Topic: Used a bot, easy password, etc for Just-Dice use Google Authentic! Compromised~! (Read 10055 times)

It's for when you leave your laptop unattended in a cafe with Just-Dice open ^^

Please explain why enabling 2FA on withdraw is added security?

If someone just has username and password and 2FA is enabled on logging in they wouldn't be able to login in the first place to make the withdraw.

I was one of the compromised accounts. Already PM'ed dooglus about it.
In case it helps anybody, I used the same user/pass combo (that has now been changed) also for weexchange, cex.io and thebitcoincompany.co.uk

Thanks Douglas and the community at Just-Dice for donating the stolen bitcoins took from players

"Google Authentic"

-_-

So he was.  Sorry for misunderstanding.

He was talking about Casinobit  

I have only reimbursed 3 of the 16 accounts that lost funds so far.  I have blocked access to the others, and am waiting for their owners to contact me and demonstrate that they have secured their accounts before refunding them.

I expect most of them were old forgotten accounts with what their owners considered 'dust' in them.

JD uses URLs as a login until you set up and username and password.  Once you've done that, the URL no longer works.

Thanks will be coming with article soon, Douglas thanks for the hard work on analyzing actions from the perpetrator hopefully we have more info on this later on. Clearly they used an anonymous program but I show a potential IP out of London that might have been responsible. 

Did not read that anyone got reimbursed. Anyway, his website use an URL as login so he can't have collected any user/pass.

Here is mine, support included
https://github.com/KgBC/just-dice-bot

Is running as python cli application, which I consider as much more stable than running in a browser window (especially thru tor).
Always download it from the original source above, so noone could compromise code.
Have Fun gambling

This is what a java driveby looks like: http://www.xylibox.com/2012/07/sparkyjava.html

It will only be able to download and run malware if you allow it, which doesn't really make it an "exploit".

Oh, in case I wasn't clear, those are accounts the hacker DID access.  Most of them either had no funds or were protected by 2FA.  'Only' 16 of them had funds that the hacker was able to withdraw.

Dooglus said it best on the other JD thread:

In short, this is not JD's fault.

I also appreciate how open you've been about which accounts the hacker tried to access.

I know you're new to Bitcoin gaming, but requiring users to register an email address typically doesn't fly.

I can't be sure.  It's possible that some of the usernames and passwords were collected using a keylogger on compromised users' computers.

Someone claiming to be the hacker was in the JD chat talking about their "java driveby", which I imagine is some kind of exploit.  Disable the java plugin in your browser if you have it installed.

Seems the sites fault...  the site should of had a type of 2 factor authentication on the withdraw system compulsary. like enter an emailed pin or what ever.  And a system that blocks users who login mulitiple wrong accounts, and also alerts the site admins something dodgie is going on.

Until thats implemented it will keep happening.

so just to confirm -- this is just because people recycled usernames and passwords right?

Thanks for all the donations.  A total of 2.40995525 BTC was received so far (not including the guy who paid one of the victims back in full privately).  That's enough to pay all but the biggest three back in full.  If I give the biggest 3 the same as the 4th, then it totals 2.696 BTC.  I'll make up the difference:

0.00018560 0.00069031 0.00930999 0.00990000 0.01006117 0.01137880 0.01773303 0.02915000 [0.04515912] 0.04542498 0.04976687 0.08471695 0.60705816 0.60705816 0.60705816 0.60705816

I will refund the victims as soon as they reclaim their accounts and enable 2FA.  I don't want the attacker withdrawing the refunds too!

I condone this message.

Two words...

Password Manager

Personally I use lastpass.com and have used roboform in the past but there are many more out there. You just need to remember one very secure master password then the rest you let the PW Manager handle it for you.

I have no idea what my password is for just-dice, or this forum without looking at my password vault! None are the same, all unique, and all very long with letters, numbers and symbols in them.

I PM'ed one user who I saw had been compromised by the attacker.  He replied:


So there's datapoint 1.

Anyone else?

You may be wondering "was my account compromised?"  Well, here's a list of compromised userids:

   983
  2018
  2436
  2828
  3095
  3258
  3481
  4259
  6700
  8509
  8606
  8660
  8815
  9825
  9895
 10167
 11303
 12326
 12732
 34054
 34490
 36411
 38924
 43386
 44554
 46462
 48038
 48131
 48640
 48781
 56101
 57228
 58436
 61376
 64827
 67755
 69701
 69908
 70295
 71528
 74347
 78524
 79308
 79539
 80125
 83971
 84543
 84943
 94532
 98378
103149
103388
105449
107711
112714
115375
116667
119688
120272
121724
122727
127888
134617
135093
136202
148465
157053
157854
181501
182131

If one of these is yours, please tell me where else you used your JD password.

Good Idea and with some reasonable problem solving we can probably find the source of this.  

Did Casinobit recently "find" some bitcoins? if I recall some of the investors was recently paid "need source". So I guess we need to ask other victims, what bitcoin gambling companies have you joined and eliminate one by one?

That seems to be the one that would have worked in this instance.

Someone had a list of usernames and passwords from a different site and tried them on Just-Dice.

Most of the usernames they tried didn't even exist on Just-Dice, but some did, and some of those use the same password as on the hacked site.

Some of those ones with the same username and password also had 2FA disabled, or had it enabled, but not required to withdraw.

Those are the people who lost coins.

The lesson here is twofold:

1) don't reuse passwords

2) do use 2FA when available

I'm sorry for people's losses.  It's an expensive way to learn about password security.  

Incidentally, I would be very interested to learn which site the list of usernames and passwords was hacked from.  If your account was compromised and you only used the same account details on a few other sites, please list those other sites here so we can see if a pattern emerges.

I've checked the logs.  It appears that the amounts stolen were (in size order):

0.00018560, 0.00069031, 0.00930999, 0.00990000, 0.01006117, 0.01137880, 0.01773303, 0.02915000, 0.04515912, 0.04542498, 0.04976687, 0.08471695, 0.60705816, 0.88197790, 3.87314367, 60.07364941

Total: 65.74930596 BTC.  The stolen coins were sent to 1GtAri6QDusZVFPtCBufA7ti6R34BxRwBB (14 transactions) and 1sCaMzrzY6sCaRMUY9WjM35QnwHYLyBEd (2 transactions).

If anyone would like to donate to make the victims whole, I set up address 1GbDrpVNGxC8CxfZrYMPVPZ2KNwvcXEHT7 for donations.  Anything sent there will go to the 16 who lost funds.

If you paid for this bot, then really theres nothin to say, greed kills all...

http://dalanmao.net/

What bot did you use, who was this user, and how did he scam you?
Was the bot set up to cash out the bitcoins to the scammer?

I'm sure some other site just logs in with same info. I used xAuth on a MC server to steal accounts, it's really easy

From the man himself:

https://bitcointalksearch.org/topic/seuntjies-dicebot-multi-site-multi-strategy-betting-bot-for-dice-with-charts-307425
This is probably the most advanced bot currently available. I've not really used it or looked through the code myself yet, since I'm not too interested in the gambling part of JD at the moment.

When I made the bottab script available the feedback was pretty positive. (and I didn't scam anyone)
It's just that I moved on to other things. I'm sure some people would be happy to see it working again. But I would really need a reason to put more time and effort into it.

I will start the list off
https://github.com/CriticalNix/just-dice.com

Very simple javascript bot.

Could you provide us a list of "known bots" for the website Rannasha? Also we are currently looking for a seasoned veteran coder to review such bots to insure safety and security for players.

There are already open-source bots available.

Well maybe I'll get some pledges this time for making a bot that won't steal anyones cash... Any interest in this?

Yeah he got into my account as well, I had google authenticator set for withdraw and when he couldn't withdraw he said that he gambled my balance untill it hit 0 (eight coins). He admitted this in chat and he also revealed others password so i definately know it was him. Ive never used a bot before. Would be nice to get the 8 coins back considering they were never withdrawn from the site.

Could someone PM me with the link he posted to abuse the exploit? I'd like to take a look. Or is it in that chat log and I'm not seeing it?

Edit: There was no link? Does anyone have more information about the mechanism he used to get passwords?

[edit] the address he posted. http://blockchain.info/address/1GtAri6QDusZVFPtCBufA7ti6R34BxRwBB

- Clear your desktop,
- Enable 2FA everywhere,
- Install & use Keepass2 (or alike) with a strong & clean main password, and use different login/pass for each sites,
- Use keepass's keeotp plugin to store 2FA keys in the database,
- Use a plugin or ftp to save the database in a remote place,
- Use ChromeIPass (or alike) to access username/pass stored in Keepass database from your browser,
- Last but not least be responsible and think of what you do.

Chat History

It's been confirmed one of the players has never used a bot so the usage of a bot is out of the question. Password list ?

The 2FA available there does not protect against locally installed programs, here are some examples of how it fails to do so:

1) You decided to enable 2FA after installing an untrusted program, then it just captures the key for generating 2FA codes;

2) You enabled 2FA earlier, but stored the key unprotected somewhere in your computer;

3) You enabled 2FA earlier, stored the key safely, but when you request a withdraw the program can alter the address in the process.

The solution involves not installing these programs. White-listing addresses helps too.

You should use 2FA on any account with money / any account that you can't afford to lose.

Even with good security practices, there's still a chance of being hit with a 0-day exploit. Yes, 2FA is a bit of an added hassle, but losing your coins is more annoying.

I would suggest if you are able to, turn on two factor authentication. As an added precaution move your funds to a safe machine (another laptop/computer or mobile phone).

Why do you think changing passwords will solve the issue ? Since you obviously don't have the code of this bot, it could have installed a couple of things to handle that. Basic stuff people: http://technet.microsoft.com/en-us/library/dd632947.aspx, https://en.wikipedia.org/wiki/Keystroke_logging#Software-based_keyloggers, and lastly http://www.computerhope.com/issues/ch001045.htm. The easiest thing you can do now is wipe out that windows.

I thought bitcoin users would be a bit smarter about that, everyone calls everything a scam still you download and run a closed-source bot ?

I can also verify this. Change your passwords if you have used a bot.

Myself included just minutes ago lost entire just-dice balances by some clown in the chat room stealing players bitcoin balances. I think there should be a requirement made on all withdraws. Payouts should have to be sent to same deposit address on file. Maybe Doug will consider such a suggestion if feasible. Some folks have logged in and reporting 60+ bitcoin losses! Bad day for the industry for sure