Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Bitcoin exchange hacked via Rails exploit, funds stolen

bitcointalk.org

Post reply on HN
Print view View original

121–130 of 279 posts

Re: Bitcoin exchange hacked via Rails exploit, funds stolen

#121

Post by temp453463343 »

dougmccune wrote: post #86
acslater00 wrote: post #75

Earlier quoted context omitted.

That is an absolutely terrible lesson to draw from this episode. First and most importantly, Airbnb and Uber are not disrupting industries burdened primarily by consumer safety regulations; they are disrupting industries burdened primarily by barriers to entrance that are designed to direct economic rents to politically favored actors. Huge difference. There is no plausible 'consumer protection' story for preventing…

Claiming hotel regulation has no benefit to consumers is simply not true. Consider the perspective of a resident of San Francisco (like me). SF has a very limited amount of housing. We can debate all day about ways to fix that and impediments to building more (and more affordable) housing, but the simple facts right now are that there are a LOT more people who want to live in SF than there are housing units. Addition…

Thank god they aren't building more housing in SF - a temporary fix (b/c eventually you'll run out of housing again) to a non-problem. The NewYorkification of San Francisco would ruin the city.

I talked about it more here http://news.ycombinator.com/item?id=4815087 http://news.ycombinator.com/item?id=4815247 http://news.ycombinator.com/item?id=4815537

Re: Bitcoin exchange hacked via Rails exploit, funds stolen

#122

Post by benmmurphy »

tlowrimore wrote: post #79
martinced wrote: post #73

Basically all the comments points to how amateurish that exchange was run compared to a real online banking website. Now how many real banks do run their website using Rails? Ruby? You guys certainly aren't as stupid as to believe this is the latest major 0-day Rails exploit to create havoc right? And now comes the answers containing the logical fallacy: "All languages/frameworks have security issues" . Which is rubb…

Many banks like to use Java rather than something amateurish like Ruby. Here's a link for you, I'll let you draw your own conclusions: http://blog.trendmicro.com/trendlabs-security-intelligence/j... Cheers!

and if people ran ruby applets in the browser they would have much worse security :) java client sandbox is a different story than java server side

Re: Bitcoin exchange hacked via Rails exploit, funds stolen

#123

Post by Xylakant »

btilly wrote: post #107
Xylakant wrote: post #59

Earlier quoted context omitted.

I completely agree: It's a stupid bug that lingered long in the codebase, probably because it was hidden in an obscure feature that nobody knew about or used. It's embarrassing, but I bet that pretty much every larger framework out there had a remote code execution bug[1]. Still, it's wrong to point at it and say "that's an engineering or QA bug that's symptomatic for the rails bunch." I'm not a rails friend, but the…

I bet that pretty much every larger framework out there had a remote code execution bug[1]. I would gladly take the other side of that bet. A decade ago I was working on a site using Perl/Mason/Apache. When we were bought by eBay, we were put through a thorough pen test. The ONLY security hole they identified as needing fixing was a redirect that could redirect to any URL anywhere. (The people testing us were shocked…

> I would gladly take the other side of that bet.

You admit that the framework you used had a couple of exploits and you were not affected because you turned of all features that you didn't need. The current rails vulnerability does not affect you if you turned off all features you didn't need. Same argument. So we have a hole in Mason, I already cited one in Spring, someone else cited one in .NET http://news.ycombinator.com/item?id=5043839.

Re: Bitcoin exchange hacked via Rails exploit, funds stolen

#125

Post by jcoder »

Disclaimer: I know virtually nothing about bitcoin past what I've read on HN.

Bitcoin are uniquely identifiable by nature. Has there been any attempt to create and maintain a manifest of "tainted" (i.e., stolen) bc that could be referenced during transactions?

If a receiver of bc knows that they are tainted, and that the next receiver might refuse them, then they might refuse them as well.

I understand that I'm hand-waving over the "Alice reports the bc she just paid Bob as stolen" problem, and I don't have an answer to that---maybe users subscribe to this service that investigates bc robbery---just thinking out loud.

Re: Bitcoin exchange hacked via Rails exploit, funds stolen

#126

Post by yafujifide »

acslater00 wrote: post #75
vannevar wrote: post #42

There seems to be a pattern emerging in all of these 'disruptive' business models, whether it be Bitcoin (banking), AirBnb (hotels), or Uber (cabs). We look around and see these industries burdened by regulation, which tends to create entrenched players and which seem to us to be inefficient. So we create similar peer-to-peer equivalents, only to start rediscovering the reasons for all those regulations in the first…

That is an absolutely terrible lesson to draw from this episode. First and most importantly, Airbnb and Uber are not disrupting industries burdened primarily by consumer safety regulations; they are disrupting industries burdened primarily by barriers to entrance that are designed to direct economic rents to politically favored actors. Huge difference. There is no plausible 'consumer protection' story for preventing…

You had me until you claimed that bank regulations are different than other regulations.

Re: Bitcoin exchange hacked via Rails exploit, funds stolen

#127

Post by rprasad »

acslater00 wrote: post #75
vannevar wrote: post #42

There seems to be a pattern emerging in all of these 'disruptive' business models, whether it be Bitcoin (banking), AirBnb (hotels), or Uber (cabs). We look around and see these industries burdened by regulation, which tends to create entrenched players and which seem to us to be inefficient. So we create similar peer-to-peer equivalents, only to start rediscovering the reasons for all those regulations in the first…

That is an absolutely terrible lesson to draw from this episode. First and most importantly, Airbnb and Uber are not disrupting industries burdened primarily by consumer safety regulations; they are disrupting industries burdened primarily by barriers to entrance that are designed to direct economic rents to politically favored actors. Huge difference. There is no plausible 'consumer protection' story for preventing…

I disagree 100% with your non-Bitcoin factual assertions because they are demonstrably false but I do not have the time to address them point-by-point.

But I will address this one major factual error: Legitimate banks don't get hacked because there are billions of dollars at stake for the banking institution, and their business literally depends on their ability to secure payments.

Banks are not in the business of securing payments; that is what payment processors like Mastercard and Visa do. Banks are in the business of investing money which has been deposited with them. As a result of (state and federal) legislation, banks are liable for making depositors whole in the event of theft, so they are motivated to invest significant sums in security.

Re: Bitcoin exchange hacked via Rails exploit, funds stolen

#128

Post by politician »

runeks wrote: post #77
jart wrote: post #52

Earlier quoted context omitted.

I think an even better question is why they didn't have multiple layers of security that would have prevented a bug in a public facing server from compromising financial data. When systems are designed with security in mind, rather than simply throwing together a web/sql application, people put a lot of time and effort into constructing barriers to protect the integrity of their data. Take for instance the CACert cer…

This is really the proper way to do it. Other people have suggested that this black box should store public/private key pairs generated from the user's password for each user on the exchange. So when a user signs up for an account on the exchange, Javascript code generates a private key from the user's password, client side. The corresponding public key is sent and stored in the offline transaction signing box. Whene…

Bitcoin supports "cold storage" which is effectively a wallet that can receive funds, but is offline so you cannot transfer funds out of it. That is, the private key is stored offline.

There is really no excuse for exchanges not using cold storage.

Re: Bitcoin exchange hacked via Rails exploit, funds stolen

#129

Post by bdcravens »

phillmv wrote: post #110
bdcravens wrote: post #96

Earlier quoted context omitted.

I don't think "Rails generation" means only Rails. I think the idea is that we're so dependent on frameworks these days, there are massive pieces of our application that we have no clue how they work, and worse, we trust the framework authors implicitly. More and more we're seeing the downfalls of this. As Rails is essentially the best known and most deployed, hence the name. Think about it: for most apps, probably 9…

> If ASP.NET WebForms had the same level of security holes in the past years as Rails ... just wow. That's a joke, right? https://www.google.ca/search?q=asp.net+remote+code&oq=as... >we trust the framework authors implicitly You want to export your common web app code to a framework for all the same reasons you don't want to write your own crypto libraries - the more people look at it the safer it is. Far more damage…

I'd encourage you to read those vulnerabilities, not just Google to disprove me. I'm speaking specifically on the ability for someone to remotely execute code on a ASP.NET WebForms application, and that was just a random example. What you linked to was comparable to saying Groovy is insecure because of the most recent vulnerability found in Java browser plugins. (http://www.itpro.co.uk/645031/new-java-7-bug-prompts-calls-f...)

I never claimed we shouldn't leverage well-written projects. I do challenge the idea that there's many eyeballs: most download and have faith. There's a bunch of eyeballs, yes, but not nearly as many as we tell ourselves.

You're totally right about frameworks resulting in better, more secure apps. However, much of that is relative: when most apps are hand-crafting SQL, JavaScript, and form handling, a framework is heads above other apps, especially when most attackers go for low-hanging fruit. However, when we get to a point where most apps are in frameworks, where would attackers turn their attention? Is an app inherently secure, or secure because it's less of a target? (Think the Mac vs. PC security arguments)

Re: Bitcoin exchange hacked via Rails exploit, funds stolen

#130

Post by Xylakant »

bdcravens wrote: post #120
MrBra wrote: post #41

I suspect that a lot of anti ruby / rails people are happy to have the occasion to prove that the language and framework that they didn't want to learn is ...bad... and are posting these news all around the web... with that small grin in their mind... fair enough... but rest assured, Ruby & Rails haven't even came close to the end of their ass-kicking :)

You say that like it's an epic conquest to learn Rails. You assume that people who criticize Rails haven't learned it. Probably a large number of haters, yes, but there's also plenty who have taken the weekend or so it takes to get a good working knowledge of Rails. That's what makes Rails great: you can be productive fast. I'd venture to say there's more Java/C# devs who know Rails than vice-versa. "Ass-kicking"? Is…

> Probably a large number of haters, yes, but there's also plenty who have taken the weekend or so it takes to get a good working knowledge of Rails.

IMHO, this is a misconception, though I must admit it's one that gets pushed by a lot of parties. There's a lot of moving parts in rails and a lot of magic shortcuts, but IMHO you should actually know what goes on behind the scenes before using rails for a serious project.

> If a language or framework has major security holes, it should fail in the marketplace

So no more Spring, no more ASP.NET? Come on, we should be beyond that. Holes appear everywhere. What matters is how they are handled.

Post reply on HN