2013-04-11: More BitCoin Shenanigans
Level Two Attack
It's been a busy week for BitCoins, with tons of press and several notable attacks. Earlier in the week, BitCoins surged to a valuation of over $240 USD - and hours later, plunged down to the $120 level. There was buzz that this was somehow related to DDoS attacks, or perhaps to a Redditor giving away thousands of dollars worth of BTC. Most people tend to think the drop was just a natural correction, and some are even suggesting that BTC could rebound even higher.
However, on the heels of all that, two items have caught my attention, and that's why I've made this Level Two Attack post. Keep in mind that a Level Two attack is relatively minor, and the Gibson Index goes as high as Level Seven - the two events listed below would likely be Level One Events on their own, but they both pertain to the same target (precious bitcoins!), escalating their severity ever so slightly.
Attempted BitCoin Heist
A decoy website may have tricked users into running Java-based malware by posing as a "bitcoin exchange live chat site", similar to a watering hole attack. It sounds like the attack would be easy for a sufficiently paranoid user to avoid (because of Java sandbox warnings and such), but a person caught unawares might unwittingly execute it.
Running the exploit would reportedly cause BTC to be transfered out of the user's MtGox account. Users with Two-Factor Authentication activated were likely not at risk.
Related Links:
- TechCrunch: Java Applet Attack Wipes Out Bitcoin Accounts On Mt. Gox
- Reddit: !!! Watch out - 0-day exploit stealing Mt. Gox funds !!!
- HackerNews: "From the source of mtgox-chat.info"
MtGox Exchange Suffers New DDoS, Temporarily Halts Services
According to TheVerge, MtGox has tweeted that they are under a "stronger than usual" DDoS attack, and has also decided to halt some of its services (for 12 hours) in an effort to stabilize BTC values after this week's extreme volatility.
A post on MtGox's own blog says that reports of a DDoS the day prior are not completely accurate (note: This may not be the same DDoS that TheVerge is reporting), instead saying that a massive influx of new users is overloading the systems - they also say that they are expanding their server capacity to get things working more smoothly.
Related Links: