet, or booting from a thumbdrive, just to make the occasional online payment are laughable. Make those kinds of requirements, and Bitcoin is guaranteed to not take off, ever.
+1
full member
Activity: 196
Merit: 100
August 31, 2011, 07:52:54 PM
#95
Linux is no magic bullet when it comes to security. I've seen so many compromised Linux boxes with hacked sshd, apache, bind, and running python scripts it's not even funny. The tools a typical Linux box offers to hacker is just ridiculous compared with your typical Windows box.

This isn't true at all, yes Linux can be unsecure, but overall a Linux (desktop) box is much more secure than Windows due to obscurity.
Most attacks directed at Linux are directed at server software that shouldn't be running on your machine open to the internet.
Overall most desktop attack vectors are pointed at Windows since it is the most widely used desktop OS compared to the 1% who currently use Linux.
newbie
Activity: 21
Merit: 0
August 27, 2011, 06:50:48 AM
#94
   
Trojan Wallet
full member
Activity: 140
Merit: 100
BitVapes.com
August 21, 2011, 02:41:34 AM
#93
I think the best solution will be storing wallet and using Bitcoin client on virtual machine with Linux as guest OS and encrypted home directory. Just install VirtualBox, download Ubuntu, and when installing enable home dir encryption.

a trojan could still infect your windows host machine, keylog your decryption password when you boot the linux virtual machine and download the virtual hard drive image so the attacker can steal the wallet.dat from it
legendary
Activity: 1582
Merit: 1002
July 28, 2011, 04:38:00 PM
#92
I think the best solution will be storing wallet and using Bitcoin client on virtual machine with Linux as guest OS and encrypted home directory. Just install VirtualBox, download Ubuntu, and when installing enable home dir encryption.
hero member
Activity: 530
Merit: 500
July 13, 2011, 04:19:13 PM
#91
i have my wallet.dat on a usb key in my desk drawer at home.

The usb key has a fingerprint reader on it. when i want to access my wallet,

1.  I insert key, authenticate with my middle finger Wink
2.  copy my wallet to bitcoin dir,
3.  start bitcoin... recieve/send,
4.  close down bitcoin,
5.  recopy to a new dir ( date/time labeled ) on usb drive,
6.  remove key, place in drawer.

So thumb in the eye for linux nerds... i can do it too cos im a PC Tongue lol

So you're copying an unencrypted wallet to an online Windows box.

Wouldn't a trojan just have to wait for the file to be copied and then steal it?
Yes and thats where people are mistaken right now.
To use (send) Bitcoins you need to be connected to the web.
And it will take only a split millisecond for a trojan to execute stuff on your pc.
So unless your Chuck Norris an can click super fast your solution is not 100% trojan proof.
Nice try though with the fancy finger print reader. Cool
legendary
Activity: 2940
Merit: 1333
July 12, 2011, 12:10:02 AM
#90
i have my wallet.dat on a usb key in my desk drawer at home.

The usb key has a fingerprint reader on it. when i want to access my wallet,

1.  I insert key, authenticate with my middle finger Wink
2.  copy my wallet to bitcoin dir,
3.  start bitcoin... recieve/send,
4.  close down bitcoin,
5.  recopy to a new dir ( date/time labeled ) on usb drive,
6.  remove key, place in drawer.

So thumb in the eye for linux nerds... i can do it too cos im a PC Tongue lol

So you're copying an unencrypted wallet to an online Windows box.

Wouldn't a trojan just have to wait for the file to be copied and then steal it?
hero member
Activity: 560
Merit: 500
July 11, 2011, 06:34:05 PM
#89
[edited]
legendary
Activity: 2940
Merit: 1333
July 11, 2011, 04:44:34 AM
#88
I'd like to be able to rename my wallet.dat to some other file, and the client asks for the file on startup.

Something like this will do it for you on Linux:

Code:
#!/bin/bash

cd
wallet=~/.bitcoin/wallet.dat

if [[ -e "$wallet" ]]
then
    echo "real wallet file $wallet already exists; giving up"
    exit 1
fi

echo -n "which file is your wallet hidden as? "
read hidden

if [[ ! -e "$hidden" ]]
then
    echo "hidden wallet file $hidden doesn't exist"
    exit 1
fi

echo "moving hidden wallet to $wallet"
mv -i "$hidden" "$wallet"

sleep 1

echo "starting bitcoin"
bitcoin "$@"

sleep 1

echo "moving $wallet back to secret location"
mv -i "$wallet" "$hidden"

Save to a file, add a line to the end of .bashrc saying:
Code:
alias bitcoin="/path/to/script-file"

Start a new terminal, type 'bitcoin', and it should use the script instead of the regular client.
newbie
Activity: 15
Merit: 0
July 10, 2011, 04:33:18 PM
#87
I'd like to be able to rename my wallet.dat to some other file, and the client asks for the file on startup.

+1
legendary
Activity: 1876
Merit: 1000
July 09, 2011, 01:17:18 AM
#86
Well that means BTC is a hit. at least now it is getting attacked like normal banks.

These have been my thoughts too.   bitcoins must be valuable if so many are trying to steal them....
legendary
Activity: 1937
Merit: 1001
July 06, 2011, 04:21:59 PM
#85
New scam software found on youtube, please flag as such

http://www.youtube.com/watch?v=l9UvUyT5i5s

DO NOT USE THIS PROGRAM!
jr. member
Activity: 56
Merit: 1
June 28, 2011, 05:33:33 PM
#84
Linux is no magic bullet when it comes to security. I've seen so many compromised Linux boxes with hacked sshd, apache, bind, and running python scripts it's not even funny. The tools a typical Linux box offers to hacker is just ridiculous compared with your typical Windows box.

The typical Linux box gets hacked through misconfiguration of third party software. The difference with Windows is that the 'typical' Linux box is a server, not a desktop, so it will run network facing services and lots of times will be administered according to the 'what bushfire needs to be extinguished next' principle since security is usually subordinate to other considerations in a corporate setting (mainly deadlines), even if the admins know what they are doing.

That doesn't mean Linux is less safe than Windows (I would argue the opposite), it just has different attack vectors. I agree that Linux offers a lot more tools compared to Windows Smiley
member
Activity: 70
Merit: 10
June 28, 2011, 03:18:00 AM
#83
Linux is no magic bullet when it comes to security. I've seen so many compromised Linux boxes with hacked sshd, apache, bind, and running python scripts it's not even funny. The tools a typical Linux box offers to hacker is just ridiculous compared with your typical Windows box.
sr. member
Activity: 313
Merit: 258
June 27, 2011, 03:13:48 AM
#82
Use Linux, and take additional steps for added security.

Windows is insecure by default, to many viruses available, and not one antivirus is 100% perfect, they all have a margin of failure were new viruses go undetected.

There are also viruses for Linux but it is very rare, and Linux out of the box is more secure.

What everyone should do is run Linux, Debian (Ubuntu), Fedora, Mandrivia, etc.

And for those of you that have a lot of bitcoins encrypt and backup the wallet.
pgp, gpg, and best crypt, true crypt are all good choices.

True crypt is best for usb, or portable disks.
pgp or gpg are good for encrypting the wallet directly.
or in you want something transparent with best crypt you can configure an account to automatically mount an encrypted file system, once the file system is mounted it is no longer encrypted until you log out, so best crypt works best using a separate account that you log in, and as soon as you are done log out, once you log out the filesystem is unmounted, and it is an encrypted folder representing the filesystem.

The only problem is that if you are expecting a payment you can not have the wallet encrypted with the current version of the bitcoin client, therefore what you can you is use 2 accounts, one that keeps the wallet encrypted and you backit up, and the other that you use for receiving or making payments, after  that wallet reaches certain amount of money make a transfer to the wallet you keep encrypted, and then backup the wallet in encrypted form somewhere else.

That way you have 2 wallets, once for pocket change, like the wallet you carry in your pocket un encrypted, and the other wallet that has all the cash encrypted and backed up.

Also when using encryption use a secure algorithm, there are many that are very secure, and others are very easily broken.

Also when it comes to encryption always use an open source package.
There is an old saying that security by obscurity is snake oil, so rely on open source for your security.

Another reason for using encryption if your computer is stolen, with either windows or Linux it is possible to log on the system once the thief has physical access to your machine, however if the wallet is encrypted there is nothing the thief can do other than a brute force attack, and if you used a secure password with a good algorithm it is nearly impossible for the thief to gain access to the data in your wallet.
newbie
Activity: 24
Merit: 0
June 27, 2011, 02:06:59 AM
#81
Don't forget offsite backups in case your house burns down or gets carried away to Oz by a tornado.
full member
Activity: 184
Merit: 100
June 26, 2011, 05:08:15 PM
#80
i have my wallet.dat on a usb key in my desk drawer at home.

The usb key has a fingerprint reader on it. when i want to access my wallet,


1.  I insert key, authenticate with my middle finger Wink
2.  copy my wallet to bitcoin dir,
3.  start bitcoin... recieve/send,
4.  close down bitcoin,
5.  recopy to a new dir ( date/time labeled ) on usb drive,
6.  remove key, place in drawer.


oh, and im behind two sets of firewall, have two AV types running in harmony, and have bitlocked by disk.
I also backup my key files to a tape drive with with a strong password for accessing and restoring if needs be.

I run windows Smiley no way in hell anyone if gonna break through those layers to get my file.

So thumb in the eye for linux nerds... i can do it too cos im a PC Tongue lol


LOL @ middle finger ... seriously why does it always have to be the MIDDLE FINGER ? Cheesy
full member
Activity: 208
Merit: 100
Risk-hedging platform for cryptocurrency investors
sr. member
Activity: 434
Merit: 252
youtube.com/ericfontainejazz now accepts bitcoin
June 22, 2011, 08:58:14 PM
#78
Bitcoin developers, please, please, please do create encrypted wallet functionality, so that I can run bitcoin on my malware infested windows computer while enjoying false sense of security.



+1.  Agreed.  This should be default.
jr. member
Activity: 56
Merit: 1
June 22, 2011, 07:21:18 PM
#77
3) Can you copy the blockchain from a "used" potentially infected computer to implement in new installation without infecting the new installation too?

Strictly speaking you can't assume so. Practically, it depends on what attacks are possible against the transfer medium and the blockchain itself. For example your OS might prescan inserted USB sticks and contain vulnerabilities in this code (this is a known attack vector), regardless of any autoplay settings. The blockchain could be doctored to include buffer overflow initiated code (the client could contain parsing bugs, I bet this has not been vetted yet). The blockchain could even be replaced by something like a specially crafted PDF file with attack code in it. There was a nice Adobe bug where when you installed the suite it would add a PDF parsing service to Windows which had a buffer overflow vulnerability. In a default setup Windows is set to periodically scan for new files for its indexing service. When the indexer comes across a PDF file, the Adobe service would be called to parse it, boom, infected. So just having the file on the system, without opening it, would infect it.

A similar exploit was possible on the Amiga, in ancient times (Kickstart 1.2) when the OS detected a filesystem problem it would automatically invoke the checkdisk program (pretty advanced for the time), but would try to load it from amongst others the floppy. Floppies were autodetected, so if you inserted one with a purposefully corrupted filesystem, and put your own doctored checkdisk program on there it would autoexecute. This in light that bootsector viruses already existed but were only executed when booting from them.
Pages:
Jump to: