Topic: Trojan Wallet stealer be careful - page 26. (Read 50290 times)
funny. in the same post warning about installing programs linked from the forums, he posts a link to a program.
If I understand this correclty the wallet.dat file needs to be kept in an encrypted volume, for example truecrypt. Can Anyone advise me and others as to how we should setup and operate the bitcoin with a TruCrypt encrypted volume?
Bitcoins are popular enough to have special viruses! That's good news at least.
i'm definetly gonna lookout for this shit
well this is some fucked up shit man 
Alright so I should create another bitcoin account seperate to my mining account, and encrypt that.
No need of trojans! There is way easier using broadcasting to locate victims!
No, even with encryption, if you are using windows, a trojan can steel your wallet after having read the password with a keylogger.
In comparison, right now you can just steal the wallet file from a mounted Truecrypt partition in 2 seconds and be done with it. Comparing that to needing a keylogger for a prolonged time to be able to decrypt the wallet in the first place... an always-encrypted wallet would be a VERY good idea.There's always the input-through-mouse PIN system.
No, even with encryption, if you are using windows, a trojan can steel your wallet after having read the password with a keylogger.
This is terrible
I would like for someone to respond to what is written here:
https://en.bitcoin.it/wiki/Talk:Securing_your_wallet#Flaws_with_argument_regarding_encryption
Because the way I see it bitcoin needs a way to encrypt a wallet file and read a wallet file that always remains encrypted. This is a fundamental flaw with the system. Don't you think its quite humorous that a system designed to transmit and verify funds which is built upon very advanced cryptography leaves the primary agent completely unencrypted. Think about this for a second. Bitcoin = cryptocurrency. Bitcoin Wallet = completely unencrypted. This makes no sense. I mean does this make sense to you? So all these people who praise Satoshi Nakamoto for his genius regarding using cryptography to allow for anonymous transactions of currency can't or won't take it upon themselves to create software that will encrypt and read an encrypted wallet. Why?
Maybe the inventors of bitcoin are the ones we need to be holding accountable for this problem. If bitcoin simply was able to read a wallet that was always encrypted none of us would be having this discussion. End of story.
https://en.bitcoin.it/wiki/Talk:Securing_your_wallet#Flaws_with_argument_regarding_encryption
Because the way I see it bitcoin needs a way to encrypt a wallet file and read a wallet file that always remains encrypted. This is a fundamental flaw with the system. Don't you think its quite humorous that a system designed to transmit and verify funds which is built upon very advanced cryptography leaves the primary agent completely unencrypted. Think about this for a second. Bitcoin = cryptocurrency. Bitcoin Wallet = completely unencrypted. This makes no sense. I mean does this make sense to you? So all these people who praise Satoshi Nakamoto for his genius regarding using cryptography to allow for anonymous transactions of currency can't or won't take it upon themselves to create software that will encrypt and read an encrypted wallet. Why?
Maybe the inventors of bitcoin are the ones we need to be holding accountable for this problem. If bitcoin simply was able to read a wallet that was always encrypted none of us would be having this discussion. End of story.
for windows users, I think the safer is to use services like mybitcoin.
To be safer, mybitcoin should implement otp like google (the otp app on iphone and android are cool, you can create several accounts)
On the other hand, if you use a web wallet you have to trust that they will adequately protect your funds whereas with a wallet on your own pc you can make it as secure as you want. To be safer, mybitcoin should implement otp like google (the otp app on iphone and android are cool, you can create several accounts)
for windows users, I think the safer is to use services like mybitcoin.
To be safer, mybitcoin should implement otp like google (the otp app on iphone and android are cool, you can create several accounts)
To be safer, mybitcoin should implement otp like google (the otp app on iphone and android are cool, you can create several accounts)
Installing and using Linux instead of Windows is a great first step to avoid getting hit by these trojans.
You can always use both with a double partition.
But i think we need to start looking at more solutions for windows if we want the BTC market to expand itself. Nice to see some security companies are forming because of this.
BTC success may depend on them.
In fact encryption is useless if you enter your password with your keyboard. If your computer gets compromised by a trojan it can read your password with a keylogger.
Not 100% secure does not equate to useless. In this case, the trojan checks for the wallet.dat file and sends it back to its server. If those infected with this specific trojan had encrypted their wallet.dat file, then it would be useless to the thief.
However, your point does stand that encrypting the wallet.dat file alone is not adequately secure. There are plenty of keyloggers in the wild. But it should be considered one of many steps taken toward security, rather than being the only one. Multi-layered security approaches are much stronger than taking just 1 decent step.
Quote from: kuloch
Part of the point of BitCoin is that everything is completely traceable. Check out blockexplorer.com. The "seller" does provide a uniquely identifiable piece of information with every transaction. That is your digital signature, which only the account's owner can create. However, the issue with wallet-stealing is that the private key used (in tandem with the public key or address) to create that digital signature is compromised, making the original account owner no longer the only account owner.
I wonder if it is possible to store my bitcoin private key on smart card.The private key is in your wallet.dat, so either just back up the entire wallet.dat or use a tool (they exist, I think I've read?) that extracts your public/private key pair(s). Worth noting is that if this practice becomes commonplace, trojans and such will start looking for this form of information, as well.
Thanks
Installing and using Linux instead of Windows is a great first step to avoid getting hit by these trojans.
thanks a lot for getting out something like this. Helps protect the people with less knowledge from evil, haha...
Possibly, but it needs a propagation method and a new C&C server or destination address since that's been blocked. Its an arms race I agree.
Keep your wallet encrypted and only decrypt for transactions, use TrueCrypt.
These stealers typically get run once (bound to a legit application) and then exit and never run again. They only need to steal your wallet once. So no C&C is involved.Keep your wallet encrypted and only decrypt for transactions, use TrueCrypt.
Yeah, he's thinking of a RAT.
Possibly, but it needs a propagation method and a new C&C server or destination address since that's been blocked. Its an arms race I agree.
Keep your wallet encrypted and only decrypt for transactions, use TrueCrypt.
These stealers typically get run once (bound to a legit application) and then exit and never run again. They only need to steal your wallet once. So no C&C is involved. Keep your wallet encrypted and only decrypt for transactions, use TrueCrypt.
Jump to: