Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Bitcoin exchange hacked via Rails exploit, funds stolen

bitcointalk.org

Post reply on HN
Print view View original

201–210 of 279 posts

Re: Bitcoin exchange hacked via Rails exploit, funds stolen

#201

Post by danielweber »

moe wrote: post #192
tptacek wrote: post #47

Earlier quoted context omitted.

You cannot leave your site open to a pre-auth remote code execution vulnerability while you wait for fixes to the asset pipeline or to any other component of Rails. I don't know that that's what you're saying you did but we need to be glacier-blue-ice-clear about this. Nobody gets to wait on bugs like this. You patch or workaround immediately or, most probably, you shut your app down.

You also cannot publish little known pre-auth remote code execution vulnerabilities for your web-framework without first publishing a mitigation patch that doesn't paint a BIG FAT RED ARROW onto the attack vector. You also cannot leave 6 years of vulnerable Rails-versions up on rubygems.org without even backporting your patch (yes, they're still up there now ). It makes no sense to blame the users of a web-framework,…

As a fan of responsible disclosure, the sad state of the universe is that telling people "upgrade to X now" on an open-source project makes it very easy for anyone to diff to find out what the fix is, which makes it very easy for people to figure out how to exploit it.

Re: Bitcoin exchange hacked via Rails exploit, funds stolen

#202

Post by runeks »

politician wrote: post #128
runeks wrote: post #77

Earlier quoted context omitted.

This is really the proper way to do it. Other people have suggested that this black box should store public/private key pairs generated from the user's password for each user on the exchange. So when a user signs up for an account on the exchange, Javascript code generates a private key from the user's password, client side. The corresponding public key is sent and stored in the offline transaction signing box. Whene…

Bitcoin supports "cold storage" which is effectively a wallet that can receive funds, but is offline so you cannot transfer funds out of it. That is, the private key is stored offline. There is really no excuse for exchanges not using cold storage.

I think this will require too much manual intervention to be viable. Customers not being able to withdraw their funds because they've been sent to the cold wallet makes them unhappy with the service.

Re: Bitcoin exchange hacked via Rails exploit, funds stolen

#203

Post by makomk »

rprasad wrote: post #131
snitko wrote: post #61

Earlier quoted context omitted.

Except that regulating things is not the same as holding a monopoly on regulations. If government is so completely confident that its currency is much more superior and stable, well, allow the competition! Make it legal to receive whatever I want to receive as a payment. Let businesses regulate the currency market and determine what currency is reliable. Oh wait, except that then government cannot tax you, of course.…

Note how free market works great in this case: the organization costs people their lost money and will most likely go out of business. Unlike big banks. That sounds horrible. If a bank gets hacked and "loses" my money, they owe me that money . Federal and state law requires them to put that money back into my bank account, at the bank's expense. (Note, this is not the same as FDIC insurance, which applies in the even…

> The free market still applies: on top of getting their money back, customers can take their money to more secure banks.

Unless the bank goes bankrupt. Basically, if the bank plays fast and loose with customers' money the customers shoulder the risks whilst the bank owners get the rewards - and there's no way customers can tell whether this is happening, since they neither have access to the bank's internal records and systems nor the skills and resources to make sense of them.

Actually, the only reason the baks have to return the money in the first place is because of Government intervention, and even that's not enough. Unfortunately, thanks to binding arbitration the US has a free market of sorts in dispute resolution, and the banks and financial providers have so much more market power than consumers that they can effectively pressure arbitrators into siding with them. If they don't, the bank won't do business with them and they can't find work, whereas most consumers only need to use arbitration a few times in their lifetime at most.

Re: Bitcoin exchange hacked via Rails exploit, funds stolen

#204

Post by SkyMarshal »

the_cat_kittles wrote: post #174
badgar wrote: post #36

Earlier quoted context omitted.

Bitcoin bank developers commonly "do it wrong."

Seems like it's high time for someone to come along who knows how to do it right.

I don't think the economics are there yet to attract such people.

Re: Bitcoin exchange hacked via Rails exploit, funds stolen

#205

Post by TallboyOne »

jacquesm wrote: post #199
TallboyOne wrote: post #90

And this is why I would NEVER in 10,000 years trust an anonymous form of money that can't be recovered or tracked to a group of average developers who in this case are obviously are amateur and don't even respond to massive critical security updates. I'm sure all the rest are like that to some degree as well. No thanks, I'll stick with cash under my matress before ever using that. I feel bad for anyone that actually…

You're confusing several things there. Bitcoin the protocol and rails the framework are not the same thing. Bitcoin was never compromised, rails was, and if these devs would have done their work and patched their servers they'd have been fine.

That's exactly what I'm talking about. I know the difference.

You are trusting your money with someone who can't even make simple critical updates to an app.

Furthermore: unless some established institution wants to work with bitcoin.. like a bank, then youre leaving your money up to the hands of some individual developers who, as made apparent by this post, dont really have their shit together.

I could be wrong, there could be some massively secured bitcoin bank somewhere with a large team of security experts, insurance, etc... but based on the fact that most bitcoin banks i see use an unstyled bootstrap theme I can't imagine they really know what theyre doing.

cliffnotes: I have yet to see a bitcoin bank website that doesnt look amateur as hell. I bet money that whatever bitcoin bank was hacked had all kinds of pages on it about "how we have a full team of security advisors making sure your money is safe!" yeah right.

bitcoin itself is cool, the mediums used to store your money are what I'm not trusting.

Re: Bitcoin exchange hacked via Rails exploit, funds stolen

#206

Post by pimeys »

tptacek wrote: post #155
sskates wrote: post #153

Earlier quoted context omitted.

Is there any evidence that apartments rented out with AirBnB are more prone to crime and abuse of non-tenants than apartments not rented out with AirBnB?

You're effectively asking whether apartments rented to unchecked strangers for days at a time are more prone to abuse than apartments rented months or years at a time. There is a reason hotels require "special use" zoning exceptions in cities, and it's not because Mariott and Hyatt have captured the city council; it's often the residents who create uproars when those exceptions are granted.

This is seen in Berlin, where some houses have several ferienwohnung. People come and go and are usually very loud while staying. People who really live in those buildings complain a lot and for a reason.

Re: Bitcoin exchange hacked via Rails exploit, funds stolen

#207

Post by moe »

danielweber wrote: post #201
moe wrote: post #192

Earlier quoted context omitted.

You also cannot publish little known pre-auth remote code execution vulnerabilities for your web-framework without first publishing a mitigation patch that doesn't paint a BIG FAT RED ARROW onto the attack vector. You also cannot leave 6 years of vulnerable Rails-versions up on rubygems.org without even backporting your patch (yes, they're still up there now ). It makes no sense to blame the users of a web-framework,…

As a fan of responsible disclosure, the sad state of the universe is that telling people "upgrade to X now" on an open-source project makes it very easy for anyone to diff to find out what the fix is, which makes it very easy for people to figure out how to exploit it.

No. A thousand times.

A bit more creativity should be allowed when handling a vulnerability of this magnitude.

For example, publish a patch that escapes all input in curious ways, presumably to prevent SQL injection. Pad it, obfuscate the actual fix with code-noise, make it annoying to read. Then release it as some handwavy, semi-plausible "follow-up" to the previous SQL-injection, urging everyone to upgrade in small caps.

Yes, a handful of blackhats will see through the bluff. However, it will likely be the exact same blackhats that already had discovered the issue after the initial SQL injection advisory.

This would have given the Rails-community a head-start, rather than unleashing every script-kiddy on the planet at once.

Re: Bitcoin exchange hacked via Rails exploit, funds stolen

#208

Post by jballanc »

jspthrowaway2 wrote: post #109
Eliezer wrote: post #82

Earlier quoted context omitted.

Legitimate banks don't get hacked? Is that true?

You don't hear of any high-profile bank disclosures, which I imagine is probably because they have security teams that keep up with everything religiously. Most old brick banks have internal systems architected in ways that a younger intruder in the Anonymous mold wouldn't know anything about, as well; you're starting to get into big iron Cobol land. That said, I don't think it's an impossible task (is anything?), an…

Nothing is impossible, but remotely hacking a bank is pretty damn close. A number of years ago, a friend worked for a large multi-national bank. He once described to me some of the key components of the security system. While the details are hazy (such as I understood them at the time), I do remember that one of the key points was that one of the "very important" servers that handled transactions between outside entities (i.e. other banks) and internal systems was double-firewalled. That is, you couldn't initiate connections from the internet or the intranet. The server would only make connections to hosts of its own choosing, on its own schedule.

Modifying or updating anything on the server required physical access.

That server was located in a secure vault.

Re: Bitcoin exchange hacked via Rails exploit, funds stolen

#209

Post by hackerboos »

astrodust wrote: post #57
gst wrote: post #50

After the Rails exploit was announced I was jokingly mentioning to a friend that this will hit a few Bitcoin exchanges. Seems there are still exchange operators that haven't learned anything about the previous exploits.

Any exchange operator that didn't stop whatever they were doing, be it eating a sandwich or having a baby, and run to patch their servers has failed their user base completely. This was no undocumented zero day hack.

Exactly. They should have shut down immediately. This is amateur hour for the Bitcoin community, yet again.

Re: Bitcoin exchange hacked via Rails exploit, funds stolen

#210

Post by m0nastic »

moe wrote: post #207
danielweber wrote: post #201

Earlier quoted context omitted.

As a fan of responsible disclosure, the sad state of the universe is that telling people "upgrade to X now" on an open-source project makes it very easy for anyone to diff to find out what the fix is, which makes it very easy for people to figure out how to exploit it.

No. A thousand times. A bit more creativity should be allowed when handling a vulnerability of this magnitude. For example, publish a patch that escapes all input in curious ways, presumably to prevent SQL injection. Pad it, obfuscate the actual fix with code-noise, make it annoying to read. Then release it as some handwavy, semi-plausible "follow-up" to the previous SQL-injection, urging everyone to upgrade in small…

So you're advocating releasing a "decoy" patch that's intentionally obtuse and doesn't actually fix the issue?

And then downplaying the severity by not encouraging developers to take the follow-up patch seriously?

That's a flat out terrible idea.

Post reply on HN