Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Breaking open the Mt. Gox case, part 1

blog.wizsec.jp

Post reply on HN
Print view View original

61–70 of 99 posts

Re: Breaking open the Mt. Gox case, part 1

#61

Post by wmf »

jnordwick wrote: post #59
Pyxl101 wrote: post #22

It sounds like MtGox must have had no auditing of their wallets, or completely ineffective auditing. How did they not at least perform a simple sum of coins held by their wallets and compare it against the amount expected by their databases? Or is the attack more sophisticated than this would detect? If I were building a system like this, I'd want to run an auditing system continuously that looks for discrepancies, a…

In trading environments we have a thing called drop copy that is a real-tine feed of what the street thinks the house's trades are. This is constantly compared to what tree house's own view is. This way trade breaks (discrepancies) are caught immediately. The analogy would be scanning the block chain looking for tree firm's account numbers to verify all transactions are accounted for. I don't know for the life of me…

In the early days, Bitcoin exchanges weren't making enough money to pay for "real" engineering. Then things tended to take off so fast that just keeping the site up consumed all its resources.

There were one or two exchanges that did things "right" (e.g. TradeHill) and were immediately driven out of business by their own high costs.

Re: Breaking open the Mt. Gox case, part 1

#62

Post by zapt02 »

buryat wrote: post #2

So according to the following, Vinnik was aware of the origin of bitcoins that were sold on BTC-e: > Some of the funds moved to BTC-e seem to have moved straight to internal storage rather than customer deposit addresses, hinting at a relationship between Vinnik and BTC-e. and he was stupid enough to deposit them back to his account on MtGox: > Moving coins back onto MtGox was what let us identify Vinnik, as the MtGo…

I find the tidbit that he moved the coins back to MtGox to be hilarious, and that being his downfall oddly poetic.

It's like robbing a bank, just to waltz in with their money the following week and deposit it into that same bank.

Re: Breaking open the Mt. Gox case, part 1

#63

Post by zapt02 »

wcummings wrote: post #41
tinco wrote: post #36

Earlier quoted context omitted.

When did you get that? I never received such a card.

Years ago, it stated I was a creditor and was owed some comically tiny amount of BTC I had left in my account. Cool form factor, a sorta sticky postcard sized accordian you would pull apart, japanese on one side, english on the other.

Video of the card (not mine): https://www.youtube.com/watch?v=WYFNAza64PI

Re: Breaking open the Mt. Gox case, part 1

#64

Post by zapt02 »

vesinisa wrote: post #44
FRex wrote: post #28

Earlier quoted context omitted.

The site was originally made for trading Magic The Gathering Online cards by one guy who later got bored and then got into Bitcoin but I have no idea and wikipedia doesn't mention if they reused any code or just the domain name itself. It's a fun piece of trivia one crypto currency guy told me and it seems to be true.

IIRC the site was written in PHP and it was a miracle it didn't get hacked earlier (or, now it seems, it did, but the hackers kept the site running to maximize the heist). https://gist.github.com/alainmeier/9319451

To be fair, PHP by itself is not the issue here, the issue is rather being amateurs (Mark, Ross) who started doing a fun project and ended up brokering millions of dollars without having the experience or opsec of doing so. This is what lead to their downfall.

Re: Breaking open the Mt. Gox case, part 1

#65

Post by mbreese »

viraptor wrote: post #45
FRex wrote: post #28

Earlier quoted context omitted.

The site was originally made for trading Magic The Gathering Online cards by one guy who later got bored and then got into Bitcoin but I have no idea and wikipedia doesn't mention if they reused any code or just the domain name itself. It's a fun piece of trivia one crypto currency guy told me and it seems to be true.

It really bothers me how often people repeat it like it means anything in this case. Like they forget Amazon was just selling books. Also no idea if it still uses any of the old code or just the name itself.

But Amazon still sells books...

The MtGox pivot from trading cards to Bitcoin was pretty dramatic.

Re: Breaking open the Mt. Gox case, part 1

#67

Post by [deleted] »

dragonwriter wrote: post #48
jstanley wrote: post #17

Earlier quoted context omitted.

Lots of people in Bitcoin hate KYC and AML laws, and consider them invasive. I am one of these people. In itself, it's not an indicator of wrongdoing.

Hating KYC/AML law may not be a strong indicator of legal wrongdoing; breaking it, OTOH, is not merely an indicator of legal wrongdoing, but is itself such wrongdoing.

[deleted]

Re: Breaking open the Mt. Gox case, part 1

#68

Post by ZedDogX »

Jabanga wrote: post #4

This would have all been avoided if MtGox had transferred its coins to a new wallet after the 2011 breach. I guess they assumed that any attacker that got access to the private keys would have immediately emptied the wallet, and the fact that this hadn't happened proved that the private keys hadn't been compromised by the breach. I have to admit, that is a reasonable assumption. This may show the limits of the useful…

It's a reasonable assumption, one move in advance. If you are thinking ahead of the immediate next move, then it is not. Clearly the person who outsmarted their security also exploited their naive human assumptions.

Re: Breaking open the Mt. Gox case, part 1

#69

Post by jpdus »

wcummings wrote: post #13
austenallred wrote: post #7

Can't wait to get my refund :) It's still insane to me that MtGox never moved coins to a wallet or acknowledged the breach until long after it was too late. You would think if you have billions of dollars sitting somewhere and you realize someone is starting to take them you would, you know, do something .

>Can't wait to get my refund :) I had like 0.000001 BTC in mtgox and it was worth it for the cute sticky unfoldy postcard thing I got from the Japanese court.

Got that funny card as well :)

Re: Breaking open the Mt. Gox case, part 1

#70

Post by Pyxl101 »

wmf wrote: post #61
jnordwick wrote: post #59

Earlier quoted context omitted.

In trading environments we have a thing called drop copy that is a real-tine feed of what the street thinks the house's trades are. This is constantly compared to what tree house's own view is. This way trade breaks (discrepancies) are caught immediately. The analogy would be scanning the block chain looking for tree firm's account numbers to verify all transactions are accounted for. I don't know for the life of me…

In the early days, Bitcoin exchanges weren't making enough money to pay for "real" engineering. Then things tended to take off so fast that just keeping the site up consumed all its resources. There were one or two exchanges that did things "right" (e.g. TradeHill) and were immediately driven out of business by their own high costs.

I don't buy that argument, if it implies that the site operators were anything but flabbergastingly incompetent.

It's pretty straightforward to compute the sum of all coins in your wallets, I would assume. It's also straightforward to compute the sum of all account deposits tracked by your database. Just knowing those two numbers is really simple stuff, like a single SQL query on the DB. All they need to do is calculate those numbers and report on it daily or weekly and they'd have detected the fraud the very first time coins were taken.

Post reply on HN