DNS Hijack Leads To Bitcoin Heist

[dlevere]

Posted by timothy on Saturday March 09, 1:51 A.M.

First time accepted submitter FearTheFez writes:

"Social Engineering and poor DNS Security lead to a Bitcoin heist worth about $12,000. Bitcoin broker Bitinstant was robbed after thieves managed to take over ownership of their domains.

While Bitinstant claims that no customers lost any money, without 2 factor authentication all it took was a place of birth and a mothers maiden name to gain access. This looks like poor security from everyone involved."

[Pyriel]

Bitcoins have been getting a lot of attention lately. The Internet Archive is paying its staff members in Bitcoins. You can use them to shop at Amazon or even buy a pizza. But that has made them a more attractive target to hackers, who have taken to writing malicious software that steals Bitcoins out of digital wallets stored on people’s desktop computers.

They keep spreading this ridiculous idea, but you can only use them to do those things because some Bitcoin-er has thrown up a website that acts as a middleman between you and pizza or you and Amazon. The merchant is still receiving Dollars or Euros or whatever. You give the Bitcoin site all your information, send a payment, and the site communicates your order while either exchanging funds, or making payment out of an account containing real money that belongs to the site.

I think the pizza sort-of-resellers are using an API that Dominos actually allows. The first site to spring up for Amazon orders is completely unauthorized. Your order will be placed using the middleman's account, and it will be shipped as a "gift". They are (or were) using an account with Prime membership to do all this, which is a violation of the membership agreement. A couple of other sites have sprung up in the last couple of weeks, using a similar ploy of layering Bitcoin nonsense over Amazon (I-framing in the Amazon site, and such). Nobody's yet sure if the new entrants into the field are scams or phishing attempts.