Bitcoin-thieving Trojans appear in the wild

A pair of Trojans are targeting the Bitcoin digital currency, according to two security companies.

Two Trojans are targeting the Bitcoin digital currency, according to two security firms. Photo credit: Bitcoin

The Trojans — InfoStealer.Coinbit and CoinBit.A — attempt to steal the wallet.dat file that holds the Bitcoin virtual currency and email it to the attacker, according to Symantec and F-Secure. "This is a snatch and grab," F-Secure wrote in a blog post on Friday.

Bitcoin is an encrypted, peer-to-peer (P2P) currency, in existence since 2009, designed as an alternative to government-controlled currencies. It makes it possible to digitally purchase goods and services. It has seen its value rocket recently, reaching $30 (£19) per Bitcoin on some online exchanges.

Both Trojans were found on Bitcoin user forums, potentially affecting all forum members if they were to click infected links. The Trojans were delivered via phishing links showing images, according to users of the Bitcoin forum.

The CoinBit.A Trojan works by scanning the local computer for the directory where the wallet is typically located. If it finds the file, it sends it to a Hotmail address via a Polish server.

Less is known about the InfoStealer.Coinbit Trojan that Symantec reported on Thursday night, other than that it also looks for the wallet.dat file in the same location and uses FTP to upload it to the attacker's server.

"We expect that code... will find a way into other malware, considering the amount of attention this sort of attack is currently receiving and with the amount of Bitcoins currently available for purchase," Symantec wrote in a blog post.

There will be more attacks, including botnets that mine coins. So, be careful and store your wallet.dat offline.

– Mikko Hypponen, F-Secure

To protect themselves against Bitcoin theft, users are advised to store their Bitcoin wallet.dat file offline, although this is difficult as the currency is only developed and used online.

"There will be more attacks, including botnets that mine coins. So, be careful and store your wallet.dat offline," Mikko Hypponen, the chief research officer of F-Secure, told ZDNet UK.

"Looking at an underground forum, we see someone has posted source code on there as well," Peter Coogan, a security response manager for Symantec, told ZDNet UK. "We expect other people will use that code to update their Trojans." Coogan said Symantec anticipates seeing the code worked into more general banking Trojans as an additional attack vector.

Previously, Symantec tracked the emergence of Bitcoin-mining botnets that used hundreds of bots to farm the currency on a variety of machines.

An encrypted, P2P currency

Bitcoin is an encrypted, untraceable, virtual currency. It uses a P2P network in tandem with a downloadable software package to distribute the currency and to increase the money supply. As opposed to typical currencies, where a central bank grows the money supply via a range of financial instruments, Bitcoins are instead "mined" by the users of the service.

The money supply is algorithmically capped. As of June, there are around 6.5 million Bitcoins in existence and these can only grow to 21 million over time.

Bitcoin can be changed with other currencies via online exchanges. Over time, the value of the currency has rocketed against the US dollar. One exchange — Mt Gox — shows the price starting at $2 per Bitcoin in May 2010, but climbing to a high of around $30 in May 2011, from which it has fallen to a price of $16.98 at the time of writing.

Given the number of Bitcoins in existence, this puts the total possible Bitcoin economy at around $110m, by Mt Gox's figure.

Growing value

By nature, the value of Bitcoins will grow with respect to other currencies over time, as total supply is capped, unless users lose confidence in the service and seek to sell their Bitcoins back to the market.

Some individuals are trading services for Bitcoins. The BitGigs job board shows a variety of people willing to perform jobs ranging from C++ coding to mobile application development and Spanish conversation classes in exchange for Bitcoins.

Mining is achieved by a computer throwing resources at specific mathematical problems, the nature of which shifts with each expansion of the money supply. More resources increase the likelihood that the system will solve the problem and gain Bitcoins.

However, the algorithms that control the creation of the currency are designed to make each round of mining exponentially more difficult, and it is in this way that limits are imposed on the supply.