4 ms·

Bitcoin trail, Google cookies and Uber Eats orders help tie man to Steam malware

46 points by rzk 3mo ago

Cider9986 3mo ago
Criminals should have used Monero. Victims should have not keep crypto on desktops. They are much less secure than Mobile.
- fsflover 3mo ago
  > Victims should have not keep crypto on desktops. They are much less secure than Mobile. Unless it's Qubes OS.
  - Cider9986 3mo ago
    True. How viable is steam on Qubes?
    - handedness 3mo ago
      It's doable if you have a suitable GPU to pass through to a Steam Qube, but it's still far from simple or even viable for most users, e.g., https://forum.qubes-os.org/t/step-by-step-nvidia-gpu-passthrough-for-cuda-vulkan-compute-applications/36813/8 https://forum.qubes-os.org/t/step-by-step-nvidia-gpu-passthr...
- LoganDark 3mo ago
  Modern macOS devices have a secure element just as good as iOS devices. Almost nobody makes use of it, though. (I haven't seen anything yet that uses the secure element to control access to a wallet. Are there any technical obstacles to keeping the keys out of main memory?)
zuzululu 3mo ago
He was smart/determined enough to risk it all. Why didn't he just try find a job that pays $200k/year ? Why play into the stereotypes ?
- fhdkweig 3mo ago
  > He was smart/determined enough to risk it all. Desperate people are willing to risk it all, and usually smart people aren't desperate.
- r_lee 3mo ago
  > didn't he just try find a job that pays $200k/year ? you really think it's that easy?
  - choilive 3mo ago
    Claude get me a job that pays $200k/yr. Make no mistakes.
    - pfych 3mo ago
      Claude get me a job that pays $200k/yr. Make a breakthrough.
  - zuzululu 3mo ago
    If you expect it to be easy like a handout then thats the wrong attitude because then everybody would be doing it so already this points to lack of context and self awareness. If you are getting paid $200k/year, you have to be willing to see it from the other side of the table, what are you offering really? It's also not as hard or dire as you think it is but without knowing more about your situation or what you tried, its pointless because I suspect that its going to just turn into a moping session. I am working on 3 remote jobs that pay over 200k/year, it takes time and effort, and yes it was relatively easy for me but not in the way that you think it should be.
- idiotsecant 3mo ago
  Yeah, clearly risking it all wasn't the smart play here, as evidenced by the fact he got caught. A lot of people are willing to tolerate risk, that hardly makes them useful. Frequently the opposite.
- deleted 3mo ago
  [deleted]
LoganDark 3mo ago
I heard Monero can help against blockchain analysis (though less so if you buy from adversaries). Unfortunately it looks like blockchain analysis was not the attack vector here, but rather buying gift cards through an incompetent intermediary.
- HDBaseT 3mo ago
  Not really an "incompetent intermediary", Bitrefill, the company used for buying gift cards with Bitcoin received legal requests to identify the user. Bitrefill doesn't proclaim insane privacy protections, they are based out of Sweden but aren't immune to being requested to provide the information. Monero could of helped, although its not easy to transfer BTC to Monero without P2P trades, as effectively every exchange requires KYC. Those source and destination wallet addresses are tainted, you wouldn't be able to deposit on any mainstream exchange and if they do, its for a honey pot purpose.
  - LoganDark 3mo ago
    Making it possible to identify a user is incompetence, exactly because of legal issues like this. You don't run a service that accepts crypto for gift cards and then keep information on file that identifies the buyer personally, that's just stupid. But then again, you don't illegally obtain crypto and then give out your info when you go to use the illegal funds, that's just stupid as well. Is P2P that big a deal? I swap coins on Bisq all the time. It's super easy to pick up and use if you already have the BTC. The biggest obstacle is obtaining some BTC in the first place when you don't have any yet. Once you have enough for the security deposit, you can buy/sell or swap thousands of dollars in funds at a time.
  - Cider9986 3mo ago
    >Monero could of helped, although its not easy to transfer BTC to Monero without P2P It's really not hard but it probably gets much harder to transfer tainted Bitcoin. Trocador.app aggregates various no-KYC CEX swaps and is regarded well in the Monero community. As we can see from the various Monero pumps, which often stemmed from cleaning coins. Thieves don't want to sit on the Bitcoin so they drive up the price of Monero selling it fast. Yeah P2P is more technical. Hopefully with Serai we can get a good UX decentralized exchange. Swapping into fiat is a different beast.
drnick1 3mo ago
This underscores a major issue with commercial software like Steam and games obtained therein. You cannot trust that software not to maliciously scan your device for secrets such as crypto wallets or other information. Ideally, you want to run apps like Steam, Discord, Zoom and whatever else does not come from a trusted distribution repo as a separate user. This is not always convenient however, and the compromise I adopted on my gaming PC is to bubblewrap Steam. Do not mount things like /home and devices games should not be using in the sandbox.
- kibwen 3mo ago
  This is what my Steam Deck is for. There's no gap like air gap.
  - drnick1 3mo ago
    Dedicated hardware is definitely the most secure option, but realistically it is even less convenient than a separate user. You can't realistically play graphically intensive games on a Deck, and separate workstations are very unaffordable at the moment.
- techjamie 3mo ago
  In theory you could change the steam command line fpr each game and have them launch in bubblewrap. Though I'm not sure how well that would play with graphics drivers. It might be friendly with AMD, but my experience is that NVIDIA is a pain to have play nice with containers.
  - drnick1 3mo ago
    I sandbox Steam itself for simplicity. My experience with Nvidia and Wayland has been good. I simply exposed /dev/nvidia*, a few networking-related files in /etc and system binaries like /usr.
    - jallasprit 3mo ago
      How are you doing the sandboxing?

46 points by rzk 3mo ago

Criminals should have used Monero. Victims should have not keep crypto on desktops. They are much less secure than Mobile.

fsflover 3mo ago
> Victims should have not keep crypto on desktops. They are much less secure than Mobile. Unless it's Qubes OS.
- Cider9986 3mo ago
  True. How viable is steam on Qubes?
  - handedness 3mo ago
    It's doable if you have a suitable GPU to pass through to a Steam Qube, but it's still far from simple or even viable for most users, e.g., https://forum.qubes-os.org/t/step-by-step-nvidia-gpu-passthrough-for-cuda-vulkan-compute-applications/36813/8 https://forum.qubes-os.org/t/step-by-step-nvidia-gpu-passthr...
LoganDark 3mo ago
Modern macOS devices have a secure element just as good as iOS devices. Almost nobody makes use of it, though. (I haven't seen anything yet that uses the secure element to control access to a wallet. Are there any technical obstacles to keeping the keys out of main memory?)

zuzululu 3mo ago

He was smart/determined enough to risk it all. Why didn't he just try find a job that pays $200k/year ? Why play into the stereotypes ?

fhdkweig 3mo ago
> He was smart/determined enough to risk it all. Desperate people are willing to risk it all, and usually smart people aren't desperate.
r_lee 3mo ago
> didn't he just try find a job that pays $200k/year ? you really think it's that easy?
- choilive 3mo ago
  Claude get me a job that pays $200k/yr. Make no mistakes.
  - pfych 3mo ago
    Claude get me a job that pays $200k/yr. Make a breakthrough.
- zuzululu 3mo ago
  If you expect it to be easy like a handout then thats the wrong attitude because then everybody would be doing it so already this points to lack of context and self awareness. If you are getting paid $200k/year, you have to be willing to see it from the other side of the table, what are you offering really? It's also not as hard or dire as you think it is but without knowing more about your situation or what you tried, its pointless because I suspect that its going to just turn into a moping session. I am working on 3 remote jobs that pay over 200k/year, it takes time and effort, and yes it was relatively easy for me but not in the way that you think it should be.
idiotsecant 3mo ago
Yeah, clearly risking it all wasn't the smart play here, as evidenced by the fact he got caught. A lot of people are willing to tolerate risk, that hardly makes them useful. Frequently the opposite.
deleted 3mo ago
[deleted]

LoganDark 3mo ago

I heard Monero can help against blockchain analysis (though less so if you buy from adversaries). Unfortunately it looks like blockchain analysis was not the attack vector here, but rather buying gift cards through an incompetent intermediary.

HDBaseT 3mo ago
Not really an "incompetent intermediary", Bitrefill, the company used for buying gift cards with Bitcoin received legal requests to identify the user. Bitrefill doesn't proclaim insane privacy protections, they are based out of Sweden but aren't immune to being requested to provide the information. Monero could of helped, although its not easy to transfer BTC to Monero without P2P trades, as effectively every exchange requires KYC. Those source and destination wallet addresses are tainted, you wouldn't be able to deposit on any mainstream exchange and if they do, its for a honey pot purpose.
- LoganDark 3mo ago
  Making it possible to identify a user is incompetence, exactly because of legal issues like this. You don't run a service that accepts crypto for gift cards and then keep information on file that identifies the buyer personally, that's just stupid. But then again, you don't illegally obtain crypto and then give out your info when you go to use the illegal funds, that's just stupid as well. Is P2P that big a deal? I swap coins on Bisq all the time. It's super easy to pick up and use if you already have the BTC. The biggest obstacle is obtaining some BTC in the first place when you don't have any yet. Once you have enough for the security deposit, you can buy/sell or swap thousands of dollars in funds at a time.
- Cider9986 3mo ago
  >Monero could of helped, although its not easy to transfer BTC to Monero without P2P It's really not hard but it probably gets much harder to transfer tainted Bitcoin. Trocador.app aggregates various no-KYC CEX swaps and is regarded well in the Monero community. As we can see from the various Monero pumps, which often stemmed from cleaning coins. Thieves don't want to sit on the Bitcoin so they drive up the price of Monero selling it fast. Yeah P2P is more technical. Hopefully with Serai we can get a good UX decentralized exchange. Swapping into fiat is a different beast.

drnick1 3mo ago

This underscores a major issue with commercial software like Steam and games obtained therein. You cannot trust that software not to maliciously scan your device for secrets such as crypto wallets or other information. Ideally, you want to run apps like Steam, Discord, Zoom and whatever else does not come from a trusted distribution repo as a separate user. This is not always convenient however, and the compromise I adopted on my gaming PC is to bubblewrap Steam. Do not mount things like /home and devices games should not be using in the sandbox.

kibwen 3mo ago
This is what my Steam Deck is for. There's no gap like air gap.
- drnick1 3mo ago
  Dedicated hardware is definitely the most secure option, but realistically it is even less convenient than a separate user. You can't realistically play graphically intensive games on a Deck, and separate workstations are very unaffordable at the moment.
techjamie 3mo ago
In theory you could change the steam command line fpr each game and have them launch in bubblewrap. Though I'm not sure how well that would play with graphics drivers. It might be friendly with AMD, but my experience is that NVIDIA is a pain to have play nice with containers.
- drnick1 3mo ago
  I sandbox Steam itself for simplicity. My experience with Nvidia and Wayland has been good. I simply exposed /dev/nvidia*, a few networking-related files in /etc and system binaries like /usr.
  - jallasprit 3mo ago
    How are you doing the sandboxing?