5

I own a crypto currency website and host a wallet on a VPS, for thew past 3 months someone has been removing coins (very little amounts at a time) from the wallet and i have no clue how, here are the details i have:

All server run ubuntu 14.0 on a VPS

I am protected with cloudflare: with the highest level of free security they offer

I have a loadbalancer using ha proxy to redirect to my application server

my application server is then linked to a wallet(transaction) server and a mysql db server

transaction commands are given by the user , the appplication serve immediately sends the command to the wallet server and the funds are transfered instantly

so from wahat i can see, the attacker is removing coins in many but very small transactions, so its likely all automated,


steps taken:

1)after changing my application server and wallet server completely (from scratch and new ip address) the hacker removed coins almost instantly (within 10-15 minutes)

2)after remaking and changing my sql server , same thing , hacked within minutes

so i initially thought that taking step 1) would somehow hide my server ip (cloudflare, laodbalancer) from the attacker and would make it hard for him to hack again, but it didnt even make them blink

i then though that he may have brute forced my mysql server password. this would mean he was increasing his balance(in the db), withdrawing through the site and then deleting the records of withdrawal, but after changing the server and password,in step 2), he still managed to withdraw funds within minutes


my next solution will be to create a database table that holds the withdrawal commands and then the transaction server can independently fetch those withdrawals and i can also set limits there,

i just wanted to know what people think before i go through this effort and if i could be missing something obvious to someone else (although i know none of this brings much if enough details)

thanks in advance for the help, it is truly appreciated, at the moment my site cant operate because of this :/

PS: if you need more info please let me know

closed as too broad by schroeder, Philipp, Mark, tylerl, Adi Apr 20 '15 at 8:49

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • Is it possible someone has hacked something other than your wallet? Something that's stored or used on a different commputer. Perhaps private keys or passwords? The "hacked within minutes" just makes me wonder if it's unrelated to your VPS. – Neil Smithline Apr 19 '15 at 20:43
  • well I've been changing the wallet.dat file every 2 or three weeks and i dont keep backups anywhere so i dont think so, but thanks for feedback, ill try to think of soemthing along those lines – beepbaapboom Apr 19 '15 at 21:00
  • If you're not providing a service to anyone, perhaps decouple your dns name from the ip address, setup a fake service somewhere, and wait for the connect. If your machine is already compromised, and it is not meant to be heavily trafficked, wait to see if an outgoing connection happens. – munchkin Apr 20 '15 at 1:53
1

To recap:

  • You changed application server
  • You changed network parameters
  • You changed database server

Still to no avail. What's logically left, then is:

  • Your application
  • The load balancer

I assume the HA load balancer doesn't do much and is part of Cloudflare's services. Therefore, looks like your web application is the vulnerable point.

  1. Have you considered getting it pentested?
  2. Do you have multiple users/passwords?
  3. Are you the only person with access to that server, or do you share admin credentials with other people?
  4. Are you sure you're not rounding off values in whatever software you use? Did you check the blockchain against a third party to verify that small amounts are actually being transferred from your wallet?

If everything else fails start auditing your own computer or access methods: perhaps, as one of the comments suggest, your computer is compromised.

  • Thank you very much for your response, so for 2)only one user 3)I'm the only one with the info 4)yep I'm sure, i found what address they are sending all the coins to. so only 1) is left , do you recommend any particular service for pentesting? – beepbaapboom Apr 20 '15 at 22:43
  • @beepbaapboom DISCLAIMER - I should not recommend any particular company, as I work for a web app pentesting company. However, I'm sure there are many both in your area or online that can help. My only word of advice is: you pay for what you get. – lorenzog Apr 21 '15 at 8:48

Not the answer you're looking for? Browse other questions tagged or ask your own question.