Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Compromised Linode, thousands of BitCoins stolen

bitcoinmedia.com

Post reply on HN
Print view View original

211–220 of 249 posts

Re: Compromised Linode, thousands of BitCoins stolen

#211

Post by [deleted] »

eli wrote: post #156
larrys wrote: post #105

" As a respected hosting provider, I hope they do the correct thing and refund me for this liability due to their error. Many people trust Linode, and they have proven themselves as a serious contender for hosting critical sensitive operations on the internet. I would hate to not see them live up to that reputation. " "hosting critical sensitive operations" in particular. If you are doing "critical sensitive operatio…

I can put a "not responsible for stolen items" sign in my restaurant, but if the coat check employee bolts out the door when you hand them your coat, I'm buying you a new one.

[deleted]

Re: Compromised Linode, thousands of BitCoins stolen

#212

Post by kamaal »

baddox wrote: post #206
bigiain wrote: post #166

Earlier quoted context omitted.

"please think for a second what liability you would want for any mistakes that you make with your web startup or idea" It seems to me that bitcoin wallets are a relatively new and not well enough understood risk. There are very few other "files" like them, in that an attacker copying them can deprive you of their value in a way that you cant protect with backups. I feel a big part of current "internet security best p…

I don't see what's so conceptually new about bitcoin wallets. They're just plain text that you don't want people getting access to. It's no different than storing passwords in plain text: if someone copies them, they're completely compromised (until the user changes them). The solution is pretty simple: encrypt your own bitcoins with your own password (or more ideally, your private key). Then, if someone hacks your s…

Sorry for asking a noob question.

But what really is a bit coin? I mean in physical existence. Is it just a file(plain text) with some data/metadata?

And stealing it means copying those files, and then deleting the source?

Which in case how is this any different than traditional bank account. My money in the bank is basically DB record. And that can be stolen.

The bank can then just say to every one 'look this transaction from db such and such is no longer valid'.

Can't bit coin do the same? I guess I'm missing something fundamental.

Can somebody explain this?

Re: Compromised Linode, thousands of BitCoins stolen

#213

Post by coopdog »

kamaal wrote: post #212
baddox wrote: post #206

Earlier quoted context omitted.

I don't see what's so conceptually new about bitcoin wallets. They're just plain text that you don't want people getting access to. It's no different than storing passwords in plain text: if someone copies them, they're completely compromised (until the user changes them). The solution is pretty simple: encrypt your own bitcoins with your own password (or more ideally, your private key). Then, if someone hacks your s…

Sorry for asking a noob question. But what really is a bit coin? I mean in physical existence. Is it just a file(plain text) with some data/metadata? And stealing it means copying those files, and then deleting the source? Which in case how is this any different than traditional bank account. My money in the bank is basically DB record. And that can be stolen. The bank can then just say to every one 'look this transa…

A 'bit coin' is a space on a block chain that everyone has a copy of. You lock the coin with a cryptographpic key, which you need to store. Whoever has a copy of the key can unlock the bitcoin and re lock it with a different key, such that now only the new owner has a copy of the key. Everyone can still see the entire block chain, but only one account (that no one knows the owner of) has the ability to move that coin.

So they got access to these peoples keys and transferred ownership of the coins.

Most money supplies are regulated, but bitcoin isn't regulated. No one has the ability to say 'reverse that transaction', but it also makes the currency safe from inflation and interference by money printing governments and privacy snoops.

Re: Compromised Linode, thousands of BitCoins stolen

#214

Post by [deleted] »

coopdog wrote: post #213
kamaal wrote: post #212

Earlier quoted context omitted.

Sorry for asking a noob question. But what really is a bit coin? I mean in physical existence. Is it just a file(plain text) with some data/metadata? And stealing it means copying those files, and then deleting the source? Which in case how is this any different than traditional bank account. My money in the bank is basically DB record. And that can be stolen. The bank can then just say to every one 'look this transa…

A 'bit coin' is a space on a block chain that everyone has a copy of. You lock the coin with a cryptographpic key, which you need to store. Whoever has a copy of the key can unlock the bitcoin and re lock it with a different key, such that now only the new owner has a copy of the key. Everyone can still see the entire block chain, but only one account (that no one knows the owner of) has the ability to move that coin…

[deleted]

Re: Compromised Linode, thousands of BitCoins stolen

#215

Post by leguman »

[deleted] wrote: post #214
coopdog wrote: post #213

Earlier quoted context omitted.

A 'bit coin' is a space on a block chain that everyone has a copy of. You lock the coin with a cryptographpic key, which you need to store. Whoever has a copy of the key can unlock the bitcoin and re lock it with a different key, such that now only the new owner has a copy of the key. Everyone can still see the entire block chain, but only one account (that no one knows the owner of) has the ability to move that coin…

[deleted]

bro seriously, you should use google or wikipedia

Re: Compromised Linode, thousands of BitCoins stolen

#216

Post by Auguste »

[deleted] wrote: post #214
coopdog wrote: post #213

Earlier quoted context omitted.

A 'bit coin' is a space on a block chain that everyone has a copy of. You lock the coin with a cryptographpic key, which you need to store. Whoever has a copy of the key can unlock the bitcoin and re lock it with a different key, such that now only the new owner has a copy of the key. Everyone can still see the entire block chain, but only one account (that no one knows the owner of) has the ability to move that coin…

[deleted]

See http://www.weusecoins.com . If I remember correctly, it had a pretty good explanation, plus a video with the tl;dr version.

Re: Compromised Linode, thousands of BitCoins stolen

#217

Post by tomp »

etcet wrote: post #204
bigiain wrote: post #166

Earlier quoted context omitted.

"please think for a second what liability you would want for any mistakes that you make with your web startup or idea" It seems to me that bitcoin wallets are a relatively new and not well enough understood risk. There are very few other "files" like them, in that an attacker copying them can deprive you of their value in a way that you cant protect with backups. I feel a big part of current "internet security best p…

Don't store your money on servers you don't own. Don't have a web interface. Don't allow anyone to connect. Don't use passwords, use public key encryption. These are the basics.

What if they steal the key?

Re: Compromised Linode, thousands of BitCoins stolen

#218

Post by Legion »

mahmud wrote: post #154
nbpoole wrote: post #3

So, a customer service interface was compromised via stolen credentials and used to access various Linode instances. A couple questions that immediately come to mind: 1. Can this interface be accessed from anywhere on the Internet? If so, why? If not, does that mean other systems owned by Linode were compromised as well? 2. Why can customer service representatives access and update servers without the client being no…

Linode will send you a confirmation email if you access the admin panel from a "new" IP. This guy must have had his email address compromised as well. Looks like a class spear-attack.

> Linode will send you a confirmation email if you access the admin panel from a "new" IP.

IF you have the IP whitelisting feature enabled on your account. It is not by default.

Re: Compromised Linode, thousands of BitCoins stolen

#219

Post by DanBC »

RLG_RLG wrote: post #114
lsc wrote: post #93

Earlier quoted context omitted.

where do you keep the key to the crypto fs?

Written on a scrap of paper in your wallet. only the password and no other info should be on the scrap. If you can memorize it, it is a bad password.

"muscle memory" helps here. People only need to refer to the scrap of paper for the first couple of weeks of entering a password.

Then that scrap can be securely stored somewhere else. (eg: In your "in case of death" box if you want people to have access when you die.)

Re: Compromised Linode, thousands of BitCoins stolen

#220

Post by gizzlon »

bigiain wrote: post #166
larrys wrote: post #105

" As a respected hosting provider, I hope they do the correct thing and refund me for this liability due to their error. Many people trust Linode, and they have proven themselves as a serious contender for hosting critical sensitive operations on the internet. I would hate to not see them live up to that reputation. " "hosting critical sensitive operations" in particular. If you are doing "critical sensitive operatio…

"please think for a second what liability you would want for any mistakes that you make with your web startup or idea" It seems to me that bitcoin wallets are a relatively new and not well enough understood risk. There are very few other "files" like them, in that an attacker copying them can deprive you of their value in a way that you cant protect with backups. I feel a big part of current "internet security best p…

"Is there a way to secure a bitcoin wallet on a machine someone else has root access to (either your datacenter's staff with physical access, or the people with hypervisor access to the hardware your vm is running on)?"

Probably not, _maybe_ trusted computing could help[1]. But it might secure enough if you had a special piece of hardware that stored the bitcoin-key and did all the signing operations. I believe things like these exists for Certifications and other signing-keys. I doubt VeriSign stores their root certificates on just-another-box :)

[1] In theory, TC could "anchor" your data to the hardware chip on the motherboard, and breaking it would require physical tampering.

Post reply on HN