Pages:
Author

Topic: Zeus trojan source leaked - bitcoin wallet stealing trojans coming soon (Read 4762 times)

legendary
Activity: 1764
Merit: 1002
What would be the most secure way to use bitcoin, or a way which is reasonably secure without becoming too inconvenient. 

A bitcoin bank.

creighto, i pay attention to everything u write b/c your thoughts are sound.  but how can u advocate a bitcoin bank it being a centralized big fat juicy target for the Feds?  ppl don't store their gold at banks but instead at home in the safe therefore the Feds can't/won't do anything about that.  but a bitcoin bank would be too irresistible for the banksters/gov't to raid.

Most people store their cash at banks, not at home.

It is simply a question of efficiency.  You can trade the risk of a centralized target for being able to pool funds, building a fortress far stronger than each person could themselves build individually.

And by volume, I'd wager the same is true for gold.  The more gold you have, more likely it is stored in a secured depository.


egold was a digital gold bank.  they got taken down.  why can't this happen to a bitcoin bank?   and please clarify what u mean by a fortress? 

He means that, like a bank vault is more cost effective security than 100+ home fire safes; a single bitcoin bank online secured by the skills of a cryptogeek and the latest and greatest hardened linux os is more cost effective security than those same users witheach running their own client that is continuously accessible to the Internet.

yes, but all the encryption security in the world won't stop the thugs from walking in the front door and taking the server away with a fork lift.

True, but you have to get to it first.  It's probably easier to do that in your own home than it would be to a bitcoin bank server, as I have seen how secure datacenters that specialize in ecommerce are.  Hacking from outside the network really is the weak link.

it depends on how determined a gov't wants to be
legendary
Activity: 1708
Merit: 1010
What would be the most secure way to use bitcoin, or a way which is reasonably secure without becoming too inconvenient. 

A bitcoin bank.

creighto, i pay attention to everything u write b/c your thoughts are sound.  but how can u advocate a bitcoin bank it being a centralized big fat juicy target for the Feds?  ppl don't store their gold at banks but instead at home in the safe therefore the Feds can't/won't do anything about that.  but a bitcoin bank would be too irresistible for the banksters/gov't to raid.

Most people store their cash at banks, not at home.

It is simply a question of efficiency.  You can trade the risk of a centralized target for being able to pool funds, building a fortress far stronger than each person could themselves build individually.

And by volume, I'd wager the same is true for gold.  The more gold you have, more likely it is stored in a secured depository.


egold was a digital gold bank.  they got taken down.  why can't this happen to a bitcoin bank?   and please clarify what u mean by a fortress? 

He means that, like a bank vault is more cost effective security than 100+ home fire safes; a single bitcoin bank online secured by the skills of a cryptogeek and the latest and greatest hardened linux os is more cost effective security than those same users witheach running their own client that is continuously accessible to the Internet.

yes, but all the encryption security in the world won't stop the thugs from walking in the front door and taking the server away with a fork lift.

True, but you have to get to it first.  It's probably easier to do that in your own home than it would be to a bitcoin bank server, as I have seen how secure datacenters that specialize in ecommerce are.  Hacking from outside the network really is the weak link.
legendary
Activity: 1764
Merit: 1002
What would be the most secure way to use bitcoin, or a way which is reasonably secure without becoming too inconvenient. 

A bitcoin bank.

creighto, i pay attention to everything u write b/c your thoughts are sound.  but how can u advocate a bitcoin bank it being a centralized big fat juicy target for the Feds?  ppl don't store their gold at banks but instead at home in the safe therefore the Feds can't/won't do anything about that.  but a bitcoin bank would be too irresistible for the banksters/gov't to raid.

Most people store their cash at banks, not at home.

It is simply a question of efficiency.  You can trade the risk of a centralized target for being able to pool funds, building a fortress far stronger than each person could themselves build individually.

And by volume, I'd wager the same is true for gold.  The more gold you have, more likely it is stored in a secured depository.


egold was a digital gold bank.  they got taken down.  why can't this happen to a bitcoin bank?   and please clarify what u mean by a fortress? 

He means that, like a bank vault is more cost effective security than 100+ home fire safes; a single bitcoin bank online secured by the skills of a cryptogeek and the latest and greatest hardened linux os is more cost effective security than those same users witheach running their own client that is continuously accessible to the Internet.

yes, but all the encryption security in the world won't stop the thugs from walking in the front door and taking the server away with a fork lift.
legendary
Activity: 1708
Merit: 1010
What would be the most secure way to use bitcoin, or a way which is reasonably secure without becoming too inconvenient. 

A bitcoin bank.

creighto, i pay attention to everything u write b/c your thoughts are sound.  but how can u advocate a bitcoin bank it being a centralized big fat juicy target for the Feds?  ppl don't store their gold at banks but instead at home in the safe therefore the Feds can't/won't do anything about that.  but a bitcoin bank would be too irresistible for the banksters/gov't to raid.

Most people store their cash at banks, not at home.

It is simply a question of efficiency.  You can trade the risk of a centralized target for being able to pool funds, building a fortress far stronger than each person could themselves build individually.

And by volume, I'd wager the same is true for gold.  The more gold you have, more likely it is stored in a secured depository.


egold was a digital gold bank.  they got taken down.  why can't this happen to a bitcoin bank?   and please clarify what u mean by a fortress? 

He means that, like a bank vault is more cost effective security than 100+ home fire safes; a single bitcoin bank online secured by the skills of a cryptogeek and the latest and greatest hardened linux os is more cost effective security than those same users witheach running their own client that is continuously accessible to the Internet.
legendary
Activity: 1764
Merit: 1002
What would be the most secure way to use bitcoin, or a way which is reasonably secure without becoming too inconvenient. 

A bitcoin bank.

creighto, i pay attention to everything u write b/c your thoughts are sound.  but how can u advocate a bitcoin bank it being a centralized big fat juicy target for the Feds?  ppl don't store their gold at banks but instead at home in the safe therefore the Feds can't/won't do anything about that.  but a bitcoin bank would be too irresistible for the banksters/gov't to raid.

Most people store their cash at banks, not at home.

It is simply a question of efficiency.  You can trade the risk of a centralized target for being able to pool funds, building a fortress far stronger than each person could themselves build individually.

And by volume, I'd wager the same is true for gold.  The more gold you have, more likely it is stored in a secured depository.


egold was a digital gold bank.  they got taken down.  why can't this happen to a bitcoin bank?   and please clarify what u mean by a fortress? 
legendary
Activity: 1708
Merit: 1010
What would be the most secure way to use bitcoin, or a way which is reasonably secure without becoming too inconvenient. 

A bitcoin bank.

creighto, i pay attention to everything u write b/c your thoughts are sound.  but how can u advocate a bitcoin bank it being a centralized big fat juicy target for the Feds?  ppl don't store their gold at banks but instead at home in the safe therefore the Feds can't/won't do anything about that.  but a bitcoin bank would be too irresistible for the banksters/gov't to raid.

Banks do exist for sound economic reasons.  Convience is a sound economic reason.  Mybitcoin.com is functionally a bitcoin bank.  I have no doubts that once the market matures and the value of a bitcoin stablizes, that Mybitcoin.com and all of it's competitors will offer bitcoin CD's and short term credit lending in bitcoin.  I might even use them for that purpose to a limited degree, but most of my bitcoin savings sits in an independent wallet.dat on a 128 meg thumbdrive locked in a firebox.  That's very secure, but it's damned inconvient.  Banks of all kinds thrive at the intersection of security and convience, and some people are going to use them.

But if the government attempts to co-opt them, users will withdraw their funds and/or move them to similar banks out of country.  It's not impossible for the US government to get to mybitcoin.com, but the fact that mybitcoin.com is based in a server in New Zealand does represent an obstacle.
member
Activity: 98
Merit: 13
What would be the most secure way to use bitcoin, or a way which is reasonably secure without becoming too inconvenient. 

A bitcoin bank.

creighto, i pay attention to everything u write b/c your thoughts are sound.  but how can u advocate a bitcoin bank it being a centralized big fat juicy target for the Feds?  ppl don't store their gold at banks but instead at home in the safe therefore the Feds can't/won't do anything about that.  but a bitcoin bank would be too irresistible for the banksters/gov't to raid.

Most people store their cash at banks, not at home.

It is simply a question of efficiency.  You can trade the risk of a centralized target for being able to pool funds, building a fortress far stronger than each person could themselves build individually.

And by volume, I'd wager the same is true for gold.  The more gold you have, more likely it is stored in a secured depository.
legendary
Activity: 1764
Merit: 1002
I have all my bitcoins tied up on servers, so I have no wallet.dat Tongue

i'll pass on that.  i want my coins with me Smiley
legendary
Activity: 1316
Merit: 1011
I have all my bitcoins tied up on servers, so I have no wallet.dat Tongue
legendary
Activity: 1764
Merit: 1002
I'm considering creating a "bitcoin" user on my machine, so that no troyan could read my wallet or send any bitcoins without knowing the bitcoin user's password.

Would that solve the troyan problem?

If you install programs as root, then they will be able to do anything. Even if you encrypt the home folder of your account, a program installed as root can do any keylogging it likes and will be able to see the decrypted files when you are using this user's account. The best solution would be to have an entirely separate computer dedicated to bitcoin on which you install only the basic software you need to run bitcoin, downloaded from trusted sources.
To protect against trojans which are not too sophisticated, running a VM seems like a reasonable solution. If the VM storage file is encrypted, that's even better. See truecrypt for that.

i use a Macbook pro with VMWare Fusion and Win 7.   my client is on the Win 7.  is this what u mean by a reasonable solution?
legendary
Activity: 1764
Merit: 1002
NEVER HAVE YOUR ETHERNET CABLE PLUGGED INTO YOUR COMPUTER

How are you supposed to download the block chain and use your coins without an internet connection?

I think so far the safest approach is the use of a savings account to most of your coins in a wallet you just access like once a year and even. Limits the possibility of exposure to wallet leaks by a lot. Of course it is also recommended to have a pen drive with a Linux live cd distro on it and the Bitcoin client installed. I wonder if an angry firewall blocking all outgoing communications but the Bitcoin port would help.


do u have to backup a savings wallet from time to time if ur not using it?  i would guess not but i'm so paranoid now i have to ask?

also do u know of a trusted USB version of the client?
legendary
Activity: 1764
Merit: 1002
What would be the most secure way to use bitcoin, or a way which is reasonably secure without becoming too inconvenient. 

A bitcoin bank.

creighto, i pay attention to everything u write b/c your thoughts are sound.  but how can u advocate a bitcoin bank it being a centralized big fat juicy target for the Feds?  ppl don't store their gold at banks but instead at home in the safe therefore the Feds can't/won't do anything about that.  but a bitcoin bank would be too irresistible for the banksters/gov't to raid.
legendary
Activity: 826
Merit: 1001
rippleFanatic
What would be the most secure way to use bitcoin, or a way which is reasonably secure without becoming too inconvenient.  

A bitcoin bank.


Do you mean a website as bitcoin bank?  In that case, all the thief needs is your bitcoin bank login and pw.  This wouldn't help, and could make it worse.

I prefer to think of the bitcoin P2P network as the bitcoin bank.  Any intermediaries would simply be centralized points of vulnerability.
newbie
Activity: 33
Merit: 0
I'm considering creating a "bitcoin" user on my machine, so that no troyan could read my wallet or send any bitcoins without knowing the bitcoin user's password.

Would that solve the troyan problem?

If you install programs as root, then they will be able to do anything. Even if you encrypt the home folder of your account, a program installed as root can do any keylogging it likes and will be able to see the decrypted files when you are using this user's account. The best solution would be to have an entirely separate computer dedicated to bitcoin on which you install only the basic software you need to run bitcoin, downloaded from trusted sources.
To protect against trojans which are not too sophisticated, running a VM seems like a reasonable solution. If the VM storage file is encrypted, that's even better. See truecrypt for that.
legendary
Activity: 1288
Merit: 1080
I'm considering creating a "bitcoin" user on my machine, so that no troyan could read my wallet or send any bitcoins without knowing the bitcoin user's password.

Would that solve the troyan problem?
legendary
Activity: 3766
Merit: 1364
Armory Developer
NEVER HAVE YOUR ETHERNET CABLE PLUGGED INTO YOUR COMPUTER

How are you supposed to download the block chain and use your coins without an internet connection?

I think so far the safest approach is the use of a savings account to most of your coins in a wallet you just access like once a year and even. Limits the possibility of exposure to wallet leaks by a lot. Of course it is also recommended to have a pen drive with a Linux live cd distro on it and the Bitcoin client installed. I wonder if an angry firewall blocking all outgoing communications but the Bitcoin port would help.
sr. member
Activity: 350
Merit: 251
Make a clean VM and install BC on it. make a new wallet and only use the on screen keyboard inside the VM. AFAIK viruses that infect VMs are still pretty rare. If your super paranoid, download the BC installer to a flash drive and install on a freshly formatted pc. make a new wallet and put it on the flash drive. write down the BC address. use DBAN to format your computer or use a new hard drive. NEVER HAVE YOUR ETHERNET CABLE PLUGGED INTO YOUR COMPUTER, or if making a new address requires it, only during when you need it. NEVER plug the usb key into your computer unless you are making an outgoing transaction.
full member
Activity: 145
Merit: 100
Using a clean virtual machine in e.g. VirtualBox is also probably a good idea, but it still seems that a trojan on the host OS would be able to keylog anything typed into the virtual machine.

If you can't trust the OS, you can't trust anything above it.  For large amounts, use a separate specialized device.  People are already working on bitcoin smartcards and whatnot.  People will figure it out.
member
Activity: 98
Merit: 13
What would be the most secure way to use bitcoin, or a way which is reasonably secure without becoming too inconvenient.  

A bitcoin bank.

Such a bank could be made more profitable and sustainable, if holds only a fraction of its reserve.  Use the majority of the reserve for investing in risky ventures that provide high returns to your clients.

legendary
Activity: 980
Merit: 1020
Pages:
Jump to: