3 ms·

If Bitcoin wallets would be designed properly they would ask for a second confirmation before sending 100k USD. This may be the main thing to fix here, as it's

by rvnx 1y ago

If Bitcoin wallets would be designed properly they would ask for a second confirmation before sending 100k USD. This may be the main thing to fix here, as it's very plausible that hacks happen again and again... by design. Today it's an infected printer, tomorrow it will be a game on Steam.

alpaca128 1y ago
Steam already had a game with an infostealer a while ago. A pirate game. But something like that would only be surprising if it was more than an obvious lazy asset flip.
cm2187 1y ago
The malware doesn’t send all the content of the wallet to itself, it just replaces the recipient address in the clipboard (so you wouldn’t notice unless you checked the address). The 100k I think are cumulatively, though if it is 9btc, it’s more like 1m.
cjbprime 1y ago
Then the malware would provide that confirmation to the wallet too. Defending yourself from malware running on the same (Windows) machine is mostly impossible.
- xnickb 1y ago
  That's a much harder attack to pull off. Windows actually does a decent job at preventing this kind of thing from being easily achievable. Clipboard attacks are far easier, as most modern systems treat clipboard as a non-critical resource. Which is mind blowing if you ask me. An app reading from clipboard must ring all sorts of alarms. Let alone writing to it.
  - gruez 1y ago
    >An app reading from clipboard must ring all sorts of alarms. Let alone writing to it. You realize any sort of content editing app is going to be reading from clipboard? Most apps used on a daily basis are going to be reading from clipboard.
    - xnickb 1y ago
      Ok let me clarify: - An app running in the background listening to clipboard changes; - An app without a focused/visible window reading clipboard; - An app reading from clipboard without a corresponding user input (menu/hotkey) All these should be detectable and controlled by the OS
codetrotter 1y ago
That kind of confirmation does exist, it’s called using a hardware wallet, such as those made by Trezor and others. https://trezor.io/ https://trezor.io/ The bigger question is, when they said: > G Data's research showed that the Bitcoin address linked to SnipVex had received about 9.3 BTC, roughly $100,000 How big was the largest amount stolen? It could be a few individuals with a lot of money in their unprotected software wallets, or it could be a lot of people with relatively smaller amounts stolen from each of them. If you only have a couple hundred dollars worth of bitcoin and don’t intend to buy any more of it then it doesn’t make much sense to spend as much on a hardware wallet as those cost. But if you have like $500 of bitcoin then it starts to make more sense. Especially if you plan on buying more of it. And if you have over a $1,000 and are still using a software wallet you should really look into getting a hardware wallet ASAP IMHO.
johnisgood 1y ago
This should be relatively easy to implement.
latexr 1y ago
> This may be the main thing to fix here It’s not, because that wasn’t the problem and would not have worked. For one, nothing indicates the $100K were extracted in one go, it looks like it was cumulative. For another, this malware isn’t directly sending coins, it’s just replacing addresses in your clipboard.
- xnorswap 1y ago
  Right, but the confirmation prompt could say something like, "You're sending $100k to L33tHaX0R, are you sure?" But that would require the protocol to also have the ability to set friendly names against public addresses. You could imagine a wallet that uses certificates for address validation. So a certificate owner could sign that they own a given public key. ( And sign with the public key to show they own that key too. ) Then that could go into a "verified recipients" section of the wallet, and you could set your wallet to only allow sending to verified recipients. ( Or only allow transactions over X to verified ).
  - jagged-chisel 1y ago
    I don’t see how this prevents malware from changing the destination just before the transaction heads out. If it can change addresses, then it can change them at any point in the process, even after human verification.
    - xnorswap 1y ago
      It doesn't stop specialized malware, but it stops clipjacking. Security isn't an absolute. You're not trying to stop all vectors, you're just trying to put up a barrier to trip up by far the most common and easy method. In a world where everyone leaves their doors open all day, you're asking "Why shut and lock your door when an attacker could just smash your windows?"
      - tough 1y ago
        on crypto you have also posioning address attacks (so using your clipboard to paste an addy is already a bad idea)
gruez 1y ago
>If Bitcoin wallets would be designed properly they would ask for a second confirmation before sending 100k USD. They already do? Here's a random screenshot I found: https://user-images.githubusercontent.com/4597798/33999728-35f377dc-e126-11e7-8379-21a1b0364864.png https://user-images.githubusercontent.com/4597798/33999728-3... the details are blacked out, but you can make out that it shows the address label along with the full addresse

by rvnx 1y ago

alpaca128 1y ago

Steam already had a game with an infostealer a while ago. A pirate game. But something like that would only be surprising if it was more than an obvious lazy asset flip.

cm2187 1y ago

The malware doesn’t send all the content of the wallet to itself, it just replaces the recipient address in the clipboard (so you wouldn’t notice unless you checked the address). The 100k I think are cumulatively, though if it is 9btc, it’s more like 1m.

cjbprime 1y ago

Then the malware would provide that confirmation to the wallet too. Defending yourself from malware running on the same (Windows) machine is mostly impossible.

xnickb 1y ago
That's a much harder attack to pull off. Windows actually does a decent job at preventing this kind of thing from being easily achievable. Clipboard attacks are far easier, as most modern systems treat clipboard as a non-critical resource. Which is mind blowing if you ask me. An app reading from clipboard must ring all sorts of alarms. Let alone writing to it.
- gruez 1y ago
  >An app reading from clipboard must ring all sorts of alarms. Let alone writing to it. You realize any sort of content editing app is going to be reading from clipboard? Most apps used on a daily basis are going to be reading from clipboard.
  - xnickb 1y ago
    Ok let me clarify: - An app running in the background listening to clipboard changes; - An app without a focused/visible window reading clipboard; - An app reading from clipboard without a corresponding user input (menu/hotkey) All these should be detectable and controlled by the OS

codetrotter 1y ago

That kind of confirmation does exist, it’s called using a hardware wallet, such as those made by Trezor and others. https://trezor.io/ https://trezor.io/ The bigger question is, when they said: > G Data's research showed that the Bitcoin address linked to SnipVex had received about 9.3 BTC, roughly $100,000 How big was the largest amount stolen? It could be a few individuals with a lot of money in their unprotected software wallets, or it could be a lot of people with relatively smaller amounts stolen from each of them. If you only have a couple hundred dollars worth of bitcoin and don’t intend to buy any more of it then it doesn’t make much sense to spend as much on a hardware wallet as those cost. But if you have like $500 of bitcoin then it starts to make more sense. Especially if you plan on buying more of it. And if you have over a $1,000 and are still using a software wallet you should really look into getting a hardware wallet ASAP IMHO.

johnisgood 1y ago

This should be relatively easy to implement.

latexr 1y ago

> This may be the main thing to fix here It’s not, because that wasn’t the problem and would not have worked. For one, nothing indicates the $100K were extracted in one go, it looks like it was cumulative. For another, this malware isn’t directly sending coins, it’s just replacing addresses in your clipboard.

xnorswap 1y ago
Right, but the confirmation prompt could say something like, "You're sending $100k to L33tHaX0R, are you sure?" But that would require the protocol to also have the ability to set friendly names against public addresses. You could imagine a wallet that uses certificates for address validation. So a certificate owner could sign that they own a given public key. ( And sign with the public key to show they own that key too. ) Then that could go into a "verified recipients" section of the wallet, and you could set your wallet to only allow sending to verified recipients. ( Or only allow transactions over X to verified ).
- jagged-chisel 1y ago
  I don’t see how this prevents malware from changing the destination just before the transaction heads out. If it can change addresses, then it can change them at any point in the process, even after human verification.
  - xnorswap 1y ago
    It doesn't stop specialized malware, but it stops clipjacking. Security isn't an absolute. You're not trying to stop all vectors, you're just trying to put up a barrier to trip up by far the most common and easy method. In a world where everyone leaves their doors open all day, you're asking "Why shut and lock your door when an attacker could just smash your windows?"
    - tough 1y ago
      on crypto you have also posioning address attacks (so using your clipboard to paste an addy is already a bad idea)

gruez 1y ago

>If Bitcoin wallets would be designed properly they would ask for a second confirmation before sending 100k USD. They already do? Here's a random screenshot I found: https://user-images.githubusercontent.com/4597798/33999728-35f377dc-e126-11e7-8379-21a1b0364864.png https://user-images.githubusercontent.com/4597798/33999728-3... the details are blacked out, but you can make out that it shows the address label along with the full addresse