Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Bitcoin payment processor BIPS compromised, 1295 BTC stolen

bitcointalk.org

Post reply on HN
Print view View original

1–10 of 70 posts

Re: Bitcoin payment processor BIPS compromised, 1295 BTC stolen

#5

Post by mmmooo »

skorgu wrote: post #4

That technical explanation sounds almost like word salad. How did a DDoS hit your SAN in the first place and how did your SAN blowing up allow a compromise?

iSCSI san, so attached via ethernet or similar, taking network devices offline would take san offline. The rest is pure magic.

Re: Bitcoin payment processor BIPS compromised, 1295 BTC stolen

#6

Post by packetslave »

mmmooo wrote: post #5
skorgu wrote: post #4

That technical explanation sounds almost like word salad. How did a DDoS hit your SAN in the first place and how did your SAN blowing up allow a compromise?

iSCSI san, so attached via ethernet or similar, taking network devices offline would take san offline. The rest is pure magic.

If your iSCSI network traffic can be impacted by an Internet-based DDoS, your network architect is an idiot.

Re: Bitcoin payment processor BIPS compromised, 1295 BTC stolen

#7

Post by mmmooo »

packetslave wrote: post #6
mmmooo wrote: post #5

Earlier quoted context omitted.

iSCSI san, so attached via ethernet or similar, taking network devices offline would take san offline. The rest is pure magic.

If your iSCSI network traffic can be impacted by an Internet-based DDoS, your network architect is an idiot.

yep, sounded like they shared switches between public and iscsi lans, or worse.

Re: Bitcoin payment processor BIPS compromised, 1295 BTC stolen

#8

Post by cryptocoin »

skorgu wrote: post #4

That technical explanation sounds almost like word salad. How did a DDoS hit your SAN in the first place and how did your SAN blowing up allow a compromise?

If you are new to bitcoin-related sites, you might find this story close to legitimate. But anyone that reads the article will see there is this "basic" flaw mentioning that DDoS attacks gave access to the server. If you read past (paid) articles about this very same service, you will see claims about how secure the system is, and how expert everyone that developed it is. The same was claimed by inputs.io, I'm sure you have read about that story earlier.

The thing is, if you want to use bitcoin, you cannot trust third parties to hold your coins for you. If you want to support bitcoin in your business, you cannot trust other sites to handle the payment for you. Yes, it is not convenient. But you have everything available to handle this yourself and, yes, you will need someone competent to do that for you if you are not into it. Bitcoin is not meant for the average user or the unaware merchant and it might never be, people need to start accepting this fact.

This is almost an exact copy from the other thread here https://news.ycombinator.com/item?id=6793984. I assume it is fine as it is ok to post duplicates like this topic.

Post reply on HN