Trojan Goes After Bitcoins 344
Orome1 writes "Bitcoin has definitely caught the attention of criminals. Even though it has been calculated that the use of botnets for Bitcoin mining is still not quite as lucrative as renting them out for other purposes, targeting people who have them in their digital wallets is quite another matter. Symantec researchers have spotted in the wild a Trojan dedicated to this specific purpose. Named Infostealer.Coinbit, it searches for the Bitcoin wallet.dat file on the infected computer and sends it to the criminal(s)."
mugging (Score:5, Insightful)
Re:mugging (Score:5, Funny)
Re: (Score:2)
so ? (Score:2)
Re: (Score:2)
how is it any different in real life ?
It's not, if you're stupid enough to keep all your cash under your bed in an area known for burglaries.
Re: (Score:3)
Re: (Score:2)
thats a credit card. a credit card is not money. in real life, if your money is stolen, it is stolen.
In real life, if your money is money (as in paper currency) you need a safe in order to consider it, well, safe. Otherwise, yes, its pointless to think that bitcoin is any less secure than having cash around. But hmm, we did think up some "alternative" to requiring anyone who wishes to participate in the currency economy to obtain and store paper currency... If only I could remember what it was...
Re: (Score:3)
You mean those institutions that take your money and then reinvest it to make money for themselves - occasionally causing an economic collapse that decreasing the value of your money drastically? They also happen to keep a pretty handy record of every transaction so that governments can see what you've been up to with your money...
Yeah, I can't see why anyone might be searching for an alternative form of currency.
Re: (Score:2)
Re: (Score:3)
In real life, the vast, vast majority of my money is stored in bank or building society accounts. If my money is stolen from those (i.e., a bank robbery) the bank is legally obliged to repay me. If the bank goes bust and can't repay me, the government has promised to pay me back (up to £85k per institution).
The amount of money that I keep in physical, stealable cash form is usually only a working amount (£10 or £20), and only very rarely and very briefly more than that.
Your BitCoin "wallet
Re: (Score:2)
Re: (Score:2)
people halfway across the world can't steal my paper cash money electronically through my computer just because I went to a dodgy website with an insecure web browser
is it. how do you think the identity thefts are conducted, leave aside your cash disappearing through cayman islands via an unauthorized wire ... fool. dont wander too much around online. you dont know shit about security.
Re: (Score:2)
That's if you have a card. Bitcoins wallets are like cash, not cards.
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
An offline computer is secure from a hacking perspective, but could still get stolen in the old-fashioned sense (a burglary). Even if the burglar doesn't know what he's stolen, your wallet file will still be gone. A house fire or similar would have much the same effect (good luck getting your insurance company to pay up for "I had £50,000 worth of virtual BitCoins stored on that computer!").
The best way would be to keep your wallet file on an offline storage medium (burn it to some CDs) and put it in
Re: (Score:2)
Re: (Score:2)
I can if I devalue it to the point of uselessness! Muahahahahahah
Yours in deflation,
Kilgore T Krugerrand
Re: (Score:2)
Agreed. Seems pretty obvious that the file should actually be comprised of two parts where one is kept on a removable storage device and the other can be on your local machine(s). That wouldn't be "THE Answer" but it it would be better than this.
I think that a lot of these types of problems will emerge and Bitcoin will be redesigned and rebooted.
Re: (Score:3)
Re: (Score:2)
Any currency works like that...
If someone grabs your cash then they have all your money with traditional currency too.
You need to take the same precautions with bitcoin too.
Re: (Score:2)
As opposed to "If someone grabs this single wallet out of my pocket then they have all my money". Sure, PINs and the like, but still the situation is similar.
Re: (Score:2)
Re: (Score:3)
Something a would-be thief would likely not even recognize as being able to store a high-virtual-value item such as a bitcoin wallet. Consider it the equivalent of stashing your money in a cookie jar.
Re: (Score:2)
You can put it on a floppy
It's not 1993 you knowI, thought they'd stopped even making floppy disks?
Re:mugging (Score:4, Insightful)
No kidding. I always thought that the actual money file was encrypted, and could have an arbitrary name. You know, like a truecrypt volume file. Then I find out it's by default a text file hanging out on your computer. Fine and dandy if you have 100% control over your computer at all times, but we all know that's never the case. And judging by the passwords people use, it will be easy to brute force most passwords.
Somehow, I think bitcoin is going to flame out in a rash of digital thievery when criminals realize that it is easier to steal someone's bitcoin file than it is to mine it or even look for credit card info.
Re: (Score:2)
You could encrypt the wallet, but with what? A password? Offline encryption is too cheap. A key file? But then if you keep that key file in the machine, you gain nothing.
There's no really effective security that the bitcoin program could apply; you need to copy the wallet off the machine.
Re: (Score:2)
Re:mugging (Score:5, Insightful)
Bitcoins may well be worthless, but they are in no respect a Ponzi scheme. Ponzi schemes have to grow geometrically to continue in existence, which is why they quickly get destroyed after a few iterations. Bitcoins in circulation, on the other hand, grow at an increasingly slow pace. Similarly, Ponzi schemes have a 'promoter'.
The whole purpose of the bitcoin ecosystem is that it is something electronically transferrable (anonymously), yet fundamentally limited in its number.
Now: they could easily be a complete fraud - with the number of bitcoins in circulation being far more than claimed. However, if the claims for the limitation of their number in circulation are true, then they could easily become a store of value, in that any fiat currency (or indeed gold itself), has value because choose to believe it.
Or to put it another way: if people wish to assign bitcoins value, they can. Likewise, they can choose not to.
Re:mugging (Score:4, Insightful)
Re: (Score:2)
No: you don't get it.
A Ponzi scheme involves earlier investors being paid by later investors.
The whole point of bitcoins is that their number is mathematically limited. They may - or may not - have value depending on whether people attribute value to them. Their number increases, but slowly (the very opposite of a Ponzi scheme).
In a Ponzi scheme, a central promoter tells people their investment is worth x. On the contrary, with Bitcoins, the only value they have is what someone else will pay for them. And t
Re: (Score:2)
Isn't every monetary system a pyramid scheme in that respect?
Re: (Score:2)
Not really. With inflation, it's kind of the reverse.
Anyone who has had a pile of USD for the long term will find that they are worth less and less every year, while someone who is earning fresh dollars in any given year (say, is paid a yearly salary) will find the value of this salary remains relatively constant over time. Thus the scheme that is regular currency benefits "new entrants" (new earners of money) over "early adopters" (people who earned money in the past, and are now living off their accumulat
Re: (Score:3)
Clearly Bitcoin is not a pyramid scheme. Nobody is promising anybody payments, and certainly not payments for signing anybody else into the scheme. Also, there is nowhere to sign up. There is no
Re: (Score:3)
Ponzi schemes have one, and only one, defining characteristic, of which many people seem to take great delight in proving their ignorance:
Generation-M investors receive their "profits" directly from the investment of Generation-M+n. Simple as that, nothing more and nothing less. All the other attributes of a Ponzi scheme (geometric
Re: (Score:2)
Hell, if they had the foresight to capture that calculation in the original legislation, rather than citing a specific retirement age, we would never have had this problem at all.
Re:mugging (Score:4, Interesting)
I don't think Bitcoin is a ponzi scheme [wikipedia.org]. It's not really an investment scheme at all. It's closer to a pyramid scheme [wikipedia.org] or possibly a just a simple con. After all, the more people "mining" Bitcoins, the less productive mining Bitcoins becomes. The early investors got Bitcoins faster and cheaper and as demand rises they can sell their Bitcoins that cost less to make for the same amount as the later, harder to make Bitcoins.
Re: (Score:3)
Re: (Score:3)
It's clearly not a ponzi scheme and it's also clearly not a pyramid scheme.
The those in early benefit is standard in essentially everything. Those in early also lose the most when whatever the thing is doesn't "take off".
The people first at an area with a lot of gold in the ground get easy pickings sitting on the surface. Those in later have to spend money digging mile deep holes in the ground to get at the remaining gold.
And of the course the entire point of bitcoins isn't the "mining" it's using them as a
Re: (Score:3)
If you imagine the bit coins being created mostly at the top of pyramid and being sold down to the new people at the bottom, you should be able to see how it could be viewed as a pyramid scheme. If the top of the pyramid only sells coins to people lower on the pyramid than themselves, eventually you'd end up with a big base of suckers left with worthless tokens while the early adopters walk away with bags of cash.
I'm not saying it's actually a pyramid scheme, because I think some of the early adopters beli
Re: (Score:2)
I haven't been following it that closely, the Time To Lulz is just not suitable for spectating. I'd chalk that up to people having a ZOMG I can actually do something with this pseudo currency reaction. It's probably the only sane reaction I've seen to Bitcoins, if you buy some, to spend, then you're not likely to get burned. Assuming you don't go stupid and stalk up on them for the long term.
Re: (Score:3)
I, for one, was totally stunned by that. WTF were they thinking? If the rest of Botcoin is as security-minded as this then it's sunk before it even goes anywhere.
Re: (Score:3)
If someone has access to your user session then encrypting your wallet it is only going to make the attackers life slightly harder since you will need to supply the software with a password to decrypt it at some point.
There isn't really any good soloution to this other than moving the wallet completely off the machine that is running an insecure general purpose OS onto a limited function device.
Re: (Score:2)
You can put your wallet.dat on a flash drive, lock it in a safe, and still be able to send money to it. The network keeps track of the values. The wallet is your key to access the bitcoins.
Re: (Score:2)
If someone has access to your user session then encrypting your wallet it is only going to make the attackers life slightly harder since you will need to supply the software with a password to decrypt it at some point.
Encryption protects the data as it resides on disk so unless the trojan is keylogging and captures the exact moment you enter a password (which you may only do once in a blue moon) it has nothing to work with. That increases the chances you'll detect the trojan before it can steal any data. Encryption also protects you from drivebys, e.g. a web browser exploit that allows someone to lift a file off your disk.
Of course crypto may not protect from someone who owns your machine and has the time to log keystr
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Yeah, it's simple. All you need is perfectly designed and implemented software and hardware, and perfect users who never let their guard down. Or leave it disconnected from the network (including sneakernet) at all times.
Another visitor! (Score:2, Informative)
Can we stop the Bitcoin stories already?
Re:Another visitor! (Score:5, Insightful)
As much as the Bitcoin stories are getting a little much we are seeing the birth of something completely new; A medium of exchange that is independent of any government. The criminal/socially unacceptable elements are legitimizing the currency by applying value. Anything that enough humans apply value to will become valuable. The primary value of gold is that many people ascribe value to it and wish to possess it. If you buy gold on the markets you pay a storage fee because there are not enough commercial applications of gold to make storage profitable. Silver, platinum, copper... They all pay a bit if you buy contracts. The only purpose of gold then is to provide a medium of exchange.
Bitcoin is something similar in that a very large group of people are beginning to value the electronic currency, thus it has value. The context of the source of that valuation has no consequence. Humans are now using it as a medium of exchange which is now creating demand. That demand is causing a rise in price and others now wish to posses it as it has potential for increasing value. This is the basic form of speculation.
Now we have a socially illegitimate group applying the initial value and then speculators step in. Speculators are socially acceptable and so a balance is beginning to form. If this continues a stabilized economy will form and it will be unstoppable.
To wish that these stories be stopped is a bit shot sighted. We may be witnessing something that has *NEVER* happened before! It's quite exciting to watch something like this form, not to mention the insight into human behavior and the many benefits that can result for that insight. Not to mention a currency that is independent of any one government.
I do not see Bitcoins ever replacing government currency but I do see it becoming a supplemental tool for securing wealth and providing a medium of exchange detached from economically repressive governments. Any government that taxes represses it's people, the people accept that repression as a necessity to govern the society. Anyway, being able to purchase something without the government being in your business is a true expression of freedom and extends a way for true privacy to be exercised. This scares quite a few people in government and will be incredibly interesting to watch it play out.
As a side note, the VHS and Internet were "legitimized" by unsavory elements of society. And here we are discussing something in a way that 20 years ago was a dream and 80 years ago was unimagined, all because it was first a marginal "thing" exploited by unsavory elements in which a majority of the population expressed the desire to not be bothered. We live in exciting times and Bitcoin is the tip of something extremely interesting.
Re:Another visitor! (Score:5, Insightful)
I would mod you up if I could, as you've said just what I wanted to say.
BitCoin is technically interesting, dammit. I don't own any, and I don't think I want to. . . it does seem like a risky, unstable economy to me. But the very idea of it is brilliant, and the implementation details and implications of its existence are profoundly interesting to me. It fits the "New for Nerds, Stuff that Matters" theme far better than most of the other stories posted here.
Re: (Score:3)
I've considered putting $10 USD into just because it creates a vested interest. That interest sensitizes on a psychological level that no amount of intellectual interest can duplicate.
Re: (Score:2)
The criminal/socially unacceptable elements are legitimizing the currency by applying value
So some bored kid modifies a standard off the shelf virus to go specifically after a given file on your computer, that is in effect worthless ... it suddenly becomes worth something? You must be one of the morons who bought into Bitcoin. They aren't attacking so much to do something with your bitcoin, its more like mugging you and taking your wallet then throwing it away later. They are going after them just to go after them and cause trouble, NOT to use the crap that is unusable sense no one with half a
Re: (Score:2)
> So some bored kid modifies a standard off the shelf virus to go specifically after a given file on your computer, that is in effect worthless ...
I'm not referring to people stealing, please ref...
http://idle.slashdot.org/story/11/06/06/1410217/Bitcoin-Used-For-the-Narcotics-Trade [slashdot.org]
http://thehill.com/blogs/hillicon-valley/technology/164865-senators-tell-doj-to-shut-down-online-drug-market [thehill.com]
> The primary value of gold is its unique physical properties which are both visually pleasing to most people and ve
Re: (Score:2)
As a side note, the VHS and Internet were "legitimized" by unsavory elements of society.
Objection!!!
There is nothing "unsavory" about good porn!
Re: (Score:2)
Re: (Score:2)
As much as the Bitcoin stories are getting a little much we are seeing the birth of something completely new; A medium of exchange that is independent of any government.
Aside from, of course, barter.
Re: (Score:3)
Barter is not a medium of exchange. It is just exchange. Without the medium. That's what makes it barter.
Re: (Score:3)
Re: (Score:3)
Collectables are only desired by others with the same desire. Bitcoins are desired by anybody that desires something that can be purchased with Bitcoins. Your analogy is anemic.
A Picasso does not serve the same role, it is unique and there is only one. It's transfer is highly public and to keep it private there are extreme measures that must be taken. Also a Picasso would fall under the definition of barter, one item for another, rather than a medium of exchange. Again an anemic analogy.
As for nothing
And yet... (Score:2, Insightful)
Nothing of value was lost.
Re: (Score:2)
Re: (Score:2)
Is there any way to give them a poisoned wallet? (Score:2)
n/t
Re:Is there any way to give them a poisoned wallet (Score:5, Funny)
Yes.
A file within a file... (Score:5, Insightful)
But honestly, if you're using this system for any sort of money handling, then leaving it, the equivilent of lying around, is not a good idea. Secure your money properly, use common sense. Also I believe it's even on BitCoin's good practise list of recommendations. Encrypt your wallet and keep a backup elsewhere incase a nasty trojan erases it. Good data retention practise applies to everything.
Re: (Score:2)
Encryption! (Sorry, couldn't resist - and I know it's not) But honestly, if you're using this system for any sort of money handling, then leaving it, the equivilent of lying around, is not a good idea. Secure your money properly, use common sense. Also I believe it's even on BitCoin's good practise list of recommendations. Encrypt your wallet and keep a backup elsewhere incase a nasty trojan erases it. Good data retention practise applies to everything.
If Bitcoin knows it's good practice, then why can't it be implemented in software? The simple fact is if Apple did this or Microsoft or Google then people would (and do) shit on them from a great height. The problem here is the Bitcoin client used by the majority of users is insecure by default. It's making it easy for the bad guys to rip people off.
Re: (Score:2)
There's nothing Bitcoin can do. Encrypting with a password is useless (too cheap to crack), encrypting with a key file is useless if the key file is kept on the same machine.
The user has to copy the wallet off the machine, there's no magic bullet.
Re: (Score:2)
Re: (Score:2)
The bitcoin program has to have *some way* of finding the file. The trojan can use the same way.
Re: (Score:2)
What the client *should* do is what every fucking private-key-storing tool does: encrypt the god damned private keys with a secret key that the user must enter before the client can sign a transaction. But, of course, this is too brain-dead fucking obvious, apparently.
Too cheap to crack computationally, no security would be achieved and you've just annoyed the users by adding an extra step they can forget (and also lose all their bitcoins by forgetting their password)
Bad idea
Re: (Score:2)
Inisist on a decent/strong password. It's at least going to take some time to crack that way.
My offer stands (Score:2, Funny)
Re: (Score:2)
I will add eleventy bajillion pirate dinaarrgh dollars to that offer.
Re: (Score:2)
So? (Score:2)
Re: (Score:2)
Call me when the data has some actual value,
The value of anything is assigned by people themselves, nothing has inherent value. It will have value when people assign it to it, which many people already have apparently.
This is a problem with available solutions (Score:3)
So sad (Score:2)
what is money? (Score:2)
money is an abstract representation of a wealth of a society. as such, it needs integrity. this integrity is derived from transparency. without integrity or transparency, "money" loses meaning, and therefore value, because people lose confidence in a society's money: they don't want to invest meaning and value in it if they can't depend upon the idea that it is worthy to do so. and without integrity and transparency, there's no way to track or understand a currency's value. it's like wanting absolutely secu
Here's the Bitcoin Story... (Score:2)
Trojans are unsafe. (Score:2, Funny)
Trojan's in your wallets don't offer very much protection. Any sex ed teacher can tell you that.
Bitcoin Spam (Score:2)
Can we stop getting bitcoin spam. It is a stupid idea. :-) The value of a bit coin is no more or less a monetary system than is the value of baseball cards, sure, you can buy, sell, and trade them, but they are not actual currency and are not likely to be. In limited circles they make take on as a token, similar to chips
Seriously, for a monetary system to have value it has to be widely agreed upon. Bitcoins are nothing more than electronic wampum, eWampum or iWampum, if you will. (Those are my trademarks!
Re: (Score:3)
There's nothing behind the anti-bitcoin crowd, apart from the fact that we're smart enough to see what a colossal scam it is. Supposedly, it isn't anonymous, which makes it even less useful as that would make it unsuitable to replace bags of cash for criminal deeds.
You get bitcoins by doing the calculations which are required to use bitcoins, so, it's not based upon anything other than the belief that it's valuable. On top of that, the rate at which ones gets bitcoins slows as time goes by to a fixed amount
Re: (Score:2)
But how is it a scam, if that's all obvious? You can get all that by simply reading its FAQ. It specifically says they promise no profits, and that it'll be worthless if nobody accepts them.
Re: (Score:2)
You get bitcoins by doing the calculations which are required to use bitcoins, so, it's not based upon anything other than the belief that it's valuable.
Can you please explain how anything is _inherently_ valuable? all value is assigned by people themselves.
USDs are essentially just paper, but you're guaranteed to at least be able to pay your taxes with them, pay debt, or exchange them into whatever your local currency is via most banks.
And if those uses are for some reason not needed by you at all and yet bitcoins is, how is bitcoin less valuable?
Lesson of the day, there is no inherent value, all values are subjective.
Re: (Score:2)
Re: (Score:2)
It's up to the proponents of bitcoin to convince the rest of the public that your currency has value. Until you can do that, it IS worthless.
Not everyone needs to use bitcoin, so long as people that you wish to trade with value it, then how is it not valuable?
I could trade bitcoins for services i may require right now whereby bitcoin would be a far more convenient method of transfer of the funds. When multiple people you are interested in trading with all value it, how is it then of no value to you when you can acquire services you may need with it?
Re: (Score:2)
Governments have far more to lose from bitcoin
What do governments have to lose from Bitcoin? At the end of the day, no nation's currency is in jeopardy from Bitcoin, because:
Re: (Score:2)
Governments have far more to lose from bitcoin...
Governments who embrace and legitimise Bitcoin will gain economic growth due to Bitcoin's speedy transactions, reliable settlement, and low transaction cost.
Governments will need to make some adjustments, for sure, but they needn't fear Bitcoin.
Re: (Score:2)
"Governments have far more to lose from bitcoin"
Governments have nothing to lose from bitcoin. They could ban it and watch the value and transaction volume plummet in seconds as people drop off the network in droves.
And if you *liked* the vision of the future on snowcrash then you're pretty fucked up...
Re: (Score:2)
Re: (Score:2)
They will simply transfer the tax burden from transactions (sales tax) to incomes (income tax).
With bitcoins, how would a government know what your income is?
See the problem yet?
Re: (Score:2)
Once bitcoin is running, the trojan only needs to find the memory space the program is using to steal your wallet.dat info.
Well, you do need root access to read other programs' memory space, so it would make it more difficult.
The reason encryption would be useless is because offline password cracking is too cheap nowadays, specially if you have a beefy GPGPU system like any bitcoiner will.
Re: (Score:2)
Re: (Score:2)
I don't think encryption alone will help. It only protects you when your PC is not on or when bitcoin is not running. Once bitcoin is running, the trojan only needs to find the memory space the program is using to steal your wallet.dat info.
Not necessarily. Bitcoin by default might hold incoming transactions as plaintext in a receivables tray but transfer them to savings tray when the user enters a password. After 5 minutes the password is dropped and the old behaviour resumes. I expect for most people this means their exposure is reduced from 24/7 down to 5 minutes a week or similar. The wallet could still show them some meta info about their savings (e.g. transaction history & amounts) but it would protect the coins themselves.
The troj
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
How does this Infostealer.Coinbit trojan get on to the infected computer?
Well the easiest way would be to package it up as a bitcoin miner. People who install miners are by definition bitcoin users and greed could lower their guard enough that they would install the thing if it promised better performance than other miners. There are enough miner apps around with source code that the trojan could actually mine for a while before flipping into robbery mode. Miners also imply bitcoin is running in server mode where it has the potential to subvert the application even if its runni