Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Bitcoin exchange hacked via Rails exploit, funds stolen

bitcointalk.org

Post reply on HN
Print view View original

231–240 of 279 posts

Re: Bitcoin exchange hacked via Rails exploit, funds stolen

#231

Post by tptacek »

moe wrote: post #192
tptacek wrote: post #47

Earlier quoted context omitted.

You cannot leave your site open to a pre-auth remote code execution vulnerability while you wait for fixes to the asset pipeline or to any other component of Rails. I don't know that that's what you're saying you did but we need to be glacier-blue-ice-clear about this. Nobody gets to wait on bugs like this. You patch or workaround immediately or, most probably, you shut your app down.

You also cannot publish little known pre-auth remote code execution vulnerabilities for your web-framework without first publishing a mitigation patch that doesn't paint a BIG FAT RED ARROW onto the attack vector. You also cannot leave 6 years of vulnerable Rails-versions up on rubygems.org without even backporting your patch (yes, they're still up there now ). It makes no sense to blame the users of a web-framework,…

I sympathise with you but (a) none of this matters in context; you still have to fix immediately or pull the plug and (b) you are deluding yourself if you think a flaw that 5 teams found independently the day the last SQLI advisory was released wasn't going to be in Metasploit within 7 days. This bug was too damn blatant.

I don't know why people weren't taking a hard look at the params processing code path in Rails for 6 years, but they clearly weren't. The SQLI bug from last week pointed people at that code, it got its first real shake, and that's all there is to say about it.

Re: Bitcoin exchange hacked via Rails exploit, funds stolen

#232

Post by tptacek »

moe wrote: post #207
danielweber wrote: post #201

Earlier quoted context omitted.

As a fan of responsible disclosure, the sad state of the universe is that telling people "upgrade to X now" on an open-source project makes it very easy for anyone to diff to find out what the fix is, which makes it very easy for people to figure out how to exploit it.

No. A thousand times. A bit more creativity should be allowed when handling a vulnerability of this magnitude. For example, publish a patch that escapes all input in curious ways, presumably to prevent SQL injection. Pad it, obfuscate the actual fix with code-noise, make it annoying to read. Then release it as some handwavy, semi-plausible "follow-up" to the previous SQL-injection, urging everyone to upgrade in small…

I was actually pretty upset because I thought that might have been what the Rails team was trying to do --- to come up with an occlusive patch, like you're advocating. Because that plan was. not. going. to. work. When multiple teams flag the same RCE on the same day, the only reasonable conclusion to come to is that the cat is out of the bag.

What needed to happen is what happened: a patch and a series of workarounds were produced as soon as possible.

Nobody got to choreograph this one. The control you think the Rails team had over this, they did not have.

Re: Bitcoin exchange hacked via Rails exploit, funds stolen

#233

Post by protome »

bdcravens wrote: post #120
MrBra wrote: post #41

I suspect that a lot of anti ruby / rails people are happy to have the occasion to prove that the language and framework that they didn't want to learn is ...bad... and are posting these news all around the web... with that small grin in their mind... fair enough... but rest assured, Ruby & Rails haven't even came close to the end of their ass-kicking :)

You say that like it's an epic conquest to learn Rails. You assume that people who criticize Rails haven't learned it. Probably a large number of haters, yes, but there's also plenty who have taken the weekend or so it takes to get a good working knowledge of Rails. That's what makes Rails great: you can be productive fast. I'd venture to say there's more Java/C# devs who know Rails than vice-versa. "Ass-kicking"? Is…

> You say that like it's an epic conquest to learn Rails. > [...] there's also plenty who have taken the weekend or so it takes to get a good working knowledge of Rails.

It is a fair enough conquest to learn Rails the proper way, knowing exactly what is happening under the hood. Rails productivity doesn't come from how easy it is to generate some pre-built basic controllers or models without knowing what is involved, Rails productivity comes from how well it is engineered and connected in the whole picture. In fact, all Rails pro's will tell you that they have stopped using those "automagical features that make productivy fast" as soon as they were able to understand what they were doing, for the sake of more granular customization. So, in 2 words, you won't have a good working knowledge of Rails in a week-end, expecially if you don't know ruby. You'll just learn to use some "generators".

> If a language or framework has major security holes, it should > fail in the marketplace

It should in a perfect world designed by an IT professional which fortunately it isn't. It will not in reality, and fortunately we have plenty of cases for this.

> I'm going to assume it's a troll post. After all, when I see your username I can't help but imagine [...]

You have a poor imagination.

Re: Bitcoin exchange hacked via Rails exploit, funds stolen

#234

Post by m0nastic »

moe wrote: post #228
m0nastic wrote: post #225

Earlier quoted context omitted.

If a Linux distro released a kernel patch for a super-critical security vulnerability that lied about its nature, AND downplayed its importance, users would go apeshit (justifiably).

You're still making no sense. Various large projects, including the kernel, have seen silent security patches (yes, even by Linus himself). Also there is no "downplaying" in declaring any kind of problem as a remote SQL injection vulnerability. That is still obviously urgent enough for everyone to patch immediately. Yet it doesn't attract blackhats in the same way as blarting "remote code injection".

Mis-labeling a Remote Code Execution vulnerability as SQL-I is absolutely downplaying the severity. SQL-I is a bad finding, RCE is tantamount to the worst thing you could possibly find in an application.

There were people on this very site who were commenting about whether they should concern themselves with this patch (initially because people erroneously attributed the vuln to SQL-I, and then later because they "weren't using XML anyway")

Those kinds of things happen when you don't clearly describe what a vulnerability is, and when you try to mask how big of a deal something is.

This was a huge vulnerability. It was critically important that everyone running a Rails app fix it immediately. Shouting that from the rooftops was absolutely the right approach. Cloak and Dagger bullshit to try and hide that is unequivocally a bad idea.

Re: Bitcoin exchange hacked via Rails exploit, funds stolen

#235

Post by tptacek »

m0nastic wrote: post #234
moe wrote: post #228

Earlier quoted context omitted.

You're still making no sense. Various large projects, including the kernel, have seen silent security patches (yes, even by Linus himself). Also there is no "downplaying" in declaring any kind of problem as a remote SQL injection vulnerability. That is still obviously urgent enough for everyone to patch immediately. Yet it doesn't attract blackhats in the same way as blarting "remote code injection".

Mis-labeling a Remote Code Execution vulnerability as SQL-I is absolutely downplaying the severity. SQL-I is a bad finding, RCE is tantamount to the worst thing you could possibly find in an application. There were people on this very site who were commenting about whether they should concern themselves with this patch (initially because people erroneously attributed the vuln to SQL-I, and then later because they "we…

In fairness, while I'm specifically not a fan of that Phusion post, it was referring to a bug that wasn't an RCE.

Re: Bitcoin exchange hacked via Rails exploit, funds stolen

#236

Post by lreeves »

temphn wrote: post #124

Well, with a Bitcoin bank, at least as a customer you have a chance of not being robbed. By contrast, if you keep your money with an FDIC bank in USD, you are having your funds diluted away every day (the latest proposal is to print a $1 trillion coin).

Bitcoins are constantly being mined by other people that have spent money for physical hardware; every coin they generate devalues whatever currency you're holding. I fail to see how you consider central-bank driven inflation theft but not the whole concept of mining Bitcoins.

Re: Bitcoin exchange hacked via Rails exploit, funds stolen

#237

Post by bradleyland »

moe wrote: post #207
danielweber wrote: post #201

Earlier quoted context omitted.

As a fan of responsible disclosure, the sad state of the universe is that telling people "upgrade to X now" on an open-source project makes it very easy for anyone to diff to find out what the fix is, which makes it very easy for people to figure out how to exploit it.

No. A thousand times. A bit more creativity should be allowed when handling a vulnerability of this magnitude. For example, publish a patch that escapes all input in curious ways, presumably to prevent SQL injection. Pad it, obfuscate the actual fix with code-noise, make it annoying to read. Then release it as some handwavy, semi-plausible "follow-up" to the previous SQL-injection, urging everyone to upgrade in small…

I was actually pretty pissed that it wasn't explicitly labeled as a "remote code execution" vulnerability in the CVE post title. This is open source, you don't get to hide. The code is there. Trying to be clever about releasing a patch isn't going to help, because every patch gets looked at by a large community of security people. Some of those people are the good guys, but some are the bad guys.

Nothing about this situation was good, but hiding it would have only made it worse. When you're serving shit sandwiches for lunch, it's best to let everyone know that's what's on the menu. End of story.

Re: Bitcoin exchange hacked via Rails exploit, funds stolen

#238

Post by ewillbefull »

rprasad wrote: post #224
Tichy wrote: post #200

Earlier quoted context omitted.

Gold does not have that much of inherent value either.

Gold is inherently useful as a tangible object with exploitable physical properties. Gold, for example, has good conductivity and is used to plate electrical connections. Gold is also useful for its rust-resistance. Thus, on this basis, like all useable physical goods, gold has some inherent value as a commodity.

Bitcoin has inherent value and "physical properties" that far exceed what Gold can offer.

1. Bitcoins can't be counterfeited. If you receive them with even just a few confirmations on the blockchain, it's probably going to be there forever.

2. You can confirm the legitimacy of Bitcoins, en masse, without any cost.

3. You can store bitcoins without any cost.

4. Bitcoins are much easier to transfer to other people.

5. You can form contracts and advanced redemption conditions for transferred coins.

If Bitcoin had no "inherent value" then it should be worthless. Maybe Mises Regression Theorem is wrong?

Re: Bitcoin exchange hacked via Rails exploit, funds stolen

#239

Post by m0nastic »

tptacek wrote: post #235
m0nastic wrote: post #234

Earlier quoted context omitted.

Mis-labeling a Remote Code Execution vulnerability as SQL-I is absolutely downplaying the severity. SQL-I is a bad finding, RCE is tantamount to the worst thing you could possibly find in an application. There were people on this very site who were commenting about whether they should concern themselves with this patch (initially because people erroneously attributed the vuln to SQL-I, and then later because they "we…

In fairness, while I'm specifically not a fan of that Phusion post, it was referring to a bug that wasn't an RCE.

Right, the Phusion post was referring to the previous bug though, right?

I disagree with Moe that labeling the latest bug as an SQL-I instead of RCE is a good strategy to ward off blackhats.

Re: Bitcoin exchange hacked via Rails exploit, funds stolen

#240

Post by davidw »

jrochkind1 wrote: post #108
tomjen3 wrote: post #99

Earlier quoted context omitted.

You may value that prioritization, but that isn't strange as you are a renter and so prefer things aligned as close as possible to your personal benefit. That is simple egoism, don't coat it in nice language.

Um, in exactly the same way that tourists prefering their interests to be prioritized is also 'egoism', right? Or property owners preferring their incomes to be maximized, just like renters preferring their rents to be minimized. So?

I'm not a "market fundamentalist" by a long shot, but markets generally do a pretty good job of balancing various interests like this. They're a lot better in a case like this than the government attempting to decide how many units must be available for which uses.
Post reply on HN