Quote from: ozboy2014 on August 02, 2015, 03:05:33 PM

Quote from: mitchellmint on August 02, 2015, 02:31:10 PM

Quote from: trader19 on August 02, 2015, 01:53:34 PM

Quote from: go6ooo1212 on August 02, 2015, 01:38:33 PM

I got hacked today through one of axioms CPU miners. Beware mates , all the appdata content were downloaded...

not so long i lost all my crave and various ppl are reporting of different hack on different coins getting stolen. funny thing is i believe there is some sort of 0day exploit as recently malwarebyte blocked one IP trying to remote control axoim running wallet. maybe someone with skills could explore that area.

Quote from: keesdewit on August 02, 2015, 12:53:33 PM

Rainbow tables can still be usefull for weak private keys. As I have read the private key can be a sha256 hash of every possible (non zero) input. Now if you take a dictionary of common words there is a change of hitting a valid private key. Like for example 'sausage' if you hash the string 'sausage' and import the (base58 encoded) outcome in your bitcoin wallet you will see that it was used. They are als usefull for keys generated with weak random number generators (like in Android or Java). I investigated the hack where I lost my coins and I do not think it was done with a trojan. My geuss is that the axiom wallet rpc interface is vulnerble for buffer overflow or maybe it uses a weak random generator. I am still investigating it, but my network logging does not show signs of a trojan.

getting closer?

make sure you add this to your conf file

rpcallowip=127.0.0.1

There are people out there that ping the nodes and try the blogged username and passwords. It only takes a couple seconds before you loose everything once they have RPC access.

So binding the above ip and using alphanumeric user name and password should be sufficient?

Ummmm. .. someone's going to answer me question? Grin