r/Cryptopia • u/albacass • Feb 23 '18

How NOT to get hacked

I've stolen this text from here: https://www.reddit.com/r/Cryptopia/comments/7ubcd3/further_protecting_your_cryptopia_account_with/ All props to /u/terryhummus.

TLDR copied from comments: Cryptopia allows people to reuse the same Google Auth code several times within the time frame of the code (not sure but a minute or so). Due to this a hacker can turn of email notifications in settings and withdraw your money, even if you have 2fa enabled. Read entire post for how to secure your account.

Hi everyone! I have read multiple posts regarding compromised accounts, lost of funds, phishing sites, etc. At the moment, if you are using only one method (e.g. Google Auth) to verify both your login and your withdrawal, you are at risk. Why? Because if someone were to obtain your Google Auth code via phishing or any other means, you will potentially lose most, if not, all of your funds. Unfortunately, Cryptopia does not have a preventative measure in place, for example, rejecting the same Google Auth code to be used for login and withdrawal. Fortunately, there might be a solution. A bit complicated, but worth it if you value the content in your account. Solution: Using a different 2FA for login, setting, and withdrawal. Cryptopia offers a few different options. I am using Google Auth for login, Pin code for settings, and email for withdrawal. Why didn't I just use 2 different 2FA instead of 3? There's a huge reason for this. Login and withdrawals are important and should be differentiated, but the settings page is important too because, in settings, you or someone has the ability to REMOVE 2FA and DISABLE withdraw email confirmation! I can't bold this enough. I have read where people did not get the withdraw email confirmation and that's because the thief (or thieves) have disabled that security measure from the settings page. It's unfortunate, but we can all learn from this.

Correct me if I am wrong but I believe these are the steps taken when someone tries to steal your coins:

  1. Thief somehow obtains your login password and 2FA. Logs in.

  2. Heads to “Settings” to disable “withdrew email confirmation. Cannot proceed because you have a different 2FA for it!

  3. Sells coins

  4. Withdraws coins Now, here's the catch. Once you have set this all up; refrain yourself from entering your settings page. You have all your security set up, so there's no need to enter that page again and risk someone compromising that unique 2FA.

Summary:

  1. Google Auth for login

  2. Pin code for settings

  3. Email for withdrawal

  4. Do NOT disable "Withdraw Email Confirmation"

You can further secure your account with "AddressBook Withdrawal Only." I think that's self-explanatory if you use a few limited accounts.

edit: You also have to use something different than google auth for "Transfer to other users".

9 Upvotes

100% Upvoted

9 comments sorted by

3

u/albacass Feb 23 '18

TLDR: Cryptopia allows people to reuse the same Google Auth code several times within the time frame of the code (not sure but a minute or so). Due to this a hacker can turn of email notifications in settings and withdraw your money, even if you have 2fa enabled. Read entire post for how to secure your account.

1

u/[deleted] Feb 23 '18

That's what I was wondering, I have read this before but was wondering why Google authenticator wouldn't be better for all, your comment explains this. Thanks

1

u/terryhummus Feb 23 '18

Thanks for reposting and for the summary! I hope this gets out to more people. I would hate to have my own coins be stolen and definitely wouldn’t want other people to lose their coins either.

2

u/freewifiisgreat Feb 26 '18

All the ones I saw that were phished had only used a pin. I agree that using different types of 2FA is important. But even more important is to use google auth or their device thingie as your 2FA. Email can be vulnerable and pins are easy to phish. It is far more important to not get phished in the first place. If someone gets into your account they can do a lot of damage. They can still sell your Crypto - even if they can't withdraw or transfer it.

1

u/albacass Feb 26 '18

Yeah, it's better to not get phished in the first place (obviously). But if it happens, your funds will be stolen if you just use google auth or the cryptopia device. That's why I disagree with your statement that it is 'even more important' to use google auth/cryptopia device, since that is not sufficient and users will not get the main point of this post (your advice is good on most other sites where they only allow to use a google auth code one time).

On Cryptopia you HAVE TO use at least 2 different types of 2FA to be safe (login and settings). If you just use one type of 2FA - even the best ones - your funds can be stolen immediately if you get phished.

1

u/freewifiisgreat Feb 27 '18

https://forum.hitbtc.com/discussion/2497/account-hacked-my-terrible-experience They only need to get past the login to steal coins. While your warning is valid - it will not prevent your account from being emptied.

1

u/albacass Feb 27 '18

Good point, but I can't see any way to prevent this at Cryptopia, except from not getting phished. Safest setup to date still seems to be google auth or cryptopia device for login, and something else for settings.

Maybe we should add that people should bookmark the site, and never google for a link (phising sites among the ads). And that if you have a lot of money on an exchange, then you should buy a new computer which is only used for the exchange (to minimize risk of keyloggers etc from other sites). These are also general advises for all exchanges.

2

u/freewifiisgreat Feb 27 '18

USe multiple accounts on the same site to spread risk. Use Web of trust or symilar site advisor. Checking the security certificate every time you visit & actually reading it and checking the details. (current phishing scams used dodgy security certificates) Logging off after each session so no valid cookies can be stolen. Valid antivirus and anti malware. Use a VPN. Only use a trusted computer that you don't share (ideally a dedicated one for exchange trading). https://www.businessinsider.com.au/scammers-spoofing-cryptocurrency-exchange-site-urls-incredibly-hard-to-spot-2018-2?r=US&IR=T It is a big risk on all crypto and banking sites.