Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

500k Bitcoins traded in 1h, Mt.Gox market hacked + crash

bitcoincharts.com

Post reply on HN
Print view View original

221–230 of 262 posts

Re: 500k Bitcoins traded in 1h, Mt.Gox market hacked + crash

#221

Post by iki23 »

buro9 wrote: post #39

From the mt.gox site: Huge Bitcoin sell off due to a compromised account - rollback The bitcoin will be back to around 17.5$/BTC after we rollback all trades that have happened after the huge Bitcoin sale that happened on June 20th near 3:00am (JST). Service should be back by June 20th 10:00am (JST, 01:00am GMT) with all the trades reversed and accounts available. One account with a lot of coins was compromised and w…

[Update - 2:06 GMT] What we know and what is being done.

* It appears that someone who performs audits on our system and had read-only access to our database had their computer compromised. This allowed for someone to pull our database. The site was not compromised with a SQL injection as many are reporting, so in effect the site was not hacked.

* Two months ago we migrated from MD5 hashing to freeBSD MD5 salted hashing. The unsalted user accounts in the wild are ones that haven't been accessed in over 2 months and are considered idle. Once we are back up we will have implemented SHA-512 multi-iteration salted hashing and all users will be required to update to a new strong password.

* We have been working with Google to ensure any gmail accounts associated with Mt.Gox user accounts have been locked and need to be reverified.

* Mt.Gox will continue to be offline as we continue our investigation, at this time we are pushing it to 8:00am GMT.

* When Mt.Gox comes back online, we will be putting all users through a new security measure to authenticate the users. This will be a mix of matching the last IP address that accessed the account, verifying their email address, account name and old password. Users will then be prompted to enter in a new strong password.

* Once Mt.Gox is back online, trades 218869~222470 will be reverted.

https://support.mtgox.com/entries/20208066-huge-bitcoin-sell...

Re: 500k Bitcoins traded in 1h, Mt.Gox market hacked + crash

#222

Post by dekz »

iki23 wrote: post #221
buro9 wrote: post #39

From the mt.gox site: Huge Bitcoin sell off due to a compromised account - rollback The bitcoin will be back to around 17.5$/BTC after we rollback all trades that have happened after the huge Bitcoin sale that happened on June 20th near 3:00am (JST). Service should be back by June 20th 10:00am (JST, 01:00am GMT) with all the trades reversed and accounts available. One account with a lot of coins was compromised and w…

[Update - 2:06 GMT] What we know and what is being done. * It appears that someone who performs audits on our system and had read-only access to our database had their computer compromised. This allowed for someone to pull our database. The site was not compromised with a SQL injection as many are reporting, so in effect the site was not hacked. * Two months ago we migrated from MD5 hashing to freeBSD MD5 salted hash…

I for one certainly wouldn't be going back. [MD5] is enough to tell me they only half heartedly care about securing user data, no matter how many buzz words they throw in now.

Re: 500k Bitcoins traded in 1h, Mt.Gox market hacked + crash

#223

Post by aquarin »

aquarin wrote: post #167
aquarin wrote: post #160

Earlier quoted context omitted.

I should say it again: This monetary system have no authority behind it and as such is going to nowhere. Disclaimer: I work as financial analytic and at least have some knowledge of how money work.

Let me explain what I mean: "Real" money are just a tokens, transferring the "Trust" between one market participant to authority and other market participant to authority. By "trust" I mean that every participants believe that Rules in the market will be followed. When you have N market participants you have N*(N-1)/2 ways to exchange "trust". If I understand correctly Bitcoin is N to N system. When you have Authorit…

I pretty well understand that there are rules that are technically implemented to be enforced (protocols, cryptography etc) but when there is some problem in the system (hacking, fraud etc.) there is no one to enforce fairness. The value of given currency is not based only on technical implementations but on trust. In this case the trust and Authority is the technical implementation of this protocol (all bitcoin markets participating). The technical implementation cannot self improve. You can only trust that technical implementation (cryptography, protocols etc) are implemented as specified.

Re: 500k Bitcoins traded in 1h, Mt.Gox market hacked + crash

#224

Post by leon_ »

rorrr wrote: post #184
lubos wrote: post #163

Earlier quoted context omitted.

you can recognize salted hashes from unsalted ones just by looking at them? open the file and search for 5f4dcc3b5aa765d61d8327deb882cf99, at least 1,600 passwords in that list are unsalted. (those without $1$)

5f4dcc3b5aa765d61d8327deb882cf99 = md5("password") for those who don't know Man, these programmers are fucking amateurs. It's a FUCKING TRADING PLATFORM.

I find it funny that people are outraged about unsalted MD5 yet they use passwords like "secret123" that are found in every wordlist.

Guess what: Even salted hashes won't save your ass with such weak passwords. And yes: it's a FUCKING TRADING PLATFORM you want to put money on so _you_ should think of a secure password.

Re: 500k Bitcoins traded in 1h, Mt.Gox market hacked + crash

#225

Post by leon_ »

skrebbel wrote: post #9

i must admit i'm somewhat impressed how fast the hackers and cheaters managed to take over bitcoin trading. i think it's kind of cute. people hoped for an economy no government could control, and got exactly that: anarchy and a burning world.

well the IRL exchanges are run by cheaters and there's not much anarchy around yet.

Re: 500k Bitcoins traded in 1h, Mt.Gox market hacked + crash

#226

Post by danenania »

potatolicious wrote: post #173
gst wrote: post #96

Earlier quoted context omitted.

You don't necessarily have to be a security expert to use Bitcoins, just if you want to run the client by yourself. If you don't have the required knowledge just pay a little bit to a "Bitcoin bank" that handles the task for you. In the real world you also don't carry your money with you all the time, but store it on a bank.

Wait, so this is the train of thought for Bitcoin: - Centralized money is bad! We need to create a perfectly decentralized, distributed economy! - Oh no! It turns out that the average Joe will get burned really badly by this new decentralized system! - But wait! What if we created these things called "banks" and provide people peace of mind and security by taking on some of this risk?! - ...? - Um... not profit.

Did you somehow get the idea that bitcoin users are against banking? Banking (as a concept) and decentralized money are not at odds.

Re: 500k Bitcoins traded in 1h, Mt.Gox market hacked + crash

#227

Post by mehwoot »

kristofferR wrote: post #65
wmf wrote: post #56

Earlier quoted context omitted.

But if you bought a bunch of BTC at $0.01 and then withdrew them, Mt.Gox should have irreversibly sent that over the real Bitcoin network.

Yeah, but my guess is that not many people managed to withdraw them because of the stability problems the site had/have. Mt.Gox will probably have some losses, but not that high I think.

This exactly. People _could_ have withdrawn a bunch, but mostly that didn't happen.

Re: 500k Bitcoins traded in 1h, Mt.Gox market hacked + crash

#228

Post by nazgulnarsil »

This is an "I told you so" post, but not about bitcoin, about the current exchanges.

I haven't cashed out any bitcoins because the current exchanges are a fucking joke and I've said as much many times in the IRC channel and forums. Bitcoins will remain a novelty for people with lots of disposable income until it has a real money changing service linking it to other exchanges. I can not conceive of the level of folly it would take for me to put anything more than pocket money on one of the current exchanges.

Re: 500k Bitcoins traded in 1h, Mt.Gox market hacked + crash

#229

Post by aquarin »

etherael wrote: post #206
aquarin wrote: post #167

Earlier quoted context omitted.

Let me explain what I mean: "Real" money are just a tokens, transferring the "Trust" between one market participant to authority and other market participant to authority. By "trust" I mean that every participants believe that Rules in the market will be followed. When you have N market participants you have N*(N-1)/2 ways to exchange "trust". If I understand correctly Bitcoin is N to N system. When you have Authorit…

Trust that the participants in the market will behave in accordance with established rules on penalty of punishment of human administered centralised authority is one thing, trust that mathematical truths governing how cryptography works is completely another. If the latter does not hold, the financial institutions which you claim to be employed by are in a lot more hot water than they would be if it does and bitcoin…

You always need governing authority to enforce the rules, just because the cryptography protocol can not handle all the possible situations of human interactions and because money have no intrinsic value. Value is determined by the level of trust to Authority transferred by different communication channels and protocols (encrypted messages, paper with special printings etc.) In the case of Bitcoin it is not necessary to be Government Authority.

Re: 500k Bitcoins traded in 1h, Mt.Gox market hacked + crash

#230

Post by norswap »

iki23 wrote: post #221
buro9 wrote: post #39

From the mt.gox site: Huge Bitcoin sell off due to a compromised account - rollback The bitcoin will be back to around 17.5$/BTC after we rollback all trades that have happened after the huge Bitcoin sale that happened on June 20th near 3:00am (JST). Service should be back by June 20th 10:00am (JST, 01:00am GMT) with all the trades reversed and accounts available. One account with a lot of coins was compromised and w…

[Update - 2:06 GMT] What we know and what is being done. * It appears that someone who performs audits on our system and had read-only access to our database had their computer compromised. This allowed for someone to pull our database. The site was not compromised with a SQL injection as many are reporting, so in effect the site was not hacked. * Two months ago we migrated from MD5 hashing to freeBSD MD5 salted hash…

"We have been working with Google to ensure any gmail accounts associated with Mt.Gox user accounts have been locked and need to be reverified."

Ah, that's why I had to change my password then.

Post reply on HN