Account hijacking on MtGox
homakov.blogspot.com
Account hijacking on MtGox
1–10 of 38 posts
Re: Account hijacking on MtGox
#2Would 2 factor auth even fix this? If you are hijacking the session ID, the user has already authenticated.
Re: Account hijacking on MtGox
#3Would 2 factor auth even fix this? If you are hijacking the session ID, the user has already authenticated.
Depends how 2FA is used. If on per/action basis it could save (you know the SID but don't know the OTP/token)
Re: Account hijacking on MtGox
#4Would 2 factor auth even fix this? If you are hijacking the session ID, the user has already authenticated.
In addition to login, 2FA is typically required for irreversible and other sensitive operations like transfers, for exactly this reason (local malware, XSS, etc, can steal cookies)
This should be pretty much required for all services where users may have significant amounts of money at stake. And users need to be educated to actually enable it.
Coinbase finally enabled 2FA for transfers (of more than $100/day) this week: http://blog.coinbase.com/post/73364231652/security-updates-o...
Re: Account hijacking on MtGox
#5Would 2 factor auth even fix this? If you are hijacking the session ID, the user has already authenticated.
Depends how 2FA is used. If on per/action basis it could save (you know the SID but don't know the OTP/token)
MtGox requires a new 2FA code for pretty much every action you can take (buy/sell/withdraw)
Re: Account hijacking on MtGox
#6I'm not sure whether Egor Homakov received a reward for reporting this to Mt.Gox which he clearly deserves. However we have contacted to Mt.Gox to understand if they would be launching a vulnerability reward program and the response we got is that they would launch one during Q1 2014. Read more at our blog about it. https://blog.crowdcurity.com/how-to-measure-the-security-of-...
Re: Account hijacking on MtGox
#7I'm not sure whether Egor Homakov received a reward for reporting this to Mt.Gox which he clearly deserves. However we have contacted to Mt.Gox to understand if they would be launching a vulnerability reward program and the response we got is that they would launch one during Q1 2014. Read more at our blog about it. https://blog.crowdcurity.com/how-to-measure-the-security-of-...
No rewards
Re: Account hijacking on MtGox
#8Gox uses a special 3FA where it takes 6+weeks to get anything out of that exchange. See 144 page bitcointalk thread 'Mtgox delays [gathering]'.
Re: Account hijacking on MtGox
#9Gox uses a special 3FA where it takes 6+weeks to get anything out of that exchange. See 144 page bitcointalk thread 'Mtgox delays [gathering]'.
6+ months, actually. Still waiting on one transfer.
Re: Account hijacking on MtGox
#10I'm not sure whether Egor Homakov received a reward for reporting this to Mt.Gox which he clearly deserves. However we have contacted to Mt.Gox to understand if they would be launching a vulnerability reward program and the response we got is that they would launch one during Q1 2014. Read more at our blog about it. https://blog.crowdcurity.com/how-to-measure-the-security-of-...
No rewards
Is there a quality bitcoin bounty reward program for vulnerabilities?