3 ms·

It's interesting seeing all these novel ways of stealing cryptocurrency. So far we have seen Twitter scams where people impersonate high profile accounts in the

It's interesting seeing all these novel ways of stealing cryptocurrency. So far we have seen Twitter scams where people impersonate high profile accounts in the hope people will think it's a real cryptocurrency giveaway and actually send funds to various wallets. Then there is the cryptominer/cryptojacking technique where the unused CPU power of personal computers is used to mine various cryptocurrency (often stealthily run in the background and the user is unaware they are mining cryptocurrency). Then there was that recent story of the so called 'cryptocurrency bandit' who scraped wallet addresses and then broke into the wallets which were encrypted with a weak password. If anyone on here knows of other novel techniques (aside from what I mentioned and the SIM-swapping method); then I would love to hear the methods.

greenleafjacob 7y ago
People have programs that scan github uploads for AWS, etc credentials accidentally uploaded by victim and spawn images that mind crypto for the attacker’s. https://www.theregister.co.uk/2015/01/06/dev_blunder_shows_github_crawling_with_keyslurping_bots/ https://www.theregister.co.uk/2015/01/06/dev_blunder_shows_g...
- xenospn 7y ago
  Wow. I’m always amazed at the lengths people will go to to abuse anything and everything.
joecool1029 7y ago
You forgot about cracking ipmi hashes, this has been an incredibly popular way to steal wallets off servers.
TokyoKid 7y ago
Any attack vector that would otherwise be foiled by a bank is a vulnerability in the case of Bitcoin. It has no consumer protections, like chargebacks or other fraud protections (lost or stolen "cards" or PIN-codes/passwords). There is no automatic or manual review of large transactions built into Bitcoin, which large bank transactions undergo to prevent theft. Bitcoin has exactly one security measure: that it's mathematically very unlikely that someone will guess or generate the same private key as you (IF you don't use one of the many faulty ways of generating your own key, which are widespread online). From there, the sky is the limit. You can hack someone's computer or server using whatever vulnerability you wish and steal their private key. You can physically gain access to a computer or simply use violence to demand someone's keys. You can offer a product or service, receive payment, and then simply never deliver the product or a refund. Or someone can seem to pay, you give them a product in return, but the transactions are later unconfirmed after they're long gone. Some of these things are possible with regular banking, but in nearly all cases funds can be recovered or reimbursed to the account holder. Bitcoin was not made with these protections in mind whatsoever. And the high-level platforms, even after more than half a decade, have failed to secure themselves or their customers consistently. They are often hacked and resort to going into hiding or creating complex ICOs, IEOs, "haircuts" or other trickery to cover up losses.

greenleafjacob 7y ago

People have programs that scan github uploads for AWS, etc credentials accidentally uploaded by victim and spawn images that mind crypto for the attacker’s. https://www.theregister.co.uk/2015/01/06/dev_blunder_shows_github_crawling_with_keyslurping_bots/ https://www.theregister.co.uk/2015/01/06/dev_blunder_shows_g...

xenospn 7y ago
Wow. I’m always amazed at the lengths people will go to to abuse anything and everything.

joecool1029 7y ago

You forgot about cracking ipmi hashes, this has been an incredibly popular way to steal wallets off servers.

TokyoKid 7y ago

Any attack vector that would otherwise be foiled by a bank is a vulnerability in the case of Bitcoin. It has no consumer protections, like chargebacks or other fraud protections (lost or stolen "cards" or PIN-codes/passwords). There is no automatic or manual review of large transactions built into Bitcoin, which large bank transactions undergo to prevent theft. Bitcoin has exactly one security measure: that it's mathematically very unlikely that someone will guess or generate the same private key as you (IF you don't use one of the many faulty ways of generating your own key, which are widespread online). From there, the sky is the limit. You can hack someone's computer or server using whatever vulnerability you wish and steal their private key. You can physically gain access to a computer or simply use violence to demand someone's keys. You can offer a product or service, receive payment, and then simply never deliver the product or a refund. Or someone can seem to pay, you give them a product in return, but the transactions are later unconfirmed after they're long gone. Some of these things are possible with regular banking, but in nearly all cases funds can be recovered or reimbursed to the account holder. Bitcoin was not made with these protections in mind whatsoever. And the high-level platforms, even after more than half a decade, have failed to secure themselves or their customers consistently. They are often hacked and resort to going into hiding or creating complex ICOs, IEOs, "haircuts" or other trickery to cover up losses.