Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Bitcoin exchange hacked via Rails exploit, funds stolen

bitcointalk.org

Post reply on HN
Print view View original

91–100 of 279 posts

Re: Bitcoin exchange hacked via Rails exploit, funds stolen

#91

Post by bradleyland »

tptacek wrote: post #47
bradleyland wrote: post #44

Earlier quoted context omitted.

This vulnerability went from disclosure to exploit extremely quickly. The CVE was published on the 8th. I can't speak for them, but in the process of trying to update, we ran in to some issues with therubyracer (a core component of the Rails asset pipeline) and libv8 (the library that therubyracer uses to embed the V8 engine). It was extraordinarily bad timing, and it slowed down our update process by almost a day wh…

You cannot leave your site open to a pre-auth remote code execution vulnerability while you wait for fixes to the asset pipeline or to any other component of Rails. I don't know that that's what you're saying you did but we need to be glacier-blue-ice-clear about this. Nobody gets to wait on bugs like this. You patch or workaround immediately or, most probably, you shut your app down.

It slowed down the update (to 3.2.11), but it didn't prevent us from removing the XML parser from DEFAULT_PARSERS immediately. I'm not defending anyone here. I'm simply pointing out that the scenario wasn't exactly status quo. This has all moved very quickly.

EDIT: I guess that qualifies as a mitigation strategy, but when I said that, I was talking more along the lines of the patches, or like another person I know, even more dramatic steps like forking Rails. There are regressions in the 3.2.x updates since 3.2.9 that affect some sites.

Bottom line is that there was a lot of bad timing here that sucked up a lot of time in securing a Rails site.

Re: Bitcoin exchange hacked via Rails exploit, funds stolen

#92

Post by tptacek »

bradleyland wrote: post #91
tptacek wrote: post #47

Earlier quoted context omitted.

You cannot leave your site open to a pre-auth remote code execution vulnerability while you wait for fixes to the asset pipeline or to any other component of Rails. I don't know that that's what you're saying you did but we need to be glacier-blue-ice-clear about this. Nobody gets to wait on bugs like this. You patch or workaround immediately or, most probably, you shut your app down.

It slowed down the update (to 3.2.11), but it didn't prevent us from removing the XML parser from DEFAULT_PARSERS immediately. I'm not defending anyone here. I'm simply pointing out that the scenario wasn't exactly status quo. This has all moved very quickly. EDIT: I guess that qualifies as a mitigation strategy, but when I said that, I was talking more along the lines of the patches, or like another person I know, e…

Right on. That was the right call to make.

I wanted to be careful not to point a finger at you; it's just that this is exactly the kind of crazy mistake I can see a web startup making.

Obviously, the timing sucked, but nobody had any control over that.

Re: Bitcoin exchange hacked via Rails exploit, funds stolen

#93

Post by noahjk »

makomk wrote: post #38
lucisferre wrote: post #27

Earlier quoted context omitted.

A lot of banks get knocked off today http://www.fbi.gov/stats-services/publications/bank-crime-st...

Yeah, most banks just intentionally try not to publicise the fact they've been robbed from what I've heard - it's bad for business and tends to encourage future robbers.

> tends to encourage future robbers

If only people would understand this about school shootings and the like

Re: Bitcoin exchange hacked via Rails exploit, funds stolen

#94

Post by pbhjpbhj »

numbsafari wrote: post #24
pavel_lishin wrote: post #4

I guess this is still the Wild Wild West era of Bitcoin; I'd wager plenty of banks got knocked off by bandits back in the day, too. What happened to a bank's customer's funds if it got robbed prior to 1933?

It probably depends. Banks are typically capitalized by a variety of assets, of which cash is typically a small amount. In addition, the bank typically has its cash holdings distributed at a number of different branches. Your account at the bank is technically it's liability. Essentially, you've loaned your money to the bank with an option to redeem it at any point in time (demand-deposit account, or checking account…

>Let's say a bank has all its assets in cash in a single branch location and that location is robbed, meaning the bank now has no assets left. //

Governments can and do offer an insurance system whereby they will ensure that customers receive a substantial part of their monies back - this aids against bank runs (where customers panic and all try to withdraw their money as cash and so cause the bank to implode).

Re: Bitcoin exchange hacked via Rails exploit, funds stolen

#95

Post by dirtyaura »

wereHamster wrote: post #3
Pr0 wrote: post #2

The good news is that they are going to cover the losses: https://bitcointalk.org/index.php?topic=135919.msg1448056#ms... edit: I was wrong about the title, see below comment.

No, some other site ( https://bitcoin-central.net/ ) fixed it within 5 minutes, not the one that was compromised ( https://vircurex.com/ ).

Vircurex developer Kumala says on the thread that they will cover the losses:

"Before the wild speculations beginn, the service will be recovered and we pay the losses out of our own pockets."

Re: Bitcoin exchange hacked via Rails exploit, funds stolen

#96

Post by bdcravens »

Xylakant wrote: post #39
meaty wrote: post #15

Well that's not really a surprise. Perhaps the "Rails generation" will gain some engineering, product selection and QA skills now. There's a big reason banks operate the way they do with the kit they do.

Even given I must admit that this was a spectacularly stupid hole[1], I don't think your point is valid. It's not like other frameworks in other languages don't have similar issues [2]. Rails is for what it does well engineered, well tested and using it for what it's intended is usually a solid choice. Rails enables and pushes testing on all levels, thus improving quality of all rails apps that follow the lead. You c…

I don't think "Rails generation" means only Rails. I think the idea is that we're so dependent on frameworks these days, there are massive pieces of our application that we have no clue how they work, and worse, we trust the framework authors implicitly. More and more we're seeing the downfalls of this. As Rails is essentially the best known and most deployed, hence the name.

Think about it: for most apps, probably 95% of your code is a framework that you didn't write. When this is criticized, the response is typically "open source unicorns! speak no more!" Moreover, there seems to be a different level of forgiveness just because it's open source. If ASP.NET WebForms had the same level of security holes in the past years as Rails ... just wow.

I love frameworks, and I think an average team would on the whole write less secure code than an open source framework would. If we want maximum transparency into our code, we'd go back to CGI written in C, but our productivity would tank, and looking back, the boom of recent years never would have happened.

However, we need a different attitude. Let's be honest: the arguments about open source are mostly a lie. Yeah, I went there. No, I'm not advocating closed source. Too many hang their hat on the ideals of open source. We're not talking ideals. We're talking rubber meets the road, cash leaves the bank reality. "Anyone can view the source - many eyeballs makes it more secure." The truth is, there aren't that many eyeballs. How many download, or (for the real technology ninjas) git clone, and trust what they're working with (whether app or framework) by a faith that rivals any religious organization?

As an industry, we need to read more code. We need to push back against the Barnes and Noble developer, the one who paid $29 for a book and now calls themselves a developer because they finished it front to back. Not everyone needs to be a senior engineer, but we have too many with that title after 3 years of building framework apps who couldn't code their way out of a CS101 class if they had Donald Knuth and Dennis Ritchie as their personal tutors.

This is pure supposition, but I think if at least 10% of those who used Rails read Rails, it'd be far more secure.

Re: Bitcoin exchange hacked via Rails exploit, funds stolen

#97

Post by Xylakant »

chez17 wrote: post #72
snitko wrote: post #61

Earlier quoted context omitted.

Except that regulating things is not the same as holding a monopoly on regulations. If government is so completely confident that its currency is much more superior and stable, well, allow the competition! Make it legal to receive whatever I want to receive as a payment. Let businesses regulate the currency market and determine what currency is reliable. Oh wait, except that then government cannot tax you, of course.…

This has everything to do with regulating bit coins and the exchanges. No bank in the US would ever dare run a stock rails site, I would bet they would be rightfully sued. On top of that, funds in a bank are insured to a point so if someone at a bank messes up, the innocent people who lost their money won't lose everything they own. The free market is cruel and so are it's proponents, we've advanced past this "fuck y…

> No bank in the US would ever dare run a stock rails site, I would bet they would be rightfully sued.

Why so? Even banking websites build on frameworks and if you'd have chosen Spring for example, there was a Remote Code Execution vulnerability in 2010. And even if you roll your own framework, you're just as likely to introduce a critical flaw. The Dutch governmental DigiD service runs rails [1]. The critical difference between the BC service and a bank or the government is that a responsible party would have secured their app immediately. The DigiD service was taken down pretty quickly and stayed down until patched. There were multiple workarounds that did not involve major patches and even if you didn't know which of your apps was vulnerable, you could filter the payload at your load-balancers if you had some [2].

[1] http://lwn.net/Articles/532224/ [2] An xml tag with the type "yaml" was required to trigger this. It's a pretty specific payload that is very unlikely to be used in a regular request.

Re: Bitcoin exchange hacked via Rails exploit, funds stolen

#98

Post by netcoyote »

acslater00 wrote: post #75
vannevar wrote: post #42

There seems to be a pattern emerging in all of these 'disruptive' business models, whether it be Bitcoin (banking), AirBnb (hotels), or Uber (cabs). We look around and see these industries burdened by regulation, which tends to create entrenched players and which seem to us to be inefficient. So we create similar peer-to-peer equivalents, only to start rediscovering the reasons for all those regulations in the first…

That is an absolutely terrible lesson to draw from this episode. First and most importantly, Airbnb and Uber are not disrupting industries burdened primarily by consumer safety regulations; they are disrupting industries burdened primarily by barriers to entrance that are designed to direct economic rents to politically favored actors. Huge difference. There is no plausible 'consumer protection' story for preventing…

I think it's important to use language that's fair and reasonable when arguing your point.

When you say "There is no plausible 'consumer protection' story for preventing licensed (sic) livery cab drivers from picking up curb hails" (I think you meant unlicensed) it's easy to dispute that point.

Here is the first hit on Google for "cab rider ripoff": http://www.nypost.com/p/news/local/taxis_taking_wBtAr13EzaKS... - "At least a dozen hacks have been caught hitting unsuspecting passengers with pricey tolls for bridges and tunnels that the cab never actually crossed".

And the result: "We are confirming these data, and if appropriate, will likewise seek to revoke their licenses," Yassky said. "We will continue to comb the GPS data for any similar incidences."

That type of legal solution is not possible if taxi drivers are unlicensed.

And the well-publicized instances of Airbnb problems (e.g. prostitution) are already demonstrating that at least some of the regulations are in fact necessary.

Finally, the point about consumer bank regulation is, if your bank account does get ripped off, you're insured to $250K by the FDIC, which BitCoin doesn't have. Though perhaps that is a market opportunity for an aspiring YC company?

In any event, you're overstating the case to make your point -- keep the language reasonable if you expect to make your point.

Re: Bitcoin exchange hacked via Rails exploit, funds stolen

#99

Post by tomjen3 »

dougmccune wrote: post #86
acslater00 wrote: post #75

Earlier quoted context omitted.

That is an absolutely terrible lesson to draw from this episode. First and most importantly, Airbnb and Uber are not disrupting industries burdened primarily by consumer safety regulations; they are disrupting industries burdened primarily by barriers to entrance that are designed to direct economic rents to politically favored actors. Huge difference. There is no plausible 'consumer protection' story for preventing…

Claiming hotel regulation has no benefit to consumers is simply not true. Consider the perspective of a resident of San Francisco (like me). SF has a very limited amount of housing. We can debate all day about ways to fix that and impediments to building more (and more affordable) housing, but the simple facts right now are that there are a LOT more people who want to live in SF than there are housing units. Addition…

You may value that prioritization, but that isn't strange as you are a renter and so prefer things aligned as close as possible to your personal benefit.

That is simple egoism, don't coat it in nice language.

Re: Bitcoin exchange hacked via Rails exploit, funds stolen

#100

Post by [deleted] »

acslater00 wrote: post #75
vannevar wrote: post #42

There seems to be a pattern emerging in all of these 'disruptive' business models, whether it be Bitcoin (banking), AirBnb (hotels), or Uber (cabs). We look around and see these industries burdened by regulation, which tends to create entrenched players and which seem to us to be inefficient. So we create similar peer-to-peer equivalents, only to start rediscovering the reasons for all those regulations in the first…

That is an absolutely terrible lesson to draw from this episode. First and most importantly, Airbnb and Uber are not disrupting industries burdened primarily by consumer safety regulations; they are disrupting industries burdened primarily by barriers to entrance that are designed to direct economic rents to politically favored actors. Huge difference. There is no plausible 'consumer protection' story for preventing…

[deleted]
Post reply on HN