Bitcoin exchange hacked via Rails exploit, funds stolen • Hacker News Board

Re: Bitcoin exchange hacked via Rails exploit, funds stolen

#171

Post by jeffem » Fri, Jan 11, 2013, 6:53 PM UTC

vannevar wrote: post #156

jeffem wrote: post #116

Earlier quoted context omitted.

You have a point, but you're taking it too far. I agree that companies need to take a look at how their industry is regulated and what purpose those regulations serve. But the fact that companies can come into these types of industries, openly skirt the regulations, and still be massively successful shows that the existing laws aren't meeting the needs of the people who use these services. And how exactly has governm…

I'm not sure what problems you're talking about in the first place. That's the point. :-) A number of them have been enumerated above: protecting banking customers from loss in the event of theft; regulating the location and safety of hotels; providing some means of recourse against a dishonest cabbie.

How are those "problems inherent in the peer-to-peer model"? Aren't those problems any business in the industry has to face?

Re: Bitcoin exchange hacked via Rails exploit, funds stolen

#172

Post by Benferhat » Fri, Jan 11, 2013, 6:54 PM UTC

thomasz wrote: post #141

cs702 wrote: post #105

Imagine that a thief breaks and enters into a warehouse which is holding physical gold for its customers, and the thief steals all their gold. The warehouse and/or its customers will suffer losses, but every single ounce of the gold stolen by the thief will continue to be as valuable as any other ounce of gold. In other words, gold will continue to be the same exact commodity. Essentially the same thing has happened…

> its integrity has NOT been compromised Shesh. A Bitcoin has no inherent value. If such incidents become common enough, nobody will be willing to buy bitcoins for dollars or accept bitcoins as payments for goods,which means that the thieves will sit on a bunch of useless bits.

> If such incidents become common enough, nobody will be willing to buy bitcoins

No, that would only be true if people were forced to store their bitcoins on vulnerable bitcoin exchanges, which they're not.

Re: Bitcoin exchange hacked via Rails exploit, funds stolen

#173

Post by mrb » Fri, Jan 11, 2013, 6:54 PM UTC

TallboyOne wrote: post #90

And this is why I would NEVER in 10,000 years trust an anonymous form of money that can't be recovered or tracked to a group of average developers who in this case are obviously are amateur and don't even respond to massive critical security updates. I'm sure all the rest are like that to some degree as well. No thanks, I'll stick with cash under my matress before ever using that. I feel bad for anyone that actually…

You are wrong, bitcoins can be "tracked". The whole point of the Bitcoin block chain is to track all transactions. The community has developed a few tool to track "tainted" money.

Also, you already trust an anonymous form of money: cash. Why so? Mostly because insurance exists against cash theft. As the Bitcoin ecosystem develops, eventually an insurance market will develop too. It sounds like Bitcoin is too unmature for you. So, wait. In this theft case, the exchange itself is providing this insurance to you: they guaranteed they will cover the stolen funds themselves.

Also, the beauty of Bitcoin is that you don't have to trust an exchange like the one that was the victim of the theft. You can decide to take care of your own security by storing bitcoins on your own computer. There are a few efforts in progress to develop credit-card sized hardware wallet in order to provide extremely safe bitcoin wallets to non-technical users who are unable to, or don't know how to keep a computer secure for hosting a Bitcoin wallet. Again, it sounds like you need to wait for these efforts to mature before judging Bitcoin.

Re: Bitcoin exchange hacked via Rails exploit, funds stolen

#174

Post by the_cat_kittles » Fri, Jan 11, 2013, 6:54 PM UTC

badgar wrote: post #36

TazeTSchnitzel wrote: post #23

If it's that easy to steal, you're probably doing it wrong. The front-end server should never have direct access to the bitcoin RPC server, since the front-end is likely to be vulnerable. Instead, it should contact a robust back end server, which then talks to the RPC.

Bitcoin bank developers commonly "do it wrong."

Seems like it's high time for someone to come along who knows how to do it right.

Re: Bitcoin exchange hacked via Rails exploit, funds stolen

#175

Post by bradleyland » Fri, Jan 11, 2013, 7:00 PM UTC

jrochkind1 wrote: post #114

bradleyland wrote: post #44

Earlier quoted context omitted.

This vulnerability went from disclosure to exploit extremely quickly. The CVE was published on the 8th. I can't speak for them, but in the process of trying to update, we ran in to some issues with therubyracer (a core component of the Rails asset pipeline) and libv8 (the library that therubyracer uses to embed the V8 engine). It was extraordinarily bad timing, and it slowed down our update process by almost a day wh…

therubyracer thing was annoying, but there's no reason it had to delay your upgrades -- you could simply lock to the same version of therubyracer you were using previously without problems, it was just as compatible with the new version of rails. The fact remains though, that this exploit was _so_ severe, that, depending on how attractive a target you were and how disastrous it would be for you to be compromised (fin…

I'm not saying that you shouldn't mitigate this vulnerability immediately (which is not the same as upgrading to 3.2.11). People are asking why/how this kind of thing happens, and I'm pointing out that there are a lot of opportunities to make the wrong decision in this situation.

Re: Bitcoin exchange hacked via Rails exploit, funds stolen

#176

Post by philwelch » Fri, Jan 11, 2013, 7:01 PM UTC

a-stjohn wrote: post #163

thomasz wrote: post #141

Earlier quoted context omitted.

> its integrity has NOT been compromised Shesh. A Bitcoin has no inherent value. If such incidents become common enough, nobody will be willing to buy bitcoins for dollars or accept bitcoins as payments for goods,which means that the thieves will sit on a bunch of useless bits.

...which is also no different than paper money, or the money we store digitally in our banks...

The difference is, you can't pay your taxes in bitcoin.

Re: Bitcoin exchange hacked via Rails exploit, funds stolen

#177

Post by malandrew » Fri, Jan 11, 2013, 7:03 PM UTC

dougmccune wrote: post #86

acslater00 wrote: post #75

Earlier quoted context omitted.

That is an absolutely terrible lesson to draw from this episode. First and most importantly, Airbnb and Uber are not disrupting industries burdened primarily by consumer safety regulations; they are disrupting industries burdened primarily by barriers to entrance that are designed to direct economic rents to politically favored actors. Huge difference. There is no plausible 'consumer protection' story for preventing…

Claiming hotel regulation has no benefit to consumers is simply not true. Consider the perspective of a resident of San Francisco (like me). SF has a very limited amount of housing. We can debate all day about ways to fix that and impediments to building more (and more affordable) housing, but the simple facts right now are that there are a LOT more people who want to live in SF than there are housing units. Addition…

The problem you described has a very simple solution. Grant more permits to increase the number of brand new housing units added to the market each year. The rate at which SF adds housing units given demand is absurd. In fact, you'd probably have many more small business opportunities in SF if the city were willing to add residential units faster.

Re: Bitcoin exchange hacked via Rails exploit, funds stolen

#178

Post by jacquesm » Fri, Jan 11, 2013, 7:04 PM UTC

Eliezer wrote: post #82

acslater00 wrote: post #75

Earlier quoted context omitted.

That is an absolutely terrible lesson to draw from this episode. First and most importantly, Airbnb and Uber are not disrupting industries burdened primarily by consumer safety regulations; they are disrupting industries burdened primarily by barriers to entrance that are designed to direct economic rents to politically favored actors. Huge difference. There is no plausible 'consumer protection' story for preventing…

Legitimate banks don't get hacked? Is that true?

Commercial banks do get hacked, it's a very well established fact. For obvious reasons they don't like to talk to the press about these things.

Re: Bitcoin exchange hacked via Rails exploit, funds stolen

#179

Post by danielweber » Fri, Jan 11, 2013, 7:05 PM UTC

Benferhat wrote: post #169

danielweber wrote: post #62

Earlier quoted context omitted.

Back when I cared about bitcoin, I'd go look at their websites for vulnerabilities and usually find them. Then I would tell them. They never replied but did fix them.

What made you stop caring?

I built a simple program to transfer money between two of my wallets, and .01 bitcoin (a substantial fraction of my bitcoin wealth) disappeared as a transaction cost.

I asked around and was told "oh, yeah, they changed the defaults recently so there is always a transaction cost, you should pay closer attention to mailing list X, it's more up-to-date than the API documentation."

I decided I didn't like dealing with something where I had to assume the fine print was out to screw me and walked away. I have other things to do with my life.

(I probably am misremembering a few details of something that took place a few years ago.)

Re: Bitcoin exchange hacked via Rails exploit, funds stolen

#180

Post by cstejerean » Fri, Jan 11, 2013, 7:05 PM UTC

btilly wrote: post #149

revelation wrote: post #135

Earlier quoted context omitted.

Why does a web interface need to directly manipulate the wallet? It needs to store the transactions somewhere where the machine that executes them (using the wallet) can find them. You need the seperation and you need to closely monitor and control the transactions requested from the web interface to detect any fraud or misuse.

Doesn't matter whether you do it directly or indirectly. There is some way of automatically manipulating money, and it will discover what it is. I can dream up architectures which limit manipulations, require the user to constantly type in passwords, etc. A company not security conscious enough to update is unlikely to have done that. But suppose they did, what happens? EVEN THEN you can turn the website into the dig…

That's why you put velocity controls in place, so that if things go south you can limit losses. Coupled with alerting/reporting on transaction volumes and you should be able to get ahead of someone that bypassed your front end before they make off with all of your cash.

That said, if the backend is also vulnerable to the same or another exploit, that's not going to buy you much.