The Bitcoin economy is learning, repeatedly, the hard way, that financial systems security is one of the most difficult, intransigent problems that any business will face. The goal posts are constantly moving, and there are always people trying to break in.
Bitcoin exchange hacked via Rails exploit, funds stolen
111–120 of 279 posts
Re: Bitcoin exchange hacked via Rails exploit, funds stolen
#112Earlier quoted context omitted.
Even given I must admit that this was a spectacularly stupid hole[1], I don't think your point is valid. It's not like other frameworks in other languages don't have similar issues [2]. Rails is for what it does well engineered, well tested and using it for what it's intended is usually a solid choice. Rails enables and pushes testing on all levels, thus improving quality of all rails apps that follow the lead. You c…
Bullshit. Rails pushes low time to market. That is all. Its built with precisely no engineering design or quality control on top of a poorly specified rickety language in a community of hype. However, my original generalizes the problem as a human issue which is where the real problem is: Did they do a risk analysis on rails - no Did they verify their architecture - no Did they perform input/type checking - no (sorry…
>Did they do a risk analysis on rails - no
Actually, this bug was discovered precisely because people began to perform a more in depth analysis.
>Did they perform input/type checking - no (sorry but statically typed languages win here)
LOL. It's 2013. Can we stop having this preposterous argument?
Re: Bitcoin exchange hacked via Rails exploit, funds stolen
#113Basically all the comments points to how amateurish that exchange was run compared to a real online banking website. Now how many real banks do run their website using Rails? Ruby? You guys certainly aren't as stupid as to believe this is the latest major 0-day Rails exploit to create havoc right? And now comes the answers containing the logical fallacy: "All languages/frameworks have security issues" . Which is rubb…
While you're obviously correct to imply that languages/frameworks have different levels of security the problem with that proposition is how does a prospective user of the framework assess the level of security it provides?
You could argue that "big, enterprise" systems are likely to be more secure, but experience with things like Oracle databases around 8/9/10 would indicate that's not always a good measure.
You could argue (and people do) that the framework being open source is a good thing, or a bad thing.
So absent that information how would someone factor that into their choice of system?
Re: Bitcoin exchange hacked via Rails exploit, funds stolen
#114I can't get to the article at the moment, but I'd love to know why they failed to update their app especially since it handles financial transactions. I had several apps to update and the process took very little time and effort.
This vulnerability went from disclosure to exploit extremely quickly. The CVE was published on the 8th. I can't speak for them, but in the process of trying to update, we ran in to some issues with therubyracer (a core component of the Rails asset pipeline) and libv8 (the library that therubyracer uses to embed the V8 engine). It was extraordinarily bad timing, and it slowed down our update process by almost a day wh…
therubyracer thing was annoying, but there's no reason it had to delay your upgrades -- you could simply lock to the same version of therubyracer you were using previously without problems, it was just as compatible with the new version of rails.
The fact remains though, that this exploit was _so_ severe, that, depending on how attractive a target you were and how disastrous it would be for you to be compromised (financial services? High on both scales) -- it would have been a better choice to _take your app down_ until you can fix it, rather than leave it up with the vulnerability. The vulnerability was "an attacker can run whatever code they want on your server, and they can discover that you are vulnerable by cheap automated port scan." It's as bad as it gets.
Re: Bitcoin exchange hacked via Rails exploit, funds stolen
#115There seems to be a pattern emerging in all of these 'disruptive' business models, whether it be Bitcoin (banking), AirBnb (hotels), or Uber (cabs). We look around and see these industries burdened by regulation, which tends to create entrenched players and which seem to us to be inefficient. So we create similar peer-to-peer equivalents, only to start rediscovering the reasons for all those regulations in the first…
That is an absolutely terrible lesson to draw from this episode. First and most importantly, Airbnb and Uber are not disrupting industries burdened primarily by consumer safety regulations; they are disrupting industries burdened primarily by barriers to entrance that are designed to direct economic rents to politically favored actors. Huge difference. There is no plausible 'consumer protection' story for preventing…
"There is no plausible 'consumer protection' story that would explain why building codes for permanent residence are not good enough for temporary residence as well. The law is there to protect hotel operators from vacation rental competition."
As an apartment owner in a multi-unit apartment building, I don't want the neighboring apartments being used as short-term rental properties - and the building regulations forbid it. It's absolutely a quality-of-living and consumer-protection issue protecting property owners from the risks associated with transients.
Re: Bitcoin exchange hacked via Rails exploit, funds stolen
#116There seems to be a pattern emerging in all of these 'disruptive' business models, whether it be Bitcoin (banking), AirBnb (hotels), or Uber (cabs). We look around and see these industries burdened by regulation, which tends to create entrenched players and which seem to us to be inefficient. So we create similar peer-to-peer equivalents, only to start rediscovering the reasons for all those regulations in the first…
You have a point, but you're taking it too far.
I agree that companies need to take a look at how their industry is regulated and what purpose those regulations serve. But the fact that companies can come into these types of industries, openly skirt the regulations, and still be massively successful shows that the existing laws aren't meeting the needs of the people who use these services.
And how exactly has government solved "the problems inherent in the peer-to-peer model"? I'm not sure what problems you're talking about in the first place.
Re: Bitcoin exchange hacked via Rails exploit, funds stolen
#117Earlier quoted context omitted.
This vulnerability went from disclosure to exploit extremely quickly. The CVE was published on the 8th. I can't speak for them, but in the process of trying to update, we ran in to some issues with therubyracer (a core component of the Rails asset pipeline) and libv8 (the library that therubyracer uses to embed the V8 engine). It was extraordinarily bad timing, and it slowed down our update process by almost a day wh…
You cannot leave your site open to a pre-auth remote code execution vulnerability while you wait for fixes to the asset pipeline or to any other component of Rails. I don't know that that's what you're saying you did but we need to be glacier-blue-ice-clear about this. Nobody gets to wait on bugs like this. You patch or workaround immediately or, most probably, you shut your app down.
Also, lest anyone think that they have time, there appear to be scanners up using the Metasploit code. This request came from an IP address on Road Runner's netblock from Ohio. The request hit a server that we don't publish, and the IP doesn't match any other requests in our logs. The greatest likelihood is that it is a computer locked up in a botnet.
https://gist.github.com/4512579
http://dev.metasploit.com/redmine/projects/framework/reposit...
Re: Bitcoin exchange hacked via Rails exploit, funds stolen
#118Earlier quoted context omitted.
Even given I must admit that this was a spectacularly stupid hole[1], I don't think your point is valid. It's not like other frameworks in other languages don't have similar issues [2]. Rails is for what it does well engineered, well tested and using it for what it's intended is usually a solid choice. Rails enables and pushes testing on all levels, thus improving quality of all rails apps that follow the lead. You c…
Bullshit. Rails pushes low time to market. That is all. Its built with precisely no engineering design or quality control on top of a poorly specified rickety language in a community of hype. However, my original generalizes the problem as a human issue which is where the real problem is: Did they do a risk analysis on rails - no Did they verify their architecture - no Did they perform input/type checking - no (sorry…
I agree on your analysis of the BC exchanges behavior. They neither did a proper risk analysis nor did they build a systen designed to safely handle the wallet nor did they respond in a timely and responsible manner. I just fail to see how that's rails fault.
Would a bank run their OLTP on rails? I don't know. I'd rather say that rails is a bad fit for that kind of problem, but that's not the goal. Rails is built for web-applications of a pretty specific type, quick build and release cycles while still keeping a solid focus on code quality [1]. So your problem is that folks see an opportunity to make money, take the first tool that seems to fit and build stuff that doesn't hold water. But that's language agnostic. You certainly realize that 10 years ago java was the "poorly specified rickety language in a community of hype".
[1] I never dreamed I'd be defending rails. gosh.
Re: Bitcoin exchange hacked via Rails exploit, funds stolen
#119There seems to be a pattern emerging in all of these 'disruptive' business models, whether it be Bitcoin (banking), AirBnb (hotels), or Uber (cabs). We look around and see these industries burdened by regulation, which tends to create entrenched players and which seem to us to be inefficient. So we create similar peer-to-peer equivalents, only to start rediscovering the reasons for all those regulations in the first…
Paypal encountered many of the problems that central regulators were set up to solve. Their solution to fraud protection was better than anything else out there, and has been widely copied in the industry. Do they have false positives? Yes, but international person-to-person (vs. company-to-company) money transfers have never been easier. Newer startups will make it easier still.
Regulators and incumbents need competition. No new product is ever better than an existing product in ALL respects, only in some features. Hitting the features that existing regulations are meant to ensure might not be #1 on the feature roadmap, but it's on there.
The problem is when features that are less important to customers are prioritized by regulation (and therefore by guns) over features that are incredibly important to customers. Clearly, the existing taxi regulations did not incentivize rather important features like "convenient for taxi customers" but instead were about edge cases that are important, but only at scale.
Re: Bitcoin exchange hacked via Rails exploit, funds stolen
#120I suspect that a lot of anti ruby / rails people are happy to have the occasion to prove that the language and framework that they didn't want to learn is ...bad... and are posting these news all around the web... with that small grin in their mind... fair enough... but rest assured, Ruby & Rails haven't even came close to the end of their ass-kicking :)
You say that like it's an epic conquest to learn Rails. You assume that people who criticize Rails haven't learned it. Probably a large number of haters, yes, but there's also plenty who have taken the weekend or so it takes to get a good working knowledge of Rails. That's what makes Rails great: you can be productive fast. I'd venture to say there's more Java/C# devs who know Rails than vice-versa.
"Ass-kicking"? Is this high school football or professional programming? If a language or framework has major security holes, it should fail in the marketplace, no matter how much "ass kicking" it has done.
Rereading your post, I'm going to assume it's a troll post. After all, when I see your username, I can't help but imagine, "Do a couple of quick sets down at Gold's, then come back and slam out some Rails, yeah brah!"