Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Bitcoin exchange hacked via Rails exploit, funds stolen

bitcointalk.org

Post reply on HN
Print view View original

51–60 of 279 posts

Re: Bitcoin exchange hacked via Rails exploit, funds stolen

#51

Post by amalag »

Xylakant wrote: post #39
meaty wrote: post #15

Well that's not really a surprise. Perhaps the "Rails generation" will gain some engineering, product selection and QA skills now. There's a big reason banks operate the way they do with the kit they do.

Even given I must admit that this was a spectacularly stupid hole[1], I don't think your point is valid. It's not like other frameworks in other languages don't have similar issues [2]. Rails is for what it does well engineered, well tested and using it for what it's intended is usually a solid choice. Rails enables and pushes testing on all levels, thus improving quality of all rails apps that follow the lead. You c…

As a Rails developer myself, it is really embarrassing to admit that all Rails apps in the last few years have been completely and totally vulnerable. The good point that it was discovered by security researchers without a known exploit is good, but we don't know if it was previously exploited without anyone's knowledge. Maybe there were smart pen testers who were routinely getting in to Rails apps without anyone's knowledge for years.

Re: Bitcoin exchange hacked via Rails exploit, funds stolen

#52

Post by jart »

bstar77 wrote: post #8

I can't get to the article at the moment, but I'd love to know why they failed to update their app especially since it handles financial transactions. I had several apps to update and the process took very little time and effort.

I think an even better question is why they didn't have multiple layers of security that would have prevented a bug in a public facing server from compromising financial data.

When systems are designed with security in mind, rather than simply throwing together a web/sql application, people put a lot of time and effort into constructing barriers to protect the integrity of their data.

Take for instance the CACert certificate authority. They designed their system in a way where the master key that signs certificates is stored in a computer that isn't connected to any network. The actual servers then talk to this computer over the serial port using a carefully crafted API when they actually want a certificate signed. This means signing certificates is slow and the key is inaccessible. So if all their servers got remotely compromised, a hacker would never be able to get the key and at best would probably be able to sign a short list of certificates before being detected.

Re: Bitcoin exchange hacked via Rails exploit, funds stolen

#53

Post by eduardordm »

raganwald wrote: post #13
pavel_lishin wrote: post #4

I guess this is still the Wild Wild West era of Bitcoin; I'd wager plenty of banks got knocked off by bandits back in the day, too. What happened to a bank's customer's funds if it got robbed prior to 1933?

Banks don't keep all of their assets in cash in the safe. In its very simplest form, a bank takes money from depositors and pays a small "savings" rate. It then lends this money to borrowers at a higher rate. Every dollar in the safe is a dollar that isn't out earning interest, so the bank wants to only keep enough on hand to cover what customers will need for withdrawals. I met an ex bank robber once. He and his "ga…

Plus, there is the compulsory reserve you need to send to the central bank.

Example: http://www.centralbank.ie/mpolbo/mpo/pages/reserve.aspx

Re: Bitcoin exchange hacked via Rails exploit, funds stolen

#54

Post by pacala »

bradleyland wrote: post #44
bstar77 wrote: post #8

I can't get to the article at the moment, but I'd love to know why they failed to update their app especially since it handles financial transactions. I had several apps to update and the process took very little time and effort.

This vulnerability went from disclosure to exploit extremely quickly. The CVE was published on the 8th. I can't speak for them, but in the process of trying to update, we ran in to some issues with therubyracer (a core component of the Rails asset pipeline) and libv8 (the library that therubyracer uses to embed the V8 engine). It was extraordinarily bad timing, and it slowed down our update process by almost a day wh…

Perhaps this may sound harsh, but if you handle large amounts of money and are informed that your software stack allows arbitrary code execution then:

You pull off the plug ASAP.

Better have customers unable to use the service for one day than have the customers lose their money while you stumble trying to figure out how to patch it. This is elementary for any mission critical system. Just imagine your neighborhood nuclear plant delaying the insertion of the control rods during a meltdown because it has to wait for some shinier parts to arrive.

Re: Bitcoin exchange hacked via Rails exploit, funds stolen

#55

Post by jberryman »

vannevar wrote: post #42

There seems to be a pattern emerging in all of these 'disruptive' business models, whether it be Bitcoin (banking), AirBnb (hotels), or Uber (cabs). We look around and see these industries burdened by regulation, which tends to create entrenched players and which seem to us to be inefficient. So we create similar peer-to-peer equivalents, only to start rediscovering the reasons for all those regulations in the first…

> it's been so long since we've encountered the problems the regulatory 'inefficiencies' were meant to address.

This is the same effect that has made the anti-vaccine movement popular.

Re: Bitcoin exchange hacked via Rails exploit, funds stolen

#57

Post by astrodust »

gst wrote: post #50

After the Rails exploit was announced I was jokingly mentioning to a friend that this will hit a few Bitcoin exchanges. Seems there are still exchange operators that haven't learned anything about the previous exploits.

Any exchange operator that didn't stop whatever they were doing, be it eating a sandwich or having a baby, and run to patch their servers has failed their user base completely.

This was no undocumented zero day hack.

Re: Bitcoin exchange hacked via Rails exploit, funds stolen

#59

Post by Xylakant »

amalag wrote: post #51
Xylakant wrote: post #39

Earlier quoted context omitted.

Even given I must admit that this was a spectacularly stupid hole[1], I don't think your point is valid. It's not like other frameworks in other languages don't have similar issues [2]. Rails is for what it does well engineered, well tested and using it for what it's intended is usually a solid choice. Rails enables and pushes testing on all levels, thus improving quality of all rails apps that follow the lead. You c…

As a Rails developer myself, it is really embarrassing to admit that all Rails apps in the last few years have been completely and totally vulnerable. The good point that it was discovered by security researchers without a known exploit is good, but we don't know if it was previously exploited without anyone's knowledge. Maybe there were smart pen testers who were routinely getting in to Rails apps without anyone's k…

I completely agree: It's a stupid bug that lingered long in the codebase, probably because it was hidden in an obscure feature that nobody knew about or used. It's embarrassing, but I bet that pretty much every larger framework out there had a remote code execution bug[1]. Still, it's wrong to point at it and say "that's an engineering or QA bug that's symptomatic for the rails bunch." I'm not a rails friend, but the response showed that the rails developers take security and QA serious. Patches and workarounds were released not only for the supported versions, but also for older, long-dead releases.

[1] Sinatra didn't, but that's < 1000 LOC.

Re: Bitcoin exchange hacked via Rails exploit, funds stolen

#60

Post by jimktrains2 »

tptacek wrote: post #47
bradleyland wrote: post #44

Earlier quoted context omitted.

This vulnerability went from disclosure to exploit extremely quickly. The CVE was published on the 8th. I can't speak for them, but in the process of trying to update, we ran in to some issues with therubyracer (a core component of the Rails asset pipeline) and libv8 (the library that therubyracer uses to embed the V8 engine). It was extraordinarily bad timing, and it slowed down our update process by almost a day wh…

You cannot leave your site open to a pre-auth remote code execution vulnerability while you wait for fixes to the asset pipeline or to any other component of Rails. I don't know that that's what you're saying you did but we need to be glacier-blue-ice-clear about this. Nobody gets to wait on bugs like this. You patch or workaround immediately or, most probably, you shut your app down.

Weren't there patches for rails, and release for rails with the patches, really quickly from release?
Post reply on HN