Those 500K Bitcoins that caused the flash crash weren't real

What bothers me most is the bullshit explanations that were given initially. Claims of a DB dump being stolen from a financial auditor's laptop, assertions that no SQLi vulnerabilities were reported and couldn't have been responsible, etc. If it weren't for the full-disclosure post about various vulnerabilities in the site, would they have ever admitted any of this?

I for one won't be returning to mtgox.

Edit: Full-disclosure post http://seclists.org/fulldisclosure/2011/Jun/417 and relevant Bitcoin forum discussion http://forum.bitcoin.org/index.php?topic=20437.0

Re: Those 500K Bitcoins that caused the flash crash weren't real

#6

Post by rlpb » Thu, Jun 30, 2011, 11:33 PM UTC

"The new Mt. Gox site features SHA-512 multi-iteration, triple salted hashing"

Why not use a standard key derivation function such as PBKDF2 or bcrypt to provide some confidence in the system rather than inventing their own?

AFAIK bcrypt is strong because of Blowfish's expensive key setup. How does this compare to SHA-512?

Re: Those 500K Bitcoins that caused the flash crash weren't real

#7

Post by daeken » Thu, Jun 30, 2011, 11:36 PM UTC

rlpb wrote: post #6

"The new Mt. Gox site features SHA-512 multi-iteration, triple salted hashing" Why not use a standard key derivation function such as PBKDF2 or bcrypt to provide some confidence in the system rather than inventing their own? AFAIK bcrypt is strong because of Blowfish's expensive key setup. How does this compare to SHA-512?

The part that bothers me about that is "triple salted hashing". This could mean any number of things, all of which point to a misunderstanding of what a salt is for.

Re: Those 500K Bitcoins that caused the flash crash weren't real

#8

Post by kevingadd » Thu, Jun 30, 2011, 11:39 PM UTC

daeken wrote: post #5

What bothers me most is the bullshit explanations that were given initially. Claims of a DB dump being stolen from a financial auditor's laptop, assertions that no SQLi vulnerabilities were reported and couldn't have been responsible, etc. If it weren't for the full-disclosure post about various vulnerabilities in the site, would they have ever admitted any of this? I for one won't be returning to mtgox. Edit: Full-d…

If I were the guy MagicalTux outright accused of being the hacker and threatened with FBI action, I'd be demanding a public apology right about now. He'll probably never get one.

Re: Those 500K Bitcoins that caused the flash crash weren't real

#9

Post by Joakal » Thu, Jun 30, 2011, 11:41 PM UTC

daeken wrote: post #7

rlpb wrote: post #6

"The new Mt. Gox site features SHA-512 multi-iteration, triple salted hashing" Why not use a standard key derivation function such as PBKDF2 or bcrypt to provide some confidence in the system rather than inventing their own? AFAIK bcrypt is strong because of Blowfish's expensive key setup. How does this compare to SHA-512?

The part that bothers me about that is "triple salted hashing". This could mean any number of things, all of which point to a misunderstanding of what a salt is for.

Triple salted hashing sounds like either there's three salts in a hash or it's hashed with a salt three times.

Re: Those 500K Bitcoins that caused the flash crash weren't real

#10

Post by william42 » Thu, Jun 30, 2011, 11:41 PM UTC

lwat wrote: post #3

That 2000BTC the thieves made off with is worth about $32,000 at the moment.

And unless the government gets involved, the thieves will have taken it scot-free.