Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Mt. Gox Has Been Hacked by People Trying to Find Out What Happened?

dzoba.com

Post reply on HN
Print view View original

61–70 of 157 posts

Re: Mt. Gox Has Been Hacked by People Trying to Find Out What Happened?

#61

Post by philsnow »

Gigablah wrote: post #17
zoba wrote: post #2

In case my server goes, here is the text: Right now in ##mtgox-chat someone named nanashi____ claims to be speaking for a group of hackers who have gotten into Mt Gox in an attempt to figure out what happened. Nanashi says they have a DB dump and are looking at what to do with it. Nanashi gave these links: A conversation in Japanese with Karpeles and a Banker ( http://picosong.com/Y7di/ ) Some Mt Gox Code ( http://pa…

In case anyone's wondering, "nanashi" means "anonymous" in Japanese.

it could also refer to the number 74, so maybe mr or ms anonymous is ~40yo right now ?

Re: Mt. Gox Has Been Hacked by People Trying to Find Out What Happened?

#62

Post by nikcub »

nathan_f77 wrote: post #8

Wow, that's a lot of my personal data leaked in these last months. My email and encrypted password in the adobe breach, my user id and part of my mobile number via SnapChat, and now hackers potentially have scans of my passport courtesy of Mt. Gox. I'm probably forgetting about some leaks, and who knows how many security breaches were never discovered. The internet is not a safe place.

and thats just the leaks you know about

Re: Mt. Gox Has Been Hacked by People Trying to Find Out What Happened?

#63

Post by parasight »

McGlockenshire wrote: post #19

The code is ... interesting. Smells organic, not designed. Comments are rare but usually useful. Highly coupled. Static methods everywhere. Violates SOLID principles. Basically, ignores current best practices. Clearly not designed for any sort of automated testing, which should be the first damn thing you do when there's any sort of money involved. Hell, even when there isn't money involved. We'd already guessed that…

One class to rule them all.

Re: Mt. Gox Has Been Hacked by People Trying to Find Out What Happened?

#64

Post by uid »

nothxbro wrote: post #27

Ok, some good news. It might be untrue about them having passport scans. Reason I say that, is the following: We know from the leaked mtgox crisis plan doc that they have 550,000 verified accounts. Each user who wanted to be verified had to scan at least 2 documents- a passport+license and a electric bill of sorts. Assuming both documents alone were only 100KB combined (and its likely way more than that since scans a…

so Gox were also leaking passport scans?

Re: Mt. Gox Has Been Hacked by People Trying to Find Out What Happened?

#65

Post by eterm »

awt wrote: post #37
nathan_f77 wrote: post #8

Wow, that's a lot of my personal data leaked in these last months. My email and encrypted password in the adobe breach, my user id and part of my mobile number via SnapChat, and now hackers potentially have scans of my passport courtesy of Mt. Gox. I'm probably forgetting about some leaks, and who knows how many security breaches were never discovered. The internet is not a safe place.

Was just thinking about the implications of my DL scan being out on the net and potential attempts at identity theft. Excluding market risks, my money is now safer in a properly generated cold bitcoin wallet than it is in my bank account.

So this is actually good news?

Re: Mt. Gox Has Been Hacked by People Trying to Find Out What Happened?

#66

Post by c0n5pir4cy »

sdrothrock wrote: post #47
TazeTSchnitzel wrote: post #46

Earlier quoted context omitted.

Karpeles making mistakes with honorifics? That's odd, even though it would he incorrect, surely he could just -san suffix everyone and be done with it?

I don't know about honorifics, but he was using "ore," according to Reddit. If he wrote the letter on the front page of Mt Gox, there are some weird/offputting polite language mistakes, too. (I can't listen to the recording right now and wouldn't get much out of it even if I could, since I can't hear well enough. :-/)

Using 俺 (ore) sounds extremely arrogant, it's also a very amateur mistake to make (or maybe it was even deliberate). it's definitely not suitable for a business sense as it either conveys superiority or familiarity.

Re: Mt. Gox Has Been Hacked by People Trying to Find Out What Happened?

#67

Post by negamax »

viraptor wrote: post #60

Thought I'll quickly scan the source code... On the first screen: $bean->Coins = (int)round($info['balance'] * 100000000); Really? Currency as a float and rounding? Just so that he can later: $client->sendToAddress($addr, $bean->Coins / 100000000); I'm ready to believe in any error "due to a bug" they claim now.

Can you explain what's wrong with this? If I had 1 million in $info[ 'balance' ]? Would $bean->Coins overflow?

Re: Mt. Gox Has Been Hacked by People Trying to Find Out What Happened?

#68

Post by reikonomusha »

negamax wrote: post #67
viraptor wrote: post #60

Thought I'll quickly scan the source code... On the first screen: $bean->Coins = (int)round($info['balance'] * 100000000); Really? Currency as a float and rounding? Just so that he can later: $client->sendToAddress($addr, $bean->Coins / 100000000); I'm ready to believe in any error "due to a bug" they claim now.

Can you explain what's wrong with this? If I had 1 million in $info[ 'balance' ]? Would $bean->Coins overflow?

Using floats to represent currency is a big no-no. Floats have limited precision, and some numbers aren't representable by floats. Go try adding 0.1 to itself over and over again in your favorite implementation.

It is better to represent as integers or fixed-precision numbers. That way, you are dealing with exact quantities.

Re: Mt. Gox Has Been Hacked by People Trying to Find Out What Happened?

#69

Post by viraptor »

negamax wrote: post #67
viraptor wrote: post #60

Thought I'll quickly scan the source code... On the first screen: $bean->Coins = (int)round($info['balance'] * 100000000); Really? Currency as a float and rounding? Just so that he can later: $client->sendToAddress($addr, $bean->Coins / 100000000); I'm ready to believe in any error "due to a bug" they claim now.

Can you explain what's wrong with this? If I had 1 million in $info[ 'balance' ]? Would $bean->Coins overflow?

The main issue is operating on the value intended for display rather than the precise value you get. The floating point value may not be always what you expect. For example you cannot even represent 0.1 precisely. See http://stackoverflow.com/questions/3730019/why-not-use-doubl...

In practice that means you can't be sure if `1/1000000` is higher or lower than the value you expect it to be. (to be pedantic, yes you can, because it's well defined, but it can spoil your calculations) When you deal with money, you want the result to be always precise.

Re: Mt. Gox Has Been Hacked by People Trying to Find Out What Happened?

#70

Post by negamax »

viraptor wrote: post #69
negamax wrote: post #67

Earlier quoted context omitted.

Can you explain what's wrong with this? If I had 1 million in $info[ 'balance' ]? Would $bean->Coins overflow?

The main issue is operating on the value intended for display rather than the precise value you get. The floating point value may not be always what you expect. For example you cannot even represent 0.1 precisely. See http://stackoverflow.com/questions/3730019/why-not-use-doubl... In practice that means you can't be sure if `1/1000000` is higher or lower than the value you expect it to be. (to be pedantic, yes you ca…

If Bitcoin has x point precision and I multiply every amount by 1e^x. Won't that in essence gives me correct integer value to work with. Provided I haven't overflowed the integer max?
Post reply on HN