Quote from: Rishodi on April 18, 2014, 06:56:39 PM

This is the reply which I have posted on the LocalBitcoins blog:

Quote

From the given information, the theft depended on 1) session hijacking and 2) compromised 2FA. Although this is certainly indicative of a compromised user device, LocalBitcoins needs to take more aggressive action to inhibit session hijacking.

Even with 2FA enabled, requests which originate from a user with a different IP address and browser than that which was recorded at the initiation of a session should be responded to by immediately destroying that session and asking the user to reauthenticate. In this particular case, the withdrawal request was associated with an IP address and user agent header which were distinguishably different from that which was recorded at the start of the session. As a result, the request should have been flagged as suspicious and denied.

Of course, such policies may not have been able to prevent the theft in this particular case. If the attacker was able to gain not merely read-only permissions but also execution permissions on the user's device, then the attacker could have sent the request directly from the user's device using the existing session, and the request would not appear suspicious to the server. If the attacker was able to access both the user's password and 2FA code, then the attacker could simply establish a new session from anywhere and subsequently send the withdrawal request.

Nonetheless, it is alarming to find that the security of session management at LocalBitcoins is certainly lacking. Taking a more proactive approach to session security would help to inhibit attacks and bolster trust in the LocalBitcoins platform. A good technical overview of the topic can be found here: https://wblinks.com/notes/secure-session-management-tips/

For anyone who uses LocalBitcoins, the safest course of action is to 1) enable 2FA and 2) logout after every session. Logging out will close the user session, and with no active sessions you are not susceptible to a session hijack attempt.

Thanks for the input Rishodi ! Is a session logout possible with an Active listing?