Estás usando un navegador desactualizado. Es posible que no muestre este u otros sitios web correctamente. Debe actualizar o usar un navegador alternativo.
meanwhile nos insisten de nuevo de las bondades del sistema
Positively Valued Fiat Money after the Sovereign Disappears: The Case of Somalia
"The case of Somalia indicates that sovereign support—in the form of legal tender laws or public receivability—is not a necessary condition for the continued circulation of fiat money"
#1
So at 10:06pm ET on April 10th 2013 I was on btc-e reading the chat box. Then and there someone posted a link to www mtgox-chat info (do not open unless you know what you are doing) claiming a video announcement that mtgox was going to start trading litecoins.
I clicked on the link, the website opened, not much happened, and the "video"/chatbox never loaded. I then forgot about this website.
Some while later at approx 11pm, I received an email. This was an email from mtgox that a withdrawal had taken place. I thought this was a joke.
------------------------------------------------------------
Dear bitbull,
There has been a withdrawal from your Mt.Gox account:
Transaction reference: 97235bfd-9909-4020-9f06-e9d318c1ef7f
Date: 2013-04-11 02:06:22 GMT
IP: 198.203.29.120
You can access your account history for more details.
Please contact us as soon as possible by replying to this email if you did not request this withdrawal.
Thanks,
The Mt.Gox Team
------------------------------------------------------------
I immediately responded back to them, but what I discovered is that the withdrawal had been instantly processed and already confirmed in the blockchain:
which left less than a third of a bitcoin in my account. I then realized that this withdrawal happened at the EXACT time i accessed the mtgox-chat website based on my browser history. I then realized that I only received my notification email from them much after the fact apparently because their servers are overloaded and not functioning correctly.
Being a techie, I started researching. I found out that this site is hosted here in the USA. I also found out that the withdrawal was submitted from an IP in Los Angeles even though I have been accessing mtgox from Pennsylvania / New York. I then discovered that the site is a teleport pro rip of bitcoincharts.com branded with a mtgox logo, and was registered on namecheap (with bitcoins as it may be) not even 5 days ago! This is the IP resolve of the domain name.
I then discovered that the site is loaded with a java script which, based on an initial analysis by my java programmer friend, is a 0 day java exploit with a cross site injection attack, which automatically started. It also contains an additional keylogger payload, all customized specifically for mtgox. They even "offer" an easy to use file download link for those whose browsers are not running java. This script INSTANTANEOUSLY initiated a mtgox withdrawal of nearly all my btc (34btc) in the background (I was logged into mtgox on that browser, seemed to be using some form of proxy to access my browser cookie cache it would seem) and then changed the account password so I couldn't login anymore. This was proven to be 100% automatic as the withdrawal occurred the same exact minute I accessed that website for the first time.
It then continued to gather all my computer passwords and logged everything I was doing including my blockchain account (as I eventually located the log files) and then sent it to the hackers / script kiddies. Luckily I have dual password protection on my blockchain wallet otherwise all my other bitcoins would be gone too. I wouldn't just call them just script kiddies because this script was very specific and well written for the mtgox website. I had two antiviruses running and neither caught it. Only later malwarebytes picked it up as a well encoded trojan payload executable.
Mtgox has clearly not had time to respond, and I antiestéticar they will claim this is my fault as I have seen in other posts online that they say "report it to the police". They should compensate me 100%. First because their site is not secured against such rudimentary attacks as has been demonstrated today. I'm not the first and certainly not the last so long as they don't deal with this. Second because their security policy should account for such instances, and I did not even have an opportunity to warn them I did not make the withdrawal. Yet most importantly, BECAUSE THEY SHOULD HAVE KNOWN ABOUT THIS OVER 3 DAYS AGO!!!
Yeah, I'm stupid, I should have enabled a Yubikey or other 2nd auth method when bitcoins started exploding in value ... but still, this attack is rather basic and should not be possible on a site at the level of Mt. Gox. I can only imagine how people with larger amounts would feel if clicking on a link emptied their account $10k+...
This is a serious loss for me, and unless this is handled correctly this can also badly affect the community. I know they are super busy as they are backlogged with over 10,000 account verifications - I can only hope this gets handled appropriately. Does anyone have any advice how to go about contacting mtgox, they are so busy they don't even realize someone has a specialized phishing operation running to rob their customers!
Any advice is very much appreciated.
En resumen, el tipo perdio solo 34BTC, al cambio de hoy unos 4250$, y se piensa que mtgox le tiene que compensar... en fin...
Otra forma más por la que muchísima gente que se meta sin saber perderá hasta los calzoncillos y luego a llorar... ¿a quien?
