Bitcoinica just reported losing 10K BTC (worth $50K USD) in this same incident.
- http://bitcointalk.org/index.php?topic=66961.msg778254#msg77...
Compromised Linode, thousands of BitCoins stolen
161–170 of 249 posts
Re: Compromised Linode, thousands of BitCoins stolen
#162Update: the Linode compromise first reported was that of the "slush" mining pool (mining.bitcoin.cz), reporting a loss of 3094 BTC. Second report was the donation-funded bitcoin faucet, reporting a loss of all of its 5 BTC.
Third report is the biggest, Bitcoinica.com which is arguably the second-largest exchange. Their main site is hosted at rackspace, but their 'hot wallet' was hosted at Linode, and contained 10,000 BTC which were stolen.[1]
1: https://www.bitcoinica.com/posts/warning-please-do-not-re-us...
EDIT: Those not following this incident on the bitcoin forums might be amused that the attacker used the stolen bitcoins to form a transaction with a size of 1337 bytes. That's probably not a coincidence, since the size of bitcoin transactions are usually under 1kb.
http://blockchain.info/tx-index/2893660/d9804de366aa4c2a0156...
Re: Compromised Linode, thousands of BitCoins stolen
#163Earlier quoted context omitted.
You can salt all you want, but an 8 character password with a single round is going to fall very, very fast. Salt, being public, has nothing to do with it.
It does however mean you have to spend two days per password, rather than two days for the entire user base, or ten minutes with a pre-existing lookup table.
No, consumer GPUs can do almost a billion SHA1 hashes per second now. We're talking seconds to minutes for "complex" passwords, not days.
Re: Compromised Linode, thousands of BitCoins stolen
#164" As a respected hosting provider, I hope they do the correct thing and refund me for this liability due to their error. Many people trust Linode, and they have proven themselves as a serious contender for hosting critical sensitive operations on the internet. I would hate to not see them live up to that reputation. " "hosting critical sensitive operations" in particular. If you are doing "critical sensitive operatio…
I can put a "not responsible for stolen items" sign in my restaurant, but if the coat check employee bolts out the door when you hand them your coat, I'm buying you a new one.
What if the coat was full of diamonds?
Re: Compromised Linode, thousands of BitCoins stolen
#165Earlier quoted context omitted.
I can put a "not responsible for stolen items" sign in my restaurant, but if the coat check employee bolts out the door when you hand them your coat, I'm buying you a new one.
Yeah, but could the (ex) coat owner hold the restaurant's landlord liable? Isn't it the restaurant _managers_ problem? I think there's a _lot_ of "grey areas" here, and while I feel sympathy for the guy who's out ~$13k worth of bitcoins, I can't help but think he was "doing the wrong thing" relying on the security of an inexpensive vps to keep them safe…
What would you recommend? Would you say the same thing if he'd been colocating and a data center employee had stolen his bitcoins? Because that seems far more analogous than any restaurant analogy, and I don't see any reasonable way for somebody who's not a huge corporation to avoid this kind of risk.
You have to trust somebody at some point unless you're keeping the server locked in your own closet. It seems really bizarre to me to say that a hosting provider doesn't have a responsibility not to steal your stuff.
Re: Compromised Linode, thousands of BitCoins stolen
#166" As a respected hosting provider, I hope they do the correct thing and refund me for this liability due to their error. Many people trust Linode, and they have proven themselves as a serious contender for hosting critical sensitive operations on the internet. I would hate to not see them live up to that reputation. " "hosting critical sensitive operations" in particular. If you are doing "critical sensitive operatio…
"please think for a second what liability you would want for any mistakes that you make with your web startup or idea"
It seems to me that bitcoin wallets are a relatively new and not well enough understood risk. There are very few other "files" like them, in that an attacker copying them can deprive you of their value in a way that you cant protect with backups. I feel a big part of current "internet security best practices" are about minimising the risk of getting exploited - but with a pragmatic limit to how much effort you invest mediated by the excuse of "if we _do_ get rooted, we can always reinstall and recover from backups". It'll only cost you time, and perhaps some reputation, and may put assumed-private-to-you information in someone else's hands, but it hasn't deprived you of access to any of your data. That doesn't apply to bitcoin wallets, and example like this are pointing out flaws in assumptions people are making about appropriate ways to manage them.
It'd suck to be "that guy" who provides the object lesson in why we need to think differently about bitcoin wallets to just about any other file type we might put on an internet accessible machine, but we _do_, and I don't know whether we have an answer to the question "Is there a way to secure a bitcoin wallet on a machine someone else has root access to (either your datacenter's staff with physical access, or the people with hypervisor access to the hardware your vm is running on)?"
I _think_ the answer is "if you can't trust those people, you can't risk storing your bitcoins there". There's a reason people keep their money in banks, and not in train station luggage lockers. I'm guessing inexpensive commodity VPS's should be considered closer to storage lockers than bank vaults. I suspect the finance sector and/or fortune500 companies have hosting arrangements with companies offering bank-vault grade protection and reserve bank style insurance - but sure as hell not at $24.95/month.
Re: Compromised Linode, thousands of BitCoins stolen
#167Earlier quoted context omitted.
you do realize that in this theory, the same person then went and stole thousands of dollars in bitcoins, right? I don't think they were worrying about liability...
You misunderstand. Not the thief's liability, Linodes. If someone, say, engages in insider trading because of something they saw in Linode's own analysis system, Linode can be sued for failing to protect that information. If they have a policy of never reading customer data (and can prove it) that becomes much harder. The posited "anti virus checker" would throw that promise out the window.
How so? Google credibly claims (somehow) that they don't "read" customer email, even though they run the largest-scale automated email reading system on the planet.
Re: Compromised Linode, thousands of BitCoins stolen
#168Earlier quoted context omitted.
I'm a Linode fanboy, but we need maximum transparency on what occurred and what's being done. What support interface? How compromised? Who's credentials, etc.
Hopefully they're working on it, and will give a post mortem once they get it sorted out. I'm inclined to show patience and not demand they do anything other than ascertain the scale of the breach, alert those affected, and secure their systems at this point. Later, they can get into what happened and how they will avoid it in the future.
We can't wait for a full postmortem before Linode says anything.
Linode can't just leave us all wondering about our own security while pouring over over someone else's Pastebins.
Re: Compromised Linode, thousands of BitCoins stolen
#169It sucks that money was lost but I can't help but to shake my head at someone keeping something like that on a cheap VPS. It's just stupid to think that was at all safe. That's something you should do on your personal computer where you can assure your security.
I'm not really sure if the author of the article expects to be compensated but if so, he's dreaming. Just read through their terms.
Next time he won't be so ignorant as to put something so sensitive on a server like this.
Re: Compromised Linode, thousands of BitCoins stolen
#170Earlier quoted context omitted.
It's certainly a grey area, but at what point is it safe to assume that if you get hacked, it's not going to be because your ISP got hacked? Say this happened to Amazon and it affected a company like Heroku or dropbox, both users of AWS? Regardless of what terms of service says, I'll bet there's some liability somewhere. And if there's a cut off, maybe linode should advertise that? "Hey, we're cheap, but you get what…
I'd say this is more akin to stashing a bunch of money in a self-storage unit instead of a bank account. One explicitly insures against theft, the other does not. The onus is on you as a customer to decide what to go with.
> One explicitly insures against theft, the other does not.
I'd take issue with that summary. If I put things in a self-storage unit, and it gets robbed because some employee left his master key under the door mat, regardless of how bad of an idea it was to store my money there, that's still their issue.
Think about it this way. I could store my money under a table at McDonald's, in a self-storage unit, or in a bank. Clearly the self-storage unit should provide me some more security than McDonald's. So when an attacker gets access through some really trivial method that they really should be protected against, that's their fault; it doesn't matter that there was a better security option, because it's still below what I was paying for.