35
36

Holy shit my eth accounts been hacked (self.ethereum)

d11e9 が 投稿

I had around 399 ether in an account and today deployed some contracts to the main chain, then while browsing an explorer I noticed someone has drained my account in 39.x ether increments.

See: http://explorer.etherapps.info/address/0xd0f9597811b0b992bb7d3757aa25b4c2561d32e2

Fuck!!

So bummed right now, wonder who http://explorer.etherapps.info/address/0xfe6404ba34ea4c30538ff4d058f4bf883220fd79 is. 😢

There goes all my ether I bought for developing dapps. I wonder how they took my funds.

Edit: I didn't intend to be alarmist, just quite bummed.

Update: I've moved my remaining funds to a new account 0xb531d16c7397c6eca613cae954cfe0a46a241666 and turned off my full node (which had open RPC ports - lesson learnt :( ) Dont store ether in accounts on my full node. It would seem that the perp is stealing more from others see account transactions above.

全 82 件のコメント
並べ替え:
ベスト
トップ新着論争中古い順Q&A

[–]CJentzschΞTHÐΞV - Christoph Jentzsch 19ポイント20ポイント  (26子コメント)

I would say you had an open RPC port and an unlocked account. Someone found your IP, and tried via a JSON-RPC call to send ether from your account, and since your account probably was unlocked, he succeeded. So never have an open JSON-RPC connection in combination with an unlocked account!

[–]LarsPensjo 6ポイント7ポイント  (14子コメント)

Please elaborate a little on this!

It is not unusual to unlock the account and then use a web function to access it. E.g. http://groupgnosis.com/, where you have to do this to be able to place bets.

Will careful selection of --rpccorsdomain prevent this? That is, avoid using "" as argument? The documentation says "Domain on which to send Access-Control-Allow-Origin header", which I don't understand, so I use to use "".

[–]portabello75 3ポイント4ポイント  (9子コメント)

Groupgnosis thread describes this as a huge security hole where groupgnosis could literally swipe any coin when you are connected. Hence, never unlock a wallet containing more funds than you intend to bet (risk) when connecting to their service.

[–]linagee 1ポイント2ポイント  (5子コメント)

never unlock a wallet containing more funds than you intend to bet (risk) when connecting to their service.

I understand this, but I kind of feel like they themselves should be warning people of this thing...

[–]portabello75 4ポイント5ポイント  (4子コメント)

That's why it's an alpha, and yeah I agree. But its the owners having a boner wanting to beat Augur to market and not worrying about security for the users. What can I say, it's sort of sad. Could have been an awesome project if they hand't botched it so badly wanting to be 'first to market' (as if that matters in this case).

[–]GroupGnosis 1ポイント2ポイント  (3子コメント)

We apologize for the lack of communication. That is something we are going to change. We will be posting a full FAQ this coming week as well as updating the site with more information and markets.

The best solution for using Gnosis at the moment is to open a geth rpc node with a coinbase that only contains as much as you are willing to lose. Do not unlock the account until right before you make a purchase. In your rpc terminal (if you don't have one running use >geth attach) type; personal.unlockAccount(eth.coinbase, ‘Password’, 30) Then place your bet within 30 seconds. This is not the best solution but we are working on a better one. Stay tuned for more updates!

[–]getrektcrew 0ポイント1ポイント  (1子コメント)

Has the time limit on the unlock feature been fixed? I know for sometime it didn't work -- just left it unlocked.

Also, dumb question but what does the --rpc stand for? and what does it do?

[–]portabello75 1ポイント2ポイント  (0子コメント)

--rpc allows remote procedure calls. aka. allows for remote interaction with the coinbase.

[–]portabello75 0ポイント1ポイント  (0子コメント)

Obviously this is something that the community figured it out itself. Doesn't really mitigate the fact that you released a potentially directly harmful product just to get to market quickly and your customers (from what it seems) lost significant sums as a result. I understand that you wanted to beat Augur, but I think in this case you basically just decided to roll out a untested framework with real money access, almost no documentation and obvious security concerns.

[–]LarsPensjo 1ポイント2ポイント  (2子コメント)

There are two issues here. The first is whether to trust Groupgnosis. I am fine with that, and accept the risk for now.

The other issue is unlocking the account while using the --rpc flag. Does that mean someone, not related to Groupgnosis, can drain my unlocked account?

[–]portabello75 1ポイント2ポイント  (1子コメント)

Unlocking your account for Groupnosis access allows anyone that can access your computer (IP) to do anything they want with your unencrypted private key (afaik). So yeah, I'd call that an issue. If you are running a miner and unlock your key you can almost guarantee someone will attempt and probably succeed in stealing your funds.

In all fairness, this goes for unlocking your account for any reason, not just for groupnosis.

[–]LarsPensjo 0ポイント1ポイント  (0子コメント)

What is then the purpose of the flag --rpccorsdomain ?

[–]CJentzschΞTHÐΞV - Christoph Jentzsch 1ポイント2ポイント  (0子コメント)

I am developer of the cpp client, so I am not familiar with the way go is doing it. But in general, dont give full control of your client to a third party or an attacker by letting it use your client over JSON-RPC when having an unlocked account. I dont know gnosis, but you can send ether to a third party when you trust them, but don't give them control over your client. JSON-RPC should primarly be used for localhost only (except of pure blockchain exploring without funds at stake). In the future you will run your Dapp in Mist and access the client only through localhost, don't open that port to the outside.

[–]roarkjs 2ポイント3ポイント  (0子コメント)

Will careful selection of --rpccorsdomain prevent this?

This is the question that I haven't found an answer to.

The gnosis website says:

This geth command must be entered when starting your node: geth --rpc --rpccorsdomain "http://groupgnosis.com" --unlock <YourAccount> '<Password>'

So if this still leaves you vulnerable what's the point in --rpccorsdomain?

[–]linagee 1ポイント2ポイント  (1子コメント)

The solution is easy: Don't use groupgnosis. I'd hate to take away from their cool factor and acceptance with the crowd, but what they are doing is just plain insecure.

[–]koeppelmann 2ポイント3ポイント  (0子コメント)

I think this focus on Gnosis is a little bit unfair. All DAPPS I am currently aware of do it this way: e.g:http://ethereum-dapp-wallet.meteor.com/ since it is the only way possible. So you could argue that DAPPs in general should wait since tools are more secure but I don't see what we did different than others.

And we put lots of warnings in our posts: https://www.reddit.com/r/ethereum/comments/3i9i8m/groupgnosis_prediction_market_is_live_trading_has/

[–]k1nkyk0ng 3ポイント4ポイント  (8子コメント)

yeah, they could have gotten your IP from IRC even

[–]CJentzschΞTHÐΞV - Christoph Jentzsch 5ポイント6ポイント  (7子コメント)

When you are connected to the Ethereum network you are telling your peers your IP. So when I set max peers to 500, and try this attack with all of my peers, I might get some Ether.

[–]doublereignbeau 0ポイント1ポイント  (4子コメント)

What do you mean by an unlocked account?

Edit: OK, I see the unlock option in Geth command line options.

[–]CJentzschΞTHÐΞV - Christoph Jentzsch 0ポイント1ポイント  (3子コメント)

The private key of your accounts is stored, but encrypted. By entering your password in the client you can encrypt and it and make it usable for the client to send transactions. Both eth and geth have similiar mechanisms to unlock an account

[–]d11e9[S] 3ポイント4ポイント  (2子コメント)

I kinda wish RPC auth was handled with tokens, instead of being either locked or unlocked globally.

[–]shouldbdan 0ポイント1ポイント  (1子コメント)

Wouldn't be hard to put a proxy in front of it that authenticated with tokens.

[–]linagee 0ポイント1ポイント  (0子コメント)

That client side proxy is called Mist... and it will alert you to any transactions that are going to be happening before they are committed.

https://youtu.be/IgNjs_WaFSc?t=12m7s

[–]gynoplasty -3ポイント-2ポイント  (1子コメント)

You don't happen to have a script handy for trying this out, for testing purposes? ;-)

[–]jzen_core 2ポイント3ポイント  (0子コメント)

Do the Ethereum clients support JSON-RPC call logging, for later analysis or reference?

[–]playingethereum 11ポイント12ポイント  (4子コメント)

This is not an isolated event. My friend had 2540 ETH stolen around 9am today (8/28/2015). He is investigating now and plans to post what he knows soon.

[–]dbendorf 3ポイント4ポイント  (1子コメント)

You are welcome to see how my attack went down this morning :( 2540 ether taken https://etherchain.org/account/0xf8fffdcb6b8b88372b6ae42257f66d93e5189ac9 That is me, and 0x672a665acb5f40e7f32c8d4733e09412966e925b is the receiver of my ether. It looks like it has been sent around and 1000 ended up on poloniex from the transaction records. I guess I am screwed. I was on IRC for an ethereum project with JSON RPC (but my geth was not unlocked). Any help would be wonderful, but I know it is gone.

[–]luvasugirls 4ポイント5ポイント  (0子コメント)

Maybe work with polo on this. They request Identification from users.

[–]linagee 1ポイント2ポイント  (1子コメント)

Was it also from a pre-sale wallet? Did he store his key on dropbox and gmail like the op? Was it taken out in strange increments and not fully drained? Did he have JSON-RPC running open to the entire world so that anyone can take his funds? (I think you should understand a bit about network security before you do this.)

[–]playingethereum 2ポイント3ポイント  (0子コメント)

I don't want to post for him, but I'm sure he'll be fine if I answer your questions: It was not a pre-sale wallet. He did not store his key loosely (gmail/dropbox). It was taken out in three transactions - first 5, then 2500, then 40. He did have an open port for remote json-rpc connections - this is my leading suspicion. He left the port open because when any of us were experiencing geth difficulty during olympic we would send him our miner hashes.

[–]sir_talkalot 5ポイント6ポイント  (4子コメント)

Have you unlocked your RPC? If so, for what sites? And what was the CORS settings?

[–]d11e9[S] 1ポイント2ポイント  (3子コメント)

This may actually be it. Is there still the geth unlock timeout not working bug?

But doesn't explain why it wasn't drained completely.

[–]portabello75 1ポイント2ポイント  (2子コメント)

But doesn't explain why it wasn't drained completely.

Seems it was drained non-malicously (possibly) considering it was not 100% drained, and from what I can tell drained in exact blocks with a few blocks being 100th of the large ones.

This is the first transaction after your contract creation: 0xd0f9597811b0b992bb7d3757aa25b4c2561d32e2 0.00000000244140625 ether 0xfe6404ba34ea4c30538ff4d058f4bf883220fd79

Dust ether to the same address seems odd.

[–]d11e9[S] 2ポイント3ポイント  (1子コメント)

Lol at non maliciously, 😅😓😅 but at least I have a little left for some development.

Assuming it's still there when I can get to a machine to transfer it to "safety"

[–]portabello75 2ポイント3ポイント  (0子コメント)

What I meant by non maliciously was that it may be a badly written contract, not necessarily intentionally so though.

[–]uncaer9 3ポイント4ポイント  (13子コメント)

I'm sorry for your loss, but could you post information like which OS do you use, did you post backups of your wallet online etc.? That would be useful to determine the cause and avoid it.

[–]d11e9[S] 1ポイント2ポイント  (12子コメント)

I develop on all three platforms Linux, OS X and windows, on all of the above it is only stored encrypted.

Only been using geth (all v1.1.0) client in all cases.

I did store a backup in my email account but it too is encrypted. I think the attack is not so simple as a stolen private key I hope that the attack is just a matter of stolen key, anything else has far more consequences.

[–]gynoplasty 1ポイント2ポイント  (7子コメント)

It seems like that is the most likely vector of attack. Is your email 2fa protected.

[–]d11e9[S] 2ポイント3ポイント  (6子コメント)

Yes 😥

[–]gynoplasty 0ポイント1ポイント  (5子コメント)

Which email client?

[–]d11e9[S] 1ポイント2ポイント  (4子コメント)

Gmail

[–]itistoday 1ポイント2ポイント  (2子コメント)

Did you send any transactions from that address prior to the hack?

[–]d11e9[S] 1ポイント2ポイント  (1子コメント)

Yes the contract creation txs prior to draining are mine.

[–]itistoday 2ポイント3ポイント  (0子コメント)

That could be part of the problem. Any time you send txns you have to reveal your public key to the network. There was a hack in Bitcoin-land where many Bitcoins were stolen because of a security flaw in the random number generator of an android wallet that allowed you to derive the private key from the public key.

[–]a-cros 0ポイント1ポイント  (1子コメント)

let's assume it's not just social engineering and that someone actually found a vulnerability, wouldn't they wait for ethereum to get bigger and/or target a more substantial amount of money though?

[–]d11e9[S] 1ポイント2ポイント  (0子コメント)

Sounds reasonable, unless the attack only applies to a subset of keys, but even so the 0-day would be worth more than my paltry hoard of 399 ether

[–]uncaer9 -2ポイント-1ポイント  (1子コメント)

Personally I wouldn't run Geth on anything beside Linux or Mac, using it on Windows(or Android if there will be mobile wallet) is just asking for trouble. Nobody has stolen anything from me in years, but probably I'm not rich enough to be a target as a Linux user.

[–]earthtrader 0ポイント1ポイント  (0子コメント)

but rich have better security than poor, so usually the poor are the victims of theft.

[–]imaginative_investor 4ポイント5ポイント  (9子コメント)

Why would someone drain the account in 39.x increments? Wouldn't it be most efficient for them to drain it in a single Tx? Sure it wasn't a bug or something you did yourself accidentally? Sorry for your loss.

[–]d11e9[S] 1ポイント2ポイント  (7子コメント)

No I wouldn't rule out human error but for the life of me can't think of an instance where that might be the case.

[–]portabello75 1ポイント2ポイント  (6子コメント)

The fact that it's automated (assuming machine interaction due to this specific chunk number) makes me think it will pertain to FAR more presale wallets.

[–]d11e9[S] 0ポイント1ポイント  (1子コメント)

At first I thought it might be a replay attack, but I never executed any transactions on the testnet with that account.

[–]portabello75 2ポイント3ポイント  (0子コメント)

Was your password/phrase strong enough that brute force hacking is unlikely? Dictionary attack against the encrypted pre-sale key database? It seems really odd.

Seems you made a few contracts tied to the address and there are two transaction of exactly 100th of the stolen amounts. Are you sure you didn't screw up a contract somehow and sent the Ether? Did you give any Dapp full key acccess?

[–][削除されました]  (3子コメント)

[deleted]

    [–]portabello75 3ポイント4ポイント  (0子コメント)

    Not at all. Just seems exceptionally unlikely that any human would withdraw it in these increments. Seems far more likely that we are dealing with a program. And I am just assuming if you write specialized software, you don't intend to steal $500. .

    I do however not have any funds still sitting in my presale wallet. People should just swipe it to a new private key and problem solved.

    [–]d11e9[S] 2ポイント3ポイント  (1子コメント)

    I'm sorry if my post comes across as FUD, I can only sincerely say that that was not my intention and if I had any position on ethereum it would be long! My only interest in my ether balance is for dapp development, check my GitHub if you want proof.

    [–]heliumcraft 3ポイント4ポイント  (1子コメント)

    Did you access any DApps recently?

    [–]ibopm 0ポイント1ポイント  (0子コメント)

    Did you access any DApps recently?

    Sounds like "have you had unprotected sex recently?" We often forget that there are still many dangers in the frontier!

    [–]k1nkyk0ng 2ポイント3ポイント  (0子コメント)

    Have you had geth rpc running with your keys unlocked?

    [–]k1nkyk0ng 1ポイント2ポイント  (10子コメント)

    did you use a website to generate your keys?

    [–]d11e9[S] 2ポイント3ポイント  (7子コメント)

    No it's from my presale wallet directly!!

    [–]k1nkyk0ng 1ポイント2ポイント  (5子コメント)

    oh shit

    [–]k1nkyk0ng 0ポイント1ポイント  (4子コメント)

    /u/d11e9 so your wallet file -- do you sync that or anything? upload to something?

    [–]k1nkyk0ng 0ポイント1ポイント  (3子コメント)

    maybe import it into a webpage?

    [–]d11e9[S] 2ポイント3ポイント  (2子コメント)

    I may have stored it in Dropbox but again always encrypted.

    Edit: it's worth noting that this Dropbox account does not sync with any machine

    [–]a-cros 1ポイント2ポイント  (1子コメント)

    dumb question but, how strong was your password? maybe it was just brute-forced after being found on some Dropbox server...

    [–]d11e9[S] 1ポイント2ポイント  (0子コメント)

    Not crazy strong, but mix of alpha numeric upper and lower and special characters

    [–]gynoplasty 0ポイント1ポイント  (0子コメント)

    And you stored it in an email? I did the same, using 2fa. I better check my balance.

    [–]botena 0ポイント1ポイント  (1子コメント)

    I've wondered about those websites. Is it safe if you change your password when you unlock the wallet?

    [–]k1nkyk0ng 1ポイント2ポイント  (0子コメント)

    Its only safe if they didn't include code to run off with your money. But note that they could start without that code and add it in later. I'm building a site that helps you interact with Ethereum so I wish I could tell you that its safe, but in truth you have to trust the creator. So I'm trying to balance that requirement of trust with some trustworthiness. Part of that is tying the service to my public identity and the other part is running it as a business that has more to gain by remaining reputable than running off with some money.

    Its a hard equation to balance and seeing this thing happen is disheartening. Especially since we don't know how the key was leaked.

    [–]k1nkyk0ng 2ポイント3ポイント  (0子コメント)

    we should make a crawler for ethereum sites and see if anything is trying to hit localhost

    [–]earthtrader 1ポイント2ポイント  (0子コメント)

    the next post like this will come from someone using this scammer's wallet

    alandunkley

    ethereum wallet . org

    [–]playingethereum 2ポイント3ポイント  (3子コメント)

    Just out of curiosity, did you use rolldice.io?

    [–]d11e9[S] 1ポイント2ポイント  (1子コメント)

    Nope used no gambling dapps

    [–]playingethereum 2ポイント3ポイント  (0子コメント)

    well. that blows my theory. I'm not sure if you saw my other comment, but one of my buddies was robbed today as well. It went to a different account than yours, but it was in three transactions totaling 2545 Eth.

    [–]smartcontractor 0ポイント1ポイント  (0子コメント)

    Rolldice.io owner here. What is your point exactly ?

    [–]LarsPensjo 0ポイント1ポイント  (3子コメント)

    The transaction costs for the last ones were 90000 gas. Isn't the gas cost 21000 for transactions?

    I don't know how this works.

    [–]linagee 1ポイント2ポイント  (0子コメント)

    90000

    90,000 is the default amount of gas to use when you're calling a function. This makes it seem even fishier.

    [–]HardToScale 0ポイント1ポイント  (0子コメント)

    Gtransaction 21000 is minimum fee Paid for every transaction plus fees related to other opcodes in the transaction. 21000 is basic gas for initial processing checking signature and so on. After that for each extra opcode in the transaction requires extra fee.

    Yellow Paper has more details, see http://www.gavwood.com/Paper.pdf

    [–]portabello75 0ポイント1ポイント  (0子コメント)

    Seems another wallet has fed transactions in the same 10%/0.1% of total balance chunks to the same account in the same family of blocks : http://explorer.etherapps.info/address/0x05586fa5cd5118635d1cee937f7a91385bc4bcf1

    [–]TotesMessenger 0ポイント1ポイント  (0子コメント)

    I'm a bot, bleep, bloop. Someone has linked to this thread from another place on reddit:

    If you follow any of the above links, please respect the rules of reddit and don't vote in the other threads. (Info / Contact)

    [–]The__Shadow -4ポイント-3ポイント  (0子コメント)

    Sorry to hear that - But the only thing people can do to send Coins from a particular Wallet is to know the Key.

    Either your Key was simply too short, too easy/unsecure, or you have a Keyboard Logger sending the data to some server reviling your Key.

    My advice for everybody is to Encrypt Your Files twice or thrice in case u use a virtual machine for your Crypto Business like everybody should do.