What happened
In late January 2015, an attacker took over the LiveChat support widget used by the peer-to-peer bitcoin marketplace LocalBitcoins and used it to push malware to users. LocalBitcoins acknowledged the attack on January 27, 2015. Vice president Nikolaus Kangas said the attacker used the LiveChat access to distribute a Windows executable, probably a new keylogger that antivirus tools did not yet detect.
Using some social engineering, the attacker got users to install it, then took over their LocalBitcoins accounts and emptied them. About 17 BTC (roughly $3,850 at the time) was stolen from three users' wallets. Staff spotted and shut down the attack quickly, which limited the damage.
LocalBitcoins said affected users would be refunded after they had fixed the security problems on their side. It advised customers to protect their accounts with measures such as two-factor authentication and said it was looking at improving its internal security.
How it happened
- The attacker gained access to LocalBitcoins' LiveChat account, a third-party chat service embedded on the site. How that access was obtained was not disclosed.
- Through the chat, and with some social engineering, the attacker got users to install a Windows executable, most likely a keylogger that antivirus tools did not yet detect.
- Users persuaded to run it exposed their login details to the attacker.
- The attacker logged in to those accounts and withdrew about 17 BTC from three users' LocalBitcoins wallets.
Protocol details
Funds Recovery
Recovered
$4K
Net Loss
$0
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
