Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Bitcoin exchange hacked via Rails exploit, funds stolen

bitcointalk.org

Post reply on HN
Print view View original

161–170 of 279 posts

Re: Bitcoin exchange hacked via Rails exploit, funds stolen

#161

Post by meaty »

phillmv wrote: post #150
bdcravens wrote: post #129

Earlier quoted context omitted.

I'd encourage you to read those vulnerabilities, not just Google to disprove me. I'm speaking specifically on the ability for someone to remotely execute code on a ASP.NET WebForms application, and that was just a random example. What you linked to was comparable to saying Groovy is insecure because of the most recent vulnerability found in Java browser plugins. ( http://www.itpro.co.uk/645031/new-java-7-bug-prompts-…

> What you linked to was comparable to saying Groovy is insecure because of the most recent vulnerability found in Java browser plugins. Not really, because in .NET separating the "language" from the "framework" is a little thornier. And the difference is all the more moot from a practical point of view: you still have to rush out and patch everything. > However, when we get to a point where most apps are in framewor…

That's probably 10s of thousands of eyes who don't know their arse from their elbow, including the guys who wrote it.

Possibly 2-3 people have read it who know their shit. The rest are just consumers.

Frameworks only centralise the security concerns - they don't necessarily make it better. That is in the hands of the implementor and their ability to build bullet proof abstractions. One fuck up and your system is globally compromised. It is the right solution, but you need the right people. Rails hasn't had the right people.

Re: Bitcoin exchange hacked via Rails exploit, funds stolen

#162

Post by rprasad »

sskates wrote: post #153
tptacek wrote: post #89

Earlier quoted context omitted.

There is no plausible 'consumer protection' story that would explain why building codes for permanent residence are not good enough for temporary residence as well. The law is there to protect hotel operators from vacation rental competition. This is not a very thoughtful comment. There are obvious reasons why properties zones for permanent residence aren't appropriate for transient residence; the latter type of occu…

Is there any evidence that apartments rented out with AirBnB are more prone to crime and abuse of non-tenants than apartments not rented out with AirBnB?

Yes. There is enough evidence of this that NYC created an entirely new beauracracy just to handle these issues. Numerous papers have published articles describing fraudulent or deceptive AirBnB listings, the guests' lack of resource, AirBnB's lack of assistance.

Re: Bitcoin exchange hacked via Rails exploit, funds stolen

#163

Post by a-stjohn »

thomasz wrote: post #141
cs702 wrote: post #105

Imagine that a thief breaks and enters into a warehouse which is holding physical gold for its customers, and the thief steals all their gold. The warehouse and/or its customers will suffer losses, but every single ounce of the gold stolen by the thief will continue to be as valuable as any other ounce of gold. In other words, gold will continue to be the same exact commodity. Essentially the same thing has happened…

> its integrity has NOT been compromised Shesh. A Bitcoin has no inherent value. If such incidents become common enough, nobody will be willing to buy bitcoins for dollars or accept bitcoins as payments for goods,which means that the thieves will sit on a bunch of useless bits.

...which is also no different than paper money, or the money we store digitally in our banks...

Re: Bitcoin exchange hacked via Rails exploit, funds stolen

#164

Post by phillmv »

meaty wrote: post #148
phillmv wrote: post #112

Earlier quoted context omitted.

>Did they do a risk analysis on rails - no Actually, this bug was discovered precisely because people began to perform a more in depth analysis. >Did they perform input/type checking - no (sorry but statically typed languages win here) LOL. It's 2013. Can we stop having this preposterous argument?

Perhaps they should have done this up front, you know as part of the engineering, hence my point. Stopping and thinking for a bit usually covers these problems. I've read a huge chunk of the rails framework source code and it certainly used to be a pretty amateur piece of kit. The argument is definitely not preposterous. Are you saying guarding against bad inputs and enforcing type is bad? A language which uses no ty…

>Perhaps they should have done this up front, you know as part of the engineering, hence my point.

And you know what, I have a feeling they did have multiple people looking over the code, and it's been vigorously refactored over the years. Rails 3 is a somewhat different beast from Rails 2.

Careful auditing reduces bugs but does not eliminate them. Crowing about "proper engineering" is very nice but is somewhat farcical given the state of the art in the industry.

>Are you saying guarding against bad inputs and enforcing type is bad?

No. Of course you guard against bad inputs.

But that's wholly separate from enforcing the type of the objects. And it's not like people are eval()ing stuff willy-nilly.

Re: Bitcoin exchange hacked via Rails exploit, funds stolen

#165

Post by tveita »

pavel_lishin wrote: post #4

I guess this is still the Wild Wild West era of Bitcoin; I'd wager plenty of banks got knocked off by bandits back in the day, too. What happened to a bank's customer's funds if it got robbed prior to 1933?

If only there were some way to learn from history - then it wouldn't take newly launched services decades to meet basic modern security standards.

Seriously, I don't see any comparison between this and a bank robbery. It's not like banks in 1933 were only just figuring out that they should lock the door where they stored the money, or that they should repair any holes in the wall, or even that paper walls, though they are quick to build, have a very bad record on security.

Re: Bitcoin exchange hacked via Rails exploit, funds stolen

#166

Post by rossjudson »

tptacek wrote: post #89
acslater00 wrote: post #75

Earlier quoted context omitted.

That is an absolutely terrible lesson to draw from this episode. First and most importantly, Airbnb and Uber are not disrupting industries burdened primarily by consumer safety regulations; they are disrupting industries burdened primarily by barriers to entrance that are designed to direct economic rents to politically favored actors. Huge difference. There is no plausible 'consumer protection' story for preventing…

There is no plausible 'consumer protection' story that would explain why building codes for permanent residence are not good enough for temporary residence as well. The law is there to protect hotel operators from vacation rental competition. This is not a very thoughtful comment. There are obvious reasons why properties zones for permanent residence aren't appropriate for transient residence; the latter type of occu…

Building codes (construction codes; how you must build), not zoning (what you're allowed to build).

Re: Bitcoin exchange hacked via Rails exploit, funds stolen

#167

Post by Benferhat »

muyuu wrote: post #17

People still keep big hot wallets?? Wow.

They probably had a decent chunk in cold storage, which is why they can afford to 'cover the losses': "Before the wild speculations beginn, the service will be recovered and we pay the losses out of our own pockets." [0]

[0] https://bitcointalk.org/index.php?topic=135919.msg1448056#ms...

Re: Bitcoin exchange hacked via Rails exploit, funds stolen

#168

Post by chevas »

thomasz wrote: post #141
cs702 wrote: post #105

Imagine that a thief breaks and enters into a warehouse which is holding physical gold for its customers, and the thief steals all their gold. The warehouse and/or its customers will suffer losses, but every single ounce of the gold stolen by the thief will continue to be as valuable as any other ounce of gold. In other words, gold will continue to be the same exact commodity. Essentially the same thing has happened…

> its integrity has NOT been compromised Shesh. A Bitcoin has no inherent value. If such incidents become common enough, nobody will be willing to buy bitcoins for dollars or accept bitcoins as payments for goods,which means that the thieves will sit on a bunch of useless bits.

A USD has no inherent value since it is also a FIAT currency. At least BitCoin's algorithm is locked into a growth curve that eventually stops. The US can continue to print money. THe way I see it, BTC is going to increase in value.

Re: Bitcoin exchange hacked via Rails exploit, funds stolen

#169

Post by Benferhat »

danielweber wrote: post #62
mattlong wrote: post #58

It's likely due to confirmation bias, but it seems that almost every bitcoin company has some (usually careless or inexcusable) gap in their security...

Back when I cared about bitcoin, I'd go look at their websites for vulnerabilities and usually find them. Then I would tell them. They never replied but did fix them.

What made you stop caring?

Re: Bitcoin exchange hacked via Rails exploit, funds stolen

#170

Post by phillmv »

meaty wrote: post #161
phillmv wrote: post #150

Earlier quoted context omitted.

> What you linked to was comparable to saying Groovy is insecure because of the most recent vulnerability found in Java browser plugins. Not really, because in .NET separating the "language" from the "framework" is a little thornier. And the difference is all the more moot from a practical point of view: you still have to rush out and patch everything. > However, when we get to a point where most apps are in framewor…

That's probably 10s of thousands of eyes who don't know their arse from their elbow, including the guys who wrote it. Possibly 2-3 people have read it who know their shit. The rest are just consumers. Frameworks only centralise the security concerns - they don't necessarily make it better. That is in the hands of the implementor and their ability to build bullet proof abstractions. One fuck up and your system is glob…

I think you seriously underestimate the sheer quantity of people looking through it, my friend.

And if we're using that metric, it's extremely unlikely your average team member knows his or her ass from their elbow, either.

Post reply on HN