<p>Currently attacks against Bitcoin users can be categorized as</p>

<ul>
<li><p>"Normal" keylogging malware which stoles credentials to Bitcoin sites and steals Bitcoins from your online wallet (unless you have two-factor authentication). These kind of malware infections generally steal all your passwords, including Facebook, PayPal, and they do not especially target Bitcoin users.</p></li>
<li><p>Password reuse attacks - if you have used the same password on some other sites, your username and password are stolen or taken from the site and then tried on all popular Bitcoin sites. This may especially happen with shady services like faucets which promise "free bitcoins" if you sign up.</p></li>
<li><p>Phishing attacks, both via email and Google advertisements. E.g. if you search BlockChain or LocalBitcoins on Google, the first "result" is an advertisement leading to a phishing site. The user gives his username and password on the phishing site, then the site will empty the wallet on the actual Bitcoin site the user thought he/she was logging in.</p></li>
<li><p>Malware and computer viruses targetting locally installed Bitcoin software. These steal <code>wallet.dat</code> or unencrypted copy of it from the memory when you unlock it.</p></li>
<li><p><a href="http://www.reddit.com/r/Bitcoin/comments/23sjle/chrome_extension_just_stole_my_btc/">Malicious browser addons (Chrome)</a> targetting popular Bitcoin sites. These may modify Bitcoin receiving address on the page in-fly, so that they can get around two-factor authentication protections set up by Bitcoin sites. </p></li>
<li><p><a href="https://blog.torproject.org/category/tags/mitm">Malicious Tor exit node attacks</a> - if you want to hide your tracks using Tor network, there are malicious exit nodes which will do HTTPS man-in-the-middle attack using fake security credentials. The web browser warns about this, but an ordinary user may ignore the warning.</p></li>
<li><p><a href="http://thecoinfront.com/roger-ver-deflects-hacker-posts-bounty-for-their-arrest/">Social engineering attacks</a>. If you are a "known Bitcoin celebrity" criminals might to attack your personally, by phone calling you and posing as a service operator, police etc. They might go after your ISP, email provider, etc. and try to social engineer access to your email.</p></li>
<li><p>Very difficult to pull attacks, <a href="http://securityaffairs.co/wordpress/27448/cyber-crime/bitcoin-mining-pools-hack.html">like rerouting all Internet traffic just to gain access to Bitcoin mining pool IP addresses</a></p></li>
</ul>

<p><a href="http://www.forbes.com/sites/andygreenberg/2014/02/26/nearly-150-breeds-of-bitcoin-stealing-malware-in-the-wild-researchers-say/">There are already 100+ strains of malware targeting Bitcoin users</a>. Because Bitcoins are easy to steal from careless users, it seems to be profitable to include Bitcoin-stealing capabilities in all malware kits. In the light of this, malware threat against Bitcoin users is not exaggerated. </p>

<p>Of course, to get your Bitcoins stolen by malware, you need to get your computer infected. The ways to protect yourself include</p>

<ul>
<li><p>Do not install applications or browser extensions on your computer from non-trusted sources, especially pirated applications or random download sites which offer Microsoft Windows application downloads. Always download all Windows software from the webpage of the software author. For OSX or Linux use App Store or the Linux distribution package manager.</p></li>
<li><p>Always keep the software on your computer up-to-date. Nearly every vulnerability widely exploited by cyber criminals has already been patched by the software manufacturer.</p></li>
<li><p>Use safer operating systems like Ubuntu Linux and OSX instead of Microsoft Windows, to lower the risk to get infection on your computer</p></li>
<li><p>Use password management software, like <a href="http://www.keepassx.org/">KeePassX</a>, and random password on every website</p></li>
<li><p>Keep most of your Bitcoin holdings offline, on a separate device not connected to Internet</p></li>
</ul>

CC BY-SA 3.0
2014-09-01T10:43:04.623Z
2014-09-02T01:27:41.540Z
2014-09-02T01:27:41.540Z
Mikko Ohtamaa
<p>Some months ago I put a small amount of Bitcoin into an account and wrote the address and private key into a text file. I have left on my computers and on those of a couple of friends. The money hasn’t been taken.</p>

<p>Where does the main danger come from? Screenshots, key-logging or what?</p>

<p>My main motive in asking this is that I use bitaddress.org offline to generate addresses, but without using Ubuntu or taking out my hard drive. I never copy my private key onto the clipboard, and I wonder whether the danger I face of having my coins taken - particularly if I store more in this way - is real or merely highly improbable?</p>

CC BY-SA 3.0
2014-09-03T15:49:37.790Z
Peter - that text file is surely a ticking time . Imagine your machine is a minefield. Every single wallet address,. Dat and encryption protocol you use is a loaded mine. The main threat is the fact that your compounding your vulnerability manyfold; 1st, you enter other human variables. 2nd, you exponentially increase the chances of a successful breech by multiplying the amount of machines store your same wallets. No,  not so much screenshots. Kelloggs are pretty easy to avoid but yes they are problematic. No hot wallet is safe.  Period.
TheGenesisBloke
CC BY-SA 3.0
2014-09-04T08:01:56.160Z
Yes, but I should have made it clear that I am leaving it there as a test to see if it is stolen. I think there is one milibit in the wallet! My main interests are: (i) will it be taken (ii) and by which method.
Peter
<malware>
Is the threat of computer malware to steal Bitcoin exaggerated?
Peter
# Is the threat of computer malware to steal Bitcoin exaggerated?

(Asked by: username_0 on 2014-09-01)

Some months ago I put a small amount of Bitcoin into an account and wrote the address and private key into a text file. I have left on my computers and on those of a couple of friends. The money hasn’t been taken.

Where does the main danger come from? Screenshots, key-logging or what?

My main motive in asking this is that I use bitaddress.org offline to generate addresses, but without using Ubuntu or taking out my hard drive. I never copy my private key onto the clipboard, and I wonder whether the danger I face of having my coins taken - particularly if I store more in this way - is real or merely highly improbable?

**Tags:** malware

> **Comments:**
> **username_1**: username_0 - that text file is surely a ticking time . Imagine your machine is a minefield. Every single wallet address,. Dat and encryption protocol you use is a loaded mine. The main threat is the fact that your compounding your vulnerability manyfold; 1st, you enter other human variables. 2nd, you exponentially increase the chances of a successful breech by multiplying the amount of machines store your same wallets. No,  not so much screenshots. Kelloggs are pretty easy to avoid but yes they are problematic. No hot wallet is safe.  Period.  
> **username_0**: Yes, but I should have made it clear that I am leaving it there as a test to see if it is stolen. I think there is one milibit in the wallet! My main interests are: (i) will it be taken (ii) and by which method.  

---

## 1 answers

### Answer by username_2 on 2014-09-01. Score: 18

Currently attacks against Bitcoin users can be categorized as

* "Normal" keylogging malware which stoles credentials to Bitcoin sites and steals Bitcoins from your online wallet (unless you have two-factor authentication). These kind of malware infections generally steal all your passwords, including Facebook, PayPal, and they do not especially target Bitcoin users.
* Password reuse attacks - if you have used the same password on some other sites, your username and password are stolen or taken from the site and then tried on all popular Bitcoin sites. This may especially happen with shady services like faucets which promise "free bitcoins" if you sign up.
* Phishing attacks, both via email and Google advertisements. E.g. if you search BlockChain or LocalBitcoins on Google, the first "result" is an advertisement leading to a phishing site. The user gives his username and password on the phishing site, then the site will empty the wallet on the actual Bitcoin site the user thought he/she was logging in.
* Malware and computer viruses targetting locally installed Bitcoin software. These steal `wallet.dat` or unencrypted copy of it from the memory when you unlock it.
* [Malicious browser addons (Chrome)](http://www.reddit.com/r/Bitcoin/comments/23sjle/chrome_extension_just_stole_my_btc/) targetting popular Bitcoin sites. These may modify Bitcoin receiving address on the page in-fly, so that they can get around two-factor authentication protections set up by Bitcoin sites.
* [Malicious Tor exit node attacks](https://blog.torproject.org/category/tags/mitm) - if you want to hide your tracks using Tor network, there are malicious exit nodes which will do HTTPS man-in-the-middle attack using fake security credentials. The web browser warns about this, but an ordinary user may ignore the warning.
* [Social engineering attacks](http://thecoinfront.com/roger-ver-deflects-hacker-posts-bounty-for-their-arrest/). If you are a "known Bitcoin celebrity" criminals might to attack your personally, by phone calling you and posing as a service operator, police etc. They might go after your ISP, email provider, etc. and try to social engineer access to your email.
* Very difficult to pull attacks, [like rerouting all Internet traffic just to gain access to Bitcoin mining pool IP addresses](http://securityaffairs.co/wordpress/27448/cyber-crime/bitcoin-mining-pools-hack.html)

[There are already 100+ strains of malware targeting Bitcoin users](http://www.forbes.com/sites/andygreenberg/2014/02/26/nearly-150-breeds-of-bitcoin-stealing-malware-in-the-wild-researchers-say/). Because Bitcoins are easy to steal from careless users, it seems to be profitable to include Bitcoin-stealing capabilities in all malware kits. In the light of this, malware threat against Bitcoin users is not exaggerated.

Of course, to get your Bitcoins stolen by malware, you need to get your computer infected. The ways to protect yourself include

* Do not install applications or browser extensions on your computer from non-trusted sources, especially pirated applications or random download sites which offer Microsoft Windows application downloads. Always download all Windows software from the webpage of the software author. For OSX or Linux use App Store or the Linux distribution package manager.
* Always keep the software on your computer up-to-date. Nearly every vulnerability widely exploited by cyber criminals has already been patched by the software manufacturer.
* Use safer operating systems like Ubuntu Linux and OSX instead of Microsoft Windows, to lower the risk to get infection on your computer
* Use password management software, like [KeePassX](http://www.keepassx.org/), and random password on every website
* Keep most of your Bitcoin holdings offline, on a separate device not connected to Internet


---

