Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Mt. Gox Has Been Hacked by People Trying to Find Out What Happened?

dzoba.com

Post reply on HN
Print view View original

31–40 of 157 posts

Re: Mt. Gox Has Been Hacked by People Trying to Find Out What Happened?

#31

Post by ekianjo »

nothxbro wrote: post #27

Ok, some good news. It might be untrue about them having passport scans. Reason I say that, is the following: We know from the leaked mtgox crisis plan doc that they have 550,000 verified accounts. Each user who wanted to be verified had to scan at least 2 documents- a passport+license and a electric bill of sorts. Assuming both documents alone were only 100KB combined (and its likely way more than that since scans a…

especially since they required passport scans in color and high resolution (at least 200 dpi).

Re: Mt. Gox Has Been Hacked by People Trying to Find Out What Happened?

#32

Post by mschuster91 »

nothxbro wrote: post #27

Ok, some good news. It might be untrue about them having passport scans. Reason I say that, is the following: We know from the leaked mtgox crisis plan doc that they have 550,000 verified accounts. Each user who wanted to be verified had to scan at least 2 documents- a passport+license and a electric bill of sorts. Assuming both documents alone were only 100KB combined (and its likely way more than that since scans a…

It is possible for them to extract the MRZ data of the passport (the Machine Readable Zone), it contains the passport ID, issuer state, DOB and DOE.

I don't know if the regulatory requirements state that you must keep a photocopy, but in case you do not it would be foolish to store more data than you need.

Re: Mt. Gox Has Been Hacked by People Trying to Find Out What Happened?

#33

Post by pinaceae »

McGlockenshire wrote: post #19

The code is ... interesting. Smells organic, not designed. Comments are rare but usually useful. Highly coupled. Static methods everywhere. Violates SOLID principles. Basically, ignores current best practices. Clearly not designed for any sort of automated testing, which should be the first damn thing you do when there's any sort of money involved. Hell, even when there isn't money involved. We'd already guessed that…

no shit, magic the gathering exchange is not coded like paypal.

Re: Mt. Gox Has Been Hacked by People Trying to Find Out What Happened?

#34

Post by sounds »

zoba wrote: post #2

In case my server goes, here is the text: Right now in ##mtgox-chat someone named nanashi____ claims to be speaking for a group of hackers who have gotten into Mt Gox in an attempt to figure out what happened. Nanashi says they have a DB dump and are looking at what to do with it. Nanashi gave these links: A conversation in Japanese with Karpeles and a Banker ( http://picosong.com/Y7di/ ) Some Mt Gox Code ( http://pa…

Thanks, zoba.

Here is the link you added to the IRC transcript:

http://pastebin.com/N7B5DC4d

"Nanashi" (japanese: Anonymous) claims to be in Serbia, but posting on behalf of a Russian group.

Re: Mt. Gox Has Been Hacked by People Trying to Find Out What Happened?

#35

Post by bencollier49 »

nothxbro wrote: post #27

Ok, some good news. It might be untrue about them having passport scans. Reason I say that, is the following: We know from the leaked mtgox crisis plan doc that they have 550,000 verified accounts. Each user who wanted to be verified had to scan at least 2 documents- a passport+license and a electric bill of sorts. Assuming both documents alone were only 100KB combined (and its likely way more than that since scans a…

Perhaps Gox lost two thirds of them. Or the hackers didn't download them all.

Re: Mt. Gox Has Been Hacked by People Trying to Find Out What Happened?

#36

Post by claudius »

nwh wrote: post #28
nathan_f77 wrote: post #8

Wow, that's a lot of my personal data leaked in these last months. My email and encrypted password in the adobe breach, my user id and part of my mobile number via SnapChat, and now hackers potentially have scans of my passport courtesy of Mt. Gox. I'm probably forgetting about some leaks, and who knows how many security breaches were never discovered. The internet is not a safe place.

I'm still getting almost daily phishing/malware from the Mt Gox leak in 2011, and I never even signed up for anything more than to see what it's interface was like. Can't imagine how that will be with people having copies of passports (supposedly).

My spam folder is also full of, well, spam addressed to the email address I supplied to Dropbox (and only Dropbox) when I first signed up there sometime in 2011 and later leaked (I think 2012).

Sometimes I wish data privacy laws were stricter, but it appears that not even financial services laws are sufficiently strict, as just demonstrated here.

Re: Mt. Gox Has Been Hacked by People Trying to Find Out What Happened?

#37

Post by awt »

nathan_f77 wrote: post #8

Wow, that's a lot of my personal data leaked in these last months. My email and encrypted password in the adobe breach, my user id and part of my mobile number via SnapChat, and now hackers potentially have scans of my passport courtesy of Mt. Gox. I'm probably forgetting about some leaks, and who knows how many security breaches were never discovered. The internet is not a safe place.

Was just thinking about the implications of my DL scan being out on the net and potential attempts at identity theft. Excluding market risks, my money is now safer in a properly generated cold bitcoin wallet than it is in my bank account.

Re: Mt. Gox Has Been Hacked by People Trying to Find Out What Happened?

#38

Post by talkingquickly »

nothxbro wrote: post #27

Ok, some good news. It might be untrue about them having passport scans. Reason I say that, is the following: We know from the leaked mtgox crisis plan doc that they have 550,000 verified accounts. Each user who wanted to be verified had to scan at least 2 documents- a passport+license and a electric bill of sorts. Assuming both documents alone were only 100KB combined (and its likely way more than that since scans a…

My impression was they were claiming to have passport scans and a 20GB DB dump, e.g. that they were separate?

Re: Mt. Gox Has Been Hacked by People Trying to Find Out What Happened?

#39

Post by aegiso »

McGlockenshire wrote: post #19

The code is ... interesting. Smells organic, not designed. Comments are rare but usually useful. Highly coupled. Static methods everywhere. Violates SOLID principles. Basically, ignores current best practices. Clearly not designed for any sort of automated testing, which should be the first damn thing you do when there's any sort of money involved. Hell, even when there isn't money involved. We'd already guessed that…

Way too much schadenfreude given Gox's history.

Although contrary to popular belief Gox was never a Magic exchange, they were a Bitcoin startup at a time when Bitcoin was not much more than internet lols and pizza deliveries. The first thing you do when hacking together a stupid exchange for a joke e-currency isn't writing unit tests. You just write the code and blast it up on a domain you had lying around for a different project.

Cue runaway success, a company sale or two, scaling issues with complicated technology and not much precedent legal or otherwise, and this is what you get.

There is nothing at all surprising about this code. And it seems Gox's problems were much more deeply rooted than the subjective non-compliance of their code with "best practices".

Re: Mt. Gox Has Been Hacked by People Trying to Find Out What Happened?

#40

Post by McGlockenshire »

aegiso wrote: post #39
McGlockenshire wrote: post #19

The code is ... interesting. Smells organic, not designed. Comments are rare but usually useful. Highly coupled. Static methods everywhere. Violates SOLID principles. Basically, ignores current best practices. Clearly not designed for any sort of automated testing, which should be the first damn thing you do when there's any sort of money involved. Hell, even when there isn't money involved. We'd already guessed that…

Way too much schadenfreude given Gox's history. Although contrary to popular belief Gox was never a Magic exchange, they were a Bitcoin startup at a time when Bitcoin was not much more than internet lols and pizza deliveries. The first thing you do when hacking together a stupid exchange for a joke e-currency isn't writing unit tests. You just write the code and blast it up on a domain you had lying around for a diff…

> contrary to popular belief Gox was never a Magic exchange

The Wayback Machine disagrees.

http://web.archive.org/web/20070701000000*/http://mtgox.com

Whether it was open as one is unclear, but that was the obvious intent here.

Also, remember that the current owners aren't the original owners. This code is wrong in design but new in attempted style, made or majorly updated within the past year or two (based on the language features used).

Post reply on HN