Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I'm the guy who bought 259684 Bitcoins for under $3000 yesterday

forum.bitcoin.org

Post reply on HN
Print view View original

71–80 of 319 posts

Re: I'm the guy who bought 259684 Bitcoins for under $3000 yesterday

#71

Post by marshray »

vessenes wrote: post #57
swah wrote: post #29

The stolen user hasn't reported until now, it seems. From one of the comments: "It was definitely all our bitcoins that mtgox had in one account! I remember a few days before, people saying that some big bitcoin movements on bitcoin monitor were from mtgox, and the quantity being moved was around 400 000 to 500 000 bitcoins. No single user lost that quantity, it was our coins, from all of us!"

This is absolutely not how the Mt. Gox database works. I know because I have access to the source code of the site. You can't post a trade from 'all' accounts; if a large trade pushed the price down, then a large trade pushed the price down, and that trade was executed from a single account. Given Mark's statement that the logins which had been dormant for more than a few months were the easily rainbow-table attacked…

This is absolutely not how the Mt. Gox database works. I know because I have access to the source code of the site.

All that source code you're looking at means nothing if the attacker gained arbitrary SQL execution on the database.

Re: I'm the guy who bought 259684 Bitcoins for under $3000 yesterday

#72

Post by jackolas »

rick888 wrote: post #59

The problems here with Bitcoin come across as the same problems with piracy: Bitcoin are just bits on a computer. Just like piracy, when we copy bits from one place to another, is it really "stealing"? Anyone that says "yes", better double-check their stance on software piracy as well.

Private keys and such are not infinitely reproducible without cost to their value. Cultural value doesn't degrade over popularity/distribution. Apples and oranges.

Re: I'm the guy who bought 259684 Bitcoins for under $3000 yesterday

#73

Post by nowarninglabel »

rick888 wrote: post #59

The problems here with Bitcoin come across as the same problems with piracy: Bitcoin are just bits on a computer. Just like piracy, when we copy bits from one place to another, is it really "stealing"? Anyone that says "yes", better double-check their stance on software piracy as well.

Eh, not really. Here's a very clear example of why your stance doesn't work.

I buy an MP3 from Amazon. I then copy it 'copy bits' over to another computer. Agreed, at this point all is fine. However, then I go try to sell the copied song for value to a 3rd-party. I may profess to 'own' the original download and the copy, however that doesn't give me the right to sell the song. It's the same with Bitcoin, if you just copied my Bitcoins, it's not theft in a sense, it's when you try to sell or exchange my Bitcoins for value that theft comes into play.

Re: I'm the guy who bought 259684 Bitcoins for under $3000 yesterday

#74

Post by ra »

romland wrote: post #42
wiredfool wrote: post #3

So, There's something like 21 million bitcoin possible, and 6 million 'in circulation' now. A sell order comes in for 1/12 of total amount of outstanding bitcoin. And the system processes it, flashcrashes, and. 3) Profit, I guess. or 4) rollback. That's something like what would happen if someone dumped 1 trillion USD onto a bond exchange. There are only a couple entities who could do this. So how did 1/12 of the val…

Or it could, again, be stupidity by MtGox: This was a "test account" that had no real user attached to it. After all, if the trade is internal on MtGox, it's just a double in a database. If that is the case, then hell yes, I can see why MtGox would want this rollback.

If it was test entries in a database, then how could the OP transfer real BTC to his wallet?

Re: I'm the guy who bought 259684 Bitcoins for under $3000 yesterday

#75

Post by VBprogrammer »

rick888 wrote: post #59

The problems here with Bitcoin come across as the same problems with piracy: Bitcoin are just bits on a computer. Just like piracy, when we copy bits from one place to another, is it really "stealing"? Anyone that says "yes", better double-check their stance on software piracy as well.

I see where you are coming from, however I would bet that the majority of the money you have, with the exception of the coins in your pocket, is already in the form of bits on a computer.

Re: I'm the guy who bought 259684 Bitcoins for under $3000 yesterday

#76

Post by Retric »

rick888 wrote: post #59

The problems here with Bitcoin come across as the same problems with piracy: Bitcoin are just bits on a computer. Just like piracy, when we copy bits from one place to another, is it really "stealing"? Anyone that says "yes", better double-check their stance on software piracy as well.

Just like money Bitcoins are numbers in a database. With software I can make 100 trillion copy's and cost you nothing, I can't do that with money or Bitcoins.

Re: I'm the guy who bought 259684 Bitcoins for under $3000 yesterday

#77

Post by johnzabroski »

Very good synopsis by Kevin.

However, he has two technical mistakes in his post from a security perspective:

1) We don't know the attack vector. For example: If Mt Gox has a SQL injection vulnerability, then a sophisticated attacker will not waste their time doing a rainbow attack on a random user. Instead, if the account balance is not encrypted and the key kept secret, then the attacker simply needs to do a SQL injection attack that returns the account with the largest balance:

select top 1 t1.account_id, t1.balance from Account t1 order by t1.balance desc

Instantly, the attacker knows the largest balance. This automatically reduces the attack space. This is a standard trick attackers use to bypass even needing to guess a password.

2) Compounding this issue, it seems Kevin is right, the attacked account had a naive password susceptible to a rainbow attack. According to rumors, this attack was a pooled account that mediated all the assets traded on the exchange. This implies that MtGox used a password susceptible to a rainbow attack to secure the master account. To answer Kevin's question, what user would amass $8M in bitcoins and use a bad password? The system administrators. 0xDEADBEEF.

Postscript: I have never traded or owned bitcoins, or even signed up for an exchange. I just find the security breach fascinating!

Re: I'm the guy who bought 259684 Bitcoins for under $3000 yesterday

#78

Post by kees »

A bitcoin exchange is a shady business, no regulation exists. So it is a freespace for criminals and hackers. You hustle or you will be hustled. This guy should have made a withdrawal by any means. In the bitcoin business only your wallet file counts, the rest is just a big hustle. And please forgot that you're able to sue somebody over a bitcoin dispute.

Re: I'm the guy who bought 259684 Bitcoins for under $3000 yesterday

#79

Post by TheEskimo »

gojomo wrote: post #33
kd0amg wrote: post #19

Earlier quoted context omitted.

Wouldn't it likely have a hash collision with a much shorter password though?

It would have many collisions with many shorter passwords. But almost certainly not any collisions with very simple and very short passwords. The hash output space is sufficiently large. Someone who (given infinite time) found a brute-force collision would likely find one of the shorter preimages first – you aren't really gaining anything by going ever-longer, after your preimage choice has as many bits as the hash o…

Sadly Mt Gox used salted and at one point unsalted MD5s for its passwords. Finding a collision would be far easier with that consideration taken into account.

Re: I'm the guy who bought 259684 Bitcoins for under $3000 yesterday

#80

Post by cpeterso »

> Two months ago we migrated from MD5 hashing to freeBSD MD5 salted hashing. The unsalted user accounts in the wild are ones that haven't been accessed in over 2 months and are considered idle. Once we are back up we will have implemented SHA-512 multi-iteration salted hashing and all users will be required to update to a new strong password.

I'm quite surprised that a service with accounts holding millions of dollars would store passwords without salt or a stronger hash algorithm than MD5!

Post reply on HN