Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Bitcoin exchange hacked via Rails exploit, funds stolen

bitcointalk.org

Post reply on HN
Print view View original

141–150 of 279 posts

Re: Bitcoin exchange hacked via Rails exploit, funds stolen

#141

Post by thomasz »

cs702 wrote: post #105

Imagine that a thief breaks and enters into a warehouse which is holding physical gold for its customers, and the thief steals all their gold. The warehouse and/or its customers will suffer losses, but every single ounce of the gold stolen by the thief will continue to be as valuable as any other ounce of gold. In other words, gold will continue to be the same exact commodity. Essentially the same thing has happened…

> its integrity has NOT been compromised

Shesh. A Bitcoin has no inherent value. If such incidents become common enough, nobody will be willing to buy bitcoins for dollars or accept bitcoins as payments for goods,which means that the thieves will sit on a bunch of useless bits.

Re: Bitcoin exchange hacked via Rails exploit, funds stolen

#142

Post by rprasad »

btilly wrote: post #87
revelation wrote: post #28

Earlier quoted context omitted.

Or, you know, why their wallet is compromised just because the web interface is. It's like a CA that creates the certificates in PHP right there.

This is a remote code exploit. For the web interface to do its job, it needs to be able to manipulate the wallet. They can stare at the code that does that, write their own, and do whatever they want.

A secure bitcoin service provider should never manipulate the wallet directly, or in realtime. Transactions should be handled transparently, logged, and then actuall excuted on the offline wallet later after fraud and loss mitigation routines have been applied.

Re: Bitcoin exchange hacked via Rails exploit, funds stolen

#143

Post by JPKab »

acslater00 wrote: post #75
vannevar wrote: post #42

There seems to be a pattern emerging in all of these 'disruptive' business models, whether it be Bitcoin (banking), AirBnb (hotels), or Uber (cabs). We look around and see these industries burdened by regulation, which tends to create entrenched players and which seem to us to be inefficient. So we create similar peer-to-peer equivalents, only to start rediscovering the reasons for all those regulations in the first…

That is an absolutely terrible lesson to draw from this episode. First and most importantly, Airbnb and Uber are not disrupting industries burdened primarily by consumer safety regulations; they are disrupting industries burdened primarily by barriers to entrance that are designed to direct economic rents to politically favored actors. Huge difference. There is no plausible 'consumer protection' story for preventing…

Thank you. As an Uber user in DC, I have yet to encounter, or hear of any news event in which Uber put people in a dangerous or even inconvenient situation. It's infuriating to see people compare Uber to a poorly secured Bitcoin site, as if the regulations in banking are somehow equivalent to those with taxi cabs.

Uber only uses licensed sedan drivers. They are already subject to safety regulation, but unlike taxi cabs they are also checked by reviews from passengers. The most frightening experience I ever had in a vehicle was in a taxi cab taking me from the airport in San Antonio to my hotel. He was exceeding 90 mph, and driving recklessly, ignoring the turn signals of other drivers on the interstate. Where was your touted regulation then?

Re: Bitcoin exchange hacked via Rails exploit, funds stolen

#144

Post by vannevar »

Eliezer wrote: post #82
acslater00 wrote: post #75

Earlier quoted context omitted.

That is an absolutely terrible lesson to draw from this episode. First and most importantly, Airbnb and Uber are not disrupting industries burdened primarily by consumer safety regulations; they are disrupting industries burdened primarily by barriers to entrance that are designed to direct economic rents to politically favored actors. Huge difference. There is no plausible 'consumer protection' story for preventing…

Legitimate banks don't get hacked? Is that true?

They've been getting hacked as long as there have been banks, it's just that they used to have to physically break in, rob the tellers at gunpoint, or commit fraud by assuming someone's identity (say, by forging their signature). Either way, there is a regulatory framework in place that ensures that the depositors are made whole in the event of a such a 'hack'.

Re: Bitcoin exchange hacked via Rails exploit, funds stolen

#145

Post by ithcy2 »

tomjen3 wrote: post #99
dougmccune wrote: post #86

Earlier quoted context omitted.

Claiming hotel regulation has no benefit to consumers is simply not true. Consider the perspective of a resident of San Francisco (like me). SF has a very limited amount of housing. We can debate all day about ways to fix that and impediments to building more (and more affordable) housing, but the simple facts right now are that there are a LOT more people who want to live in SF than there are housing units. Addition…

You may value that prioritization, but that isn't strange as you are a renter and so prefer things aligned as close as possible to your personal benefit. That is simple egoism, don't coat it in nice language.

>you are a renter and so prefer things aligned as close as possible to your personal benefit

Non sequitur.

Re: Bitcoin exchange hacked via Rails exploit, funds stolen

#147

Post by illuminate »

lucisferre wrote: post #27
pavel_lishin wrote: post #4

I guess this is still the Wild Wild West era of Bitcoin; I'd wager plenty of banks got knocked off by bandits back in the day, too. What happened to a bank's customer's funds if it got robbed prior to 1933?

A lot of banks get knocked off today http://www.fbi.gov/stats-services/publications/bank-crime-st...

And aside from movies, the meth-heads can only carry and drive off with so much money. A few thousand here and there. It's a very inefficient time to be a bankrobber.

http://www.allgov.com/news/unusual-news/robbing-banks-is-not...

"Using confidential data on the value of every bank heist in the U.K. from 2005 to 2008, the trio came up with an economic model of bank robbery.

They found that the average revenue from a British bank robbery in 2005-2008 was only $31,600, although excluding the one-third of robberies that came up dry boosts the average to $46,600. But those proceeds have to be divided among the gang, and while extra gang members raise the average take, the haul per person decreases.

The average take per person per successful job was $19,792, equivalent to less than six months’ average wage in the UK, although being armed increased revenues substantially. While that may not sound too bad, multiple jobs greatly increase the risk of arrest and incarceration, as 20% of heists ended that way.

Data from the FBI paint a similar picture. In 2011, there were 5,086 bank robberies in the U.S., generating $38,343,501.96 in revenues for the perpetrators, or an average of $7,539 per heist. Excluding the robberies where nothing was taken increases the average only to $8,457. Not only is the return low, the risk is high: out of 13 people killed during bank robberies in 2011, 10 were robbers."

Re: Bitcoin exchange hacked via Rails exploit, funds stolen

#148

Post by meaty »

phillmv wrote: post #112
meaty wrote: post #76

Earlier quoted context omitted.

Bullshit. Rails pushes low time to market. That is all. Its built with precisely no engineering design or quality control on top of a poorly specified rickety language in a community of hype. However, my original generalizes the problem as a human issue which is where the real problem is: Did they do a risk analysis on rails - no Did they verify their architecture - no Did they perform input/type checking - no (sorry…

>Did they do a risk analysis on rails - no Actually, this bug was discovered precisely because people began to perform a more in depth analysis. >Did they perform input/type checking - no (sorry but statically typed languages win here) LOL. It's 2013. Can we stop having this preposterous argument?

Perhaps they should have done this up front, you know as part of the engineering, hence my point. Stopping and thinking for a bit usually covers these problems. I've read a huge chunk of the rails framework source code and it certainly used to be a pretty amateur piece of kit.

The argument is definitely not preposterous. Are you saying guarding against bad inputs and enforcing type is bad? A language which uses no type inference has less assumptions therefore is likely to be less error prone. I've proven this hundreds of times over the last 30 years of writing code in things from communications electronics to financial quotation platforms.

Re: Bitcoin exchange hacked via Rails exploit, funds stolen

#149

Post by btilly »

revelation wrote: post #135
btilly wrote: post #87

Earlier quoted context omitted.

This is a remote code exploit. For the web interface to do its job, it needs to be able to manipulate the wallet. They can stare at the code that does that, write their own, and do whatever they want.

Why does a web interface need to directly manipulate the wallet? It needs to store the transactions somewhere where the machine that executes them (using the wallet) can find them. You need the seperation and you need to closely monitor and control the transactions requested from the web interface to detect any fraud or misuse.

Doesn't matter whether you do it directly or indirectly. There is some way of automatically manipulating money, and it will discover what it is.

I can dream up architectures which limit manipulations, require the user to constantly type in passwords, etc. A company not security conscious enough to update is unlikely to have done that. But suppose they did, what happens? EVEN THEN you can turn the website into the digital equivalent of an ATM skimmer, and steal money. That is, of course, assuming that I have not managed to turn shell access into some more direct compromise of your whole network.

Here is the moral. If you're directly handling money or a money equivalent on your website, and someone has shell access, they will be able to steal from you.

Re: Bitcoin exchange hacked via Rails exploit, funds stolen

#150

Post by phillmv »

bdcravens wrote: post #129
phillmv wrote: post #110

Earlier quoted context omitted.

> If ASP.NET WebForms had the same level of security holes in the past years as Rails ... just wow. That's a joke, right? https://www.google.ca/search?q=asp.net+remote+code&oq=as... >we trust the framework authors implicitly You want to export your common web app code to a framework for all the same reasons you don't want to write your own crypto libraries - the more people look at it the safer it is. Far more damage…

I'd encourage you to read those vulnerabilities, not just Google to disprove me. I'm speaking specifically on the ability for someone to remotely execute code on a ASP.NET WebForms application, and that was just a random example. What you linked to was comparable to saying Groovy is insecure because of the most recent vulnerability found in Java browser plugins. ( http://www.itpro.co.uk/645031/new-java-7-bug-prompts-…

> What you linked to was comparable to saying Groovy is insecure because of the most recent vulnerability found in Java browser plugins.

Not really, because in .NET separating the "language" from the "framework" is a little thornier.

And the difference is all the more moot from a practical point of view: you still have to rush out and patch everything.

> However, when we get to a point where most apps are in frameworks, where would attackers turn their attention? Is an app inherently secure, or secure because it's less of a target?

You're not wrong in that widespread deployments of the same code base are what make these kinds of attacks possible in the first place; that's one downside of this kind of monoculture.

I can tell you however that these frameworks make it easier to write secure code in the first place. My business partner in my consultancy is a security researcher, and his job is to break apps. Frameworks like Rails make his life "harder" (in so far that one looks good by finding vulnerabilities); there is a ton of automated tooling that can probe and exploit a myriad of common-developer-mistakes-or-misconceptions.

Code you wrote within your team is audited by 10 people, tops. Code like Rails has been seen thousands of eyeballs. Even with several orders of magnitude of more attention, stuff like this still slips by. What are the odds you are better off?

Post reply on HN