Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

500k Bitcoins traded in 1h, Mt.Gox market hacked + crash

bitcoincharts.com

Post reply on HN
Print view View original

151–160 of 262 posts

Re: 500k Bitcoins traded in 1h, Mt.Gox market hacked + crash

#151

Post by olex »

jaekwon wrote: post #29
andypants wrote: post #19

Earlier quoted context omitted.

Who is 'they'? As far as I understood bitcoin, there is no authority. Nobody can do anything about a user having 500k of his coins hacked, and nobody can do anything about the market crash either.

as far as i know you're right. there is no infrastructure for rollbacks of any kind.

MtGox != Bitcoin. Transactions on bitcoin network cannot be undone, that is true; however, MtGox will undo the transactions inside their system (buys and sells within MtGox). The only thing that cannot be undone is the withdrawal of 80 stolen BTC from a MtGox account into Bitcoin network.

Re: 500k Bitcoins traded in 1h, Mt.Gox market hacked + crash

#152

Post by soult »

tlrobinson wrote: post #78

There's an alleged database dump of Mt Gox floating around... https://twitter.com/#!/954/status/82531189705019392 UPDATE: looks legit. http://forum.bitcoin.org/index.php?topic=19543.0 https://support.mtgox.com/entries/20208066-huge-bitcoin-sell...

I can confirm that the alleged dump is the real deal.

Some passwords are md5 hashes, some are salted md5 hashes (utilizing the crypt[0] function). I did not log in for a long time and my password was still unsalted, so I assume that converting to salted passwords was done either automatically on login or on password changes.

0: http://www.kernel.org/doc/man-pages/online/pages/man3/crypt....

Re: 500k Bitcoins traded in 1h, Mt.Gox market hacked + crash

#153

Post by [deleted] »

eis wrote: post #60

Newest update: Apparently someone got the whole user account database of Mt.Gox I wont publish the link to it though for obvious reasons. Quick analysis: the database is legit, it contains user id, username, email if set, and a bcrypt hash. The hashes seem salted with a global salt.

[deleted]

Re: 500k Bitcoins traded in 1h, Mt.Gox market hacked + crash

#154

Post by xfs »

eis wrote: post #60

Newest update: Apparently someone got the whole user account database of Mt.Gox I wont publish the link to it though for obvious reasons. Quick analysis: the database is legit, it contains user id, username, email if set, and a bcrypt hash. The hashes seem salted with a global salt.

About 1600 passwords in this database are hashed with plain md5 without salt. I found quite a lot hits (34% success rate) using a rainbow table cracker.

Re: 500k Bitcoins traded in 1h, Mt.Gox market hacked + crash

#155

Post by drpancake »

olex wrote: post #126
Tichy wrote: post #110

Earlier quoted context omitted.

Doesn't look as if passwords were salted, though :-( (Edit: just read in another comment that there seems to have been a global salt)

They were hashed using the standard php crypt() method, it generates a salt for every password encrypted. I'm in that database and was able to generate the exact hash. Luckily I use one-time passwords with such things...

The salt is one of the other fields in the row? I'm pretty sure I used unimportant password, but I can't remember for sure!

Re: 500k Bitcoins traded in 1h, Mt.Gox market hacked + crash

#156

Post by jtchang »

lubos wrote: post #118
kristofferR wrote: post #88

Earlier quoted context omitted.

Damn, I'm in there. Glad I used a generated password (from LastPass) so I don't have to change my passwords on a lot of various sites.

this is the only way to fight incompetence of some websites. those passwords are (most likely) unsalted vanilla MD5 hashes. just entered a few of them into google from that file and yes, many of them are present in rainbow tables. damn. makes me angry as a programmer how financial website can be this unsecure and easy to compromise.

They look like salted hashes to me.

Re: 500k Bitcoins traded in 1h, Mt.Gox market hacked + crash

#157

Post by bradleyland »

soult wrote: post #152
tlrobinson wrote: post #78

There's an alleged database dump of Mt Gox floating around... https://twitter.com/#!/954/status/82531189705019392 UPDATE: looks legit. http://forum.bitcoin.org/index.php?topic=19543.0 https://support.mtgox.com/entries/20208066-huge-bitcoin-sell...

I can confirm that the alleged dump is the real deal. Some passwords are md5 hashes, some are salted md5 hashes (utilizing the crypt[0] function). I did not log in for a long time and my password was still unsalted, so I assume that converting to salted passwords was done either automatically on login or on password changes. 0: http://www.kernel.org/doc/man-pages/online/pages/man3/crypt....

I hate to look down my nose at other programmers, because I understand that we all start somewhere, but if you are building a financial exchange and you encrypted passwords using unsalted MD5 at any point in the history of your product, you have proven to me that you are learning as you go, and there is no way in hell I'd trust you with any significant sum of money.

Re: 500k Bitcoins traded in 1h, Mt.Gox market hacked + crash

#158

Post by mike_esspe »

danielsoneg wrote: post #99
wmf wrote: post #93

Earlier quoted context omitted.

I would argue that it's not the same thing, since people use Mt.Gox voluntarily. We can expect no-rollback exchanges to appear any day now.

Do they? It's by far the largest BTC exchange - by a factor of ~50 or so. If you want to exchange more than a couple hundred BTC, they're the only game in town right now.

You can't unsubscribe yourself and your property from the government services, but you can from mtgox. That's the difference.

Re: 500k Bitcoins traded in 1h, Mt.Gox market hacked + crash

#159

Post by dataangel »

rmc wrote: post #144
hollerith wrote: post #121

Earlier quoted context omitted.

It is pretty clear that Mt Gox rolled back all trades from now to the first big unauthorized trade.

So if you had already done a legitimate trade it's gone? "Sorry you made some money there, but someone else got affect by something else, so we've undone that". So much for "There are no chargebacks on BitCoin"

You don't understand. There is a difference between the currency and the exchange. The exchange stores the trades internally without actually doing any bitcoin transactions until the time of withdrawal.

Re: 500k Bitcoins traded in 1h, Mt.Gox market hacked + crash

#160

Post by aquarin »

weavejester wrote: post #143
aquarin wrote: post #127

Earlier quoted context omitted.

Probably. I regret each time i comment here, but I attribute this to the cultural differences between California based NH-users and the rest of the world.

It's not cultural differences between California and the rest of the world. It's simply that your statements indicate you're commenting without an understanding the subject matter. This incident occurred because (a) people with large amounts of bitcoin do not always store them securely, and (b) the bitcoin market is very small, and therefore can be destabilised by relatively small amounts of money (a few million doll…

I should say it again: This monetary system have no authority behind it and as such is going to nowhere. Disclaimer: I work as financial analytic and at least have some knowledge of how money work.
Post reply on HN