Question about protecting Electreum wallet data file

[yhiaali3]

Hello. Greetings to everyone.
On the occasion of the opening of the technical Section, I had a question that I would like to raise here for discussion

Some time ago, my laptop was hacked and the hacker was able to steal the Electreum wallet data file, and after that he was able to open the wallet. I do not know how, but he was able to open the wallet and steal the balance.

Several questions come to mind:
1 - How was the hacker able to open the wallet file even though I was using a very strong password?

2 - Are there other ways to encrypt the wallet file other than the password so that it makes things more difficult for the hacker to open the file?

3- Is it possible to access the private key in such a case? I mean, can a hacker access the private key through the wallet's data file?

4 - The last question is hypothetical: I know that there is a possibility of creating an Electreum wallet with two-factor authentication 2FA. In such a case, if I enable two-factor authentication, can a hacker access the wallet even if he manages to obtain the password?

[ABCbits]

Several questions come to mind:
1 - How was the hacker able to open the wallet file even though I was using a very strong password?

2 - Are there other ways to encrypt the wallet file other than the password so that it makes things more difficult for the hacker to open the file?

3- Is it possible to access the private key in such a case? I mean, can a hacker access the private key through the wallet's data file?

4 - The last question is hypothetical: I know that there is a possibility of creating an Electreum wallet with two-factor authentication 2FA. In such a case, if I enable two-factor authentication, can a hacker access the wallet even if he manages to obtain the password?

Short answer to your questions.
1. Usually it's due to keylogger where the hacker wait for you to open Electrum and enter password.
2. Yes, such as using yubikey. But you still need to perform decryption twice which makes it not practical.
3. Theoretically possible, assuming he has access to your computer.
4. Yes, but he can't steal your Bitcoin without 2FA code.

[examplens]

Several questions come to mind:
1 - How was the hacker able to open the wallet file even though I was using a very strong password?

A few years ago, I had the misfortune of being hacked, most likely via a keylogger. It was quite painful.
Here is an interesting fact. One secondary wallet, where I was testing something and in the meantime, I forgot the password for it. Well, the hacker also knew that password and cleared that address as well.

[yhiaali3]

Short answer to your questions.
1. Usually it's due to keylogger where the hacker wait for you to open Electrum and enter password.

I also think so, as I think the hacker was able to record the password via a keylogger after I opened the wallet to make a transaction.

2. Yes, such as using yubikey. But you still need to perform decryption twice which makes it not practical.

Do you mean encrypting the data file itself using yubikey? So you need to decrypt every time you want to enter the wallet, annoying but more secure?

Short answer to your questions.
4. Yes, but he can't steal your Bitcoin without 2FA code.

So this is the most secure option although it costs an additional fee per transaction when two-factor authentication is enabled.

A few years ago, I had the misfortune of being hacked, most likely via a keylogger. It was quite painful.
Here is an interesting fact. One secondary wallet, where I was testing something and in the meantime, I forgot the password for it. Well, the hacker also knew that password and cleared that address as well.

Really unfortunate, this is what happened to me as well. I expect that the hacker was able to steal the password via a keylogger and then open the wallet and withdrew the balance.

[ABCbits]

2. Yes, such as using yubikey. But you still need to perform decryption twice which makes it not practical.

Do you mean encrypting the data file itself using yubikey?

To be exact, storing password or encryption key on YubiKey with using encryption software which support YubiKey. Here's an example, https://support.yubico.com/hc/en-us/articles/360013790259-Using-Your-YubiKey-with-OpenPGP.

So you need to decrypt every time you want to enter the wallet, annoying but more secure?

Yes.

Short answer to your questions.
4. Yes, but he can't steal your Bitcoin without 2FA code.

So this is the most secure option although it costs an additional fee per transaction when two-factor authentication is enabled.

I don't think it's most secure when other option (such as using Electrum on airgapped laptop) exist. And FYI, you pay for every 20 or 100 transaction these days. See https://trustedcoin.com/#/faq.

[Yamane_Keto]

1 - How was the hacker able to open the wallet file even though I was using a very strong password?

hackers may records the screen if you try to avoid using the keyboard to enter the password. This all depends on the access permissions that hackers can gain.

I know that there is a possibility of creating an Electreum wallet with two-factor authentication 2FA. In such a case, if I enable two-factor authentication, can a hacker access the wallet even if he manages to obtain the password?

It is better create a multi-signature wallet to avoid a single point of failure, You can have 2-of-4 Multisig Wallet, where you will need two signatures from 4 devices, or 3-of-4, all of which are solutions that will increase the complexity of the sending process, but there will not be a single point of failure.

[bitmover]

Some time ago, my laptop was hacked and the hacker was able to steal the Electreum wallet data file, and after that he was able to open the wallet. I do not know how, but he was able to open the wallet and steal the balance.

Sorry for your loss.

How were you hacked? Can you share some of the lessons you learned? What did you do wrong?

99% of my coins are in a hardware wallet, but I was never hacked AFAIK.

[yhiaali3]

Sorry for your loss.

How were you hacked? Can you share some of the lessons you learned? What did you do wrong?

Thank you
Actually, I don't know exactly, but I think the main mistake was downloading crack from the Internet. I used Windows 10 and downloaded the crack for a video converter program, and then the problems started.

Although I know the danger of cracks, unfortunately I live in a country that is banned from most services and we do not have legal programs, so I am forced to download cracked programs, and although I downloaded many cracks before, I did not have any problems, and the site from which I downloaded the crack seemed safe to me. It has nothing to do with Crypto, but the incident occurred after downloading the last file, so I guess it is the reason.

Several days after downloading the file, I opened the wallet, made a transaction, and sent some Bitcoin to the exchange, and the balance was still there, but after a few days, I opened the wallet to check the balance and was surprised that my balance was 0, and about $750 of Bitcoin that was in the wallet had been transferred to an unknown address.

I expect that the hacker was able to inject the keylogger program into my device, and after I opened the wallet, he was able to obtain the password, open the wallet, and steal the balance.

Of course, after the incident, I repartitioned the hard drive, erased everything, reinstalled a new system, and increased security, but it was too late. Although the amount was not very large, it was a harsh experience for me, and the most important lesson I learned is not to trust any file on the Internet and not to be complacent with safety procedures.

[bitmover]

Although I know the danger of cracks, unfortunately I live in a country that is banned from most services and we do not have legal programs, so I am forced to download cracked programs, and although I downloaded many cracks before, I did not have any problems, and the site from which I downloaded the crack seemed safe to me. It has nothing to do with Crypto, but the incident occurred after downloading the last file, so I guess it is the reason.

That is probably the cause.

I used to download a lot of cracked software in the past, but I do not anymore. Basically all software that I have in my computer are genuine now... even Microsoft Office (which is very cheap nowadays, and were basically all cracked few years ago)

[yhiaali3]

That is probably the cause.

I used to download a lot of cracked software in the past, but I do not anymore. Basically all software that I have in my computer are genuine now... even Microsoft Office (which is very cheap nowadays, and were basically all cracked few years ago)

I wish I could get paid programs. My problem is not with payment, but my main problem is that I live in Syria, where, as you know, all online payment services are banned.

I tried to find a way to buy the original software through Crypto, but I could not find it. I tried the free, open source software, but it was not as efficient as the paid software, so I was forced to download cracked software.

Of course, after what happened to me, I decided to use open source programs, even if their efficiency was less.

[Husna QA]

-snip-
I tried to find a way to buy the original software through Crypto, but I could not find it. I tried the free, open source software, but it was not as efficient as the paid software, so I was forced to download cracked software.

Of course, after what happened to me, I decided to use open source programs, even if their efficiency was less.

If you can't switch to open-source software for your main work, You can use Tails OS and install Electrum on that OS in a portable way (I recommend manually installing the latest version of Electrum).
- https://tails.net/
- https://electrum.readthedocs.io/en/latest/tails.html

There is a charge for using the 2FA wallet option on Electrum. Alternatively, you can use a multi-signature wallet on two different devices.

[bitmover]

I wish I could get paid programs. My problem is not with payment, but my main problem is that I live in Syria, where, as you know, all online payment services are banned.

Can't you buy digital software in Amazon using visa.?

Wow, I was not aware of this situation in Syria. Bitcoin is even more important to you.

I think you might be able to get some softwares using this bitrefill or similar services.

[dkbit98]

I wish I could get paid programs. My problem is not with payment, but my main problem is that I live in Syria, where, as you know, all online payment services are banned.

Why don't you just switch to some good Linux OS like Fedora, Debian or Mint?
This are all free open source operating systems and most of the software is very good and free, but important thing is that you won't have any more problems with malware and hackers.
Most bitcoin and crypto related stuff is working fine, and there are plenty alternatives for general purpose software, there is even Adobe software package that works perfectly in Linux.

[yhiaali3]

If you can't switch to open-source software for your main work, You can use Tails OS and install Electrum on that OS in a portable way (I recommend manually installing the latest version of Electrum).
- https://tails.net/
- https://electrum.readthedocs.io/en/latest/tails.html

Thank you for the links, this is really cool. I installed Linux on a flash drive to use electrum, but I did not know about tails. It looks very cool and safer to use electrum, I will try it.

Can't you buy digital software in Amazon using visa.?

Wow, I was not aware of this situation in Syria. Bitcoin is even more important to you.

I think you might be able to get some softwares using this bitrefill or similar services.

Amazon and Visa completely ban Syria. I cannot use Visa or any electronic payment card, but I have not tried bitrefill before. I will try it and tell you the result.

Of course, Bitcoin is the best and most important option for me, but the problem is with third-party services that block Syria due to the American embargo.

Why don't you just switch to some good Linux OS like Fedora, Debian or Mint?
This are all free open source operating systems and most of the software is very good and free, but important thing is that you won't have any more problems with malware and hackers.
Most bitcoin and crypto related stuff is working fine, and there are plenty alternatives for general purpose software, there is even Adobe software package that works perfectly in Linux.

Frankly, I have been accustomed to the Windows system for a long time, but after the incident I tried installing Debian Linux on a flash drive and working on it when using Electreum or things related to Crypto that require more security. Now I think I will try tails and if I like it I will always use it.

Thank you all for the tips

[Husna QA]

If you can't switch to open-source software for your main work, You can use Tails OS and install Electrum on that OS in a portable way (I recommend manually installing the latest version of Electrum).
- https://tails.net/
- https://electrum.readthedocs.io/en/latest/tails.html

Thank you for the links, this is really cool. I installed Linux on a flash drive to use electrum, but I did not know about tails. It looks very cool and safer to use electrum, I will try it.

Tails OS provides built-in Electrum, but I recommend installing the latest version of Electrum yourself.
The following is an example of Electrum on Tails OS that I have tried:

Considering that the storage media uses a flash drive, it is also necessary to consider several shortcomings that generally occur in flash drives.
However, the main thing is to ensure you save the seed phrase properly for the recovery process if there is a problem with the device.