I suspect that a lot of anti ruby / rails people are happy to have the occasion to prove that the language and framework that they didn't want to learn is ...bad... and are posting these news all around the web... with that small grin in their mind... fair enough... but rest assured, Ruby & Rails haven't even came close to the end of their ass-kicking :)
Bitcoin exchange hacked via Rails exploit, funds stolen
41–50 of 279 posts
Re: Bitcoin exchange hacked via Rails exploit, funds stolen
#42There seems to be a pattern emerging in all of these 'disruptive' business models, whether it be Bitcoin (banking), AirBnb (hotels), or Uber (cabs). We look around and see these industries burdened by regulation, which tends to create entrenched players and which seem to us to be inefficient. So we create similar peer-to-peer equivalents, only to start rediscovering the reasons for all those regulations in the first place. I would argue that one reason mature industries seem inefficient to us is that it's been so long since we've encountered the problems the regulatory 'inefficiencies' were meant to address, that we've forgotten why our ancestors put them in place. Peer-to-peer is not a new idea, it's how things worked back before we started using government to solve the problems inherent in the peer-to-peer model.
Re: Bitcoin exchange hacked via Rails exploit, funds stolen
#43Re: Bitcoin exchange hacked via Rails exploit, funds stolen
#44I can't get to the article at the moment, but I'd love to know why they failed to update their app especially since it handles financial transactions. I had several apps to update and the process took very little time and effort.
This vulnerability went from disclosure to exploit extremely quickly. The CVE was published on the 8th. I can't speak for them, but in the process of trying to update, we ran in to some issues with therubyracer (a core component of the Rails asset pipeline) and libv8 (the library that therubyracer uses to embed the V8 engine). It was extraordinarily bad timing, and it slowed down our update process by almost a day while waiting on a new version of therubyracer and libv8 to hit.
Having said all that, if our upgrade holdup had taken any longer than it did, we would have implemented one of the mitigation strategies.
Re: Bitcoin exchange hacked via Rails exploit, funds stolen
#45> The system was not breached, no passwords were compromised (they are salted and multiple times hashed anyways)
When they say "multiple times" I hope that means they're using PBKDF2 or bcrypt, because if they were simply using SHA1 then their users are even more doomed.
Re: Bitcoin exchange hacked via Rails exploit, funds stolen
#46I guess this is still the Wild Wild West era of Bitcoin; I'd wager plenty of banks got knocked off by bandits back in the day, too. What happened to a bank's customer's funds if it got robbed prior to 1933?
A lot of banks get knocked off today http://www.fbi.gov/stats-services/publications/bank-crime-st...
Wow awesome link. That fully blows my mind.
Re: Bitcoin exchange hacked via Rails exploit, funds stolen
#47I can't get to the article at the moment, but I'd love to know why they failed to update their app especially since it handles financial transactions. I had several apps to update and the process took very little time and effort.
This vulnerability went from disclosure to exploit extremely quickly. The CVE was published on the 8th. I can't speak for them, but in the process of trying to update, we ran in to some issues with therubyracer (a core component of the Rails asset pipeline) and libv8 (the library that therubyracer uses to embed the V8 engine). It was extraordinarily bad timing, and it slowed down our update process by almost a day wh…
You cannot leave your site open to a pre-auth remote code execution vulnerability while you wait for fixes to the asset pipeline or to any other component of Rails.
I don't know that that's what you're saying you did but we need to be glacier-blue-ice-clear about this. Nobody gets to wait on bugs like this. You patch or workaround immediately or, most probably, you shut your app down.
Re: Bitcoin exchange hacked via Rails exploit, funds stolen
#48If you want to get free security research from the best in the business, running a bitcoin exchange seems like a lovely way to do it. Just keep good logs to a write-only device.
Re: Bitcoin exchange hacked via Rails exploit, funds stolen
#49There seems to be a pattern emerging in all of these 'disruptive' business models, whether it be Bitcoin (banking), AirBnb (hotels), or Uber (cabs). We look around and see these industries burdened by regulation, which tends to create entrenched players and which seem to us to be inefficient. So we create similar peer-to-peer equivalents, only to start rediscovering the reasons for all those regulations in the first…
Brilliant point. It's a case of experimenting with the balance of freedom vs regulation.
Perhaps it's not vital that a hotel(or taxi) is licensed today, because we can easily see its realtime feedback from previous users. But then again, perhaps those users don't notice that there is no emergency lighting and the fire alarm is disabled, or that the driver has multiple convictions for dishonesty.
Re: Bitcoin exchange hacked via Rails exploit, funds stolen
#50After the Rails exploit was announced I was jokingly mentioning to a friend that this will hit a few Bitcoin exchanges. Seems there are still exchange operators that haven't learned anything about the previous exploits.