Compromised Linode, thousands of BitCoins stolen • Hacker News Board

Re: Compromised Linode, thousands of BitCoins stolen

#51

Post by ajross » Thu, Mar 01, 2012, 10:31 PM UTC

gravitronic wrote: post #46

ajross wrote: post #36

Earlier quoted context omitted.

I'd be very surprised (and suspicious) if they were running any kind of diangostics over their customer's data without an explicit signed contract. The liability worry there alone is scary.

you do realize that in this theory, the same person then went and stole thousands of dollars in bitcoins, right? I don't think they were worrying about liability...

You misunderstand. Not the thief's liability, Linodes. If someone, say, engages in insider trading because of something they saw in Linode's own analysis system, Linode can be sued for failing to protect that information. If they have a policy of never reading customer data (and can prove it) that becomes much harder. The posited "anti virus checker" would throw that promise out the window.

Re: Compromised Linode, thousands of BitCoins stolen

#52

Post by ajross » Thu, Mar 01, 2012, 10:33 PM UTC

driverdan wrote: post #47

ajross wrote: post #42

Earlier quoted context omitted.

Has anyone solved the liquidity mess? Say I want to buy a car and have to unload $20k of bitcoins. Can I do that? With a latency of less than 24 hours? Without getting my PayPal account frozen?

What does PayPal have to do with Bitcoins? Trying to buy or sell Bitcoins with PayPal is foolish.

Right. So no liquidity solution then. It's foolish, obviously, because it doesn't work: it looks like fraud. As it does to all the other banks out there. So bitcoins are illiquid. They're like oddball collections. "Valuable" to a few, but basically useless as an "investment" to people with liquidity requirements.

One corrolary you'll note is that because they are both illiquid and volatile, they even suck as a speculative investment: if you make a bad bet you can't get out of it.

Re: Compromised Linode, thousands of BitCoins stolen

#53

Post by plasma » Thu, Mar 01, 2012, 10:37 PM UTC

It's quite possible that the attacker has been using the support admin login details for much longer against Linode, without being noticed, until now.

What sort of defenses can developers put in place to protect against admin panels?

I've used these sorts of techniques in the past:

1) Separate username/password system compared to the regular website 2) IP whitelist of who may even access the admin panel 3) Failed login attempts send an e-mail alert with a log entry

Any other recommendations or suggestions?

Re: Compromised Linode, thousands of BitCoins stolen

#54

Post by aidenn0 » Thu, Mar 01, 2012, 10:38 PM UTC

ben0x539 wrote: post #41

> Although passwords are stored using SHA1 with a salt, Where's the bcrypt/scrypt/whatever police in this comments thread?

I already asked in the comments of the original article how many rounds of sha1 are used. SHA-1 still isn't the best, since it yields to FPGA attacks, but a single round can brute-force all 8 character passwords in less than 2 days on a GPU. My guess is that 10k rounds of sha-1 would probably not be feasible for non-dictionary attacks without specialized hardware.

Re: Compromised Linode, thousands of BitCoins stolen

#55

Post by regularfry » Thu, Mar 01, 2012, 10:39 PM UTC

tantalor wrote: post #23

If this was sensitive data why was it not encrypted? Replace "bitcoin wallet" with "medical history" or "credit card numbers".

It had to be decrypted to be used. It was in use. Ergo...

Re: Compromised Linode, thousands of BitCoins stolen

#56

Post by kiba » Thu, Mar 01, 2012, 10:40 PM UTC

gravitronic wrote: post #13

klodolph wrote: post #5

I'm not really sure why people are trying to store bitcoins on a VPS in the first place. You can't process credit cards on a VPS and be PCI compliant (it's against the rules), but any moron can do what they want with bitcoins.

But all that regulation is evil and it's the freedom of bitcoin that gives it the power* *for hackers to get away with the entertaining virtual train robberies we've seen in the last year

To be fair, websites were all continuously compromised last years, many of which have nothing to do with bitcoin.

Even so, bitcoin seems to attract every shark in a one thousand mile radius.

Re: Compromised Linode, thousands of BitCoins stolen

#57

Post by lhnn » Thu, Mar 01, 2012, 10:45 PM UTC

gravitronic wrote: post #13

klodolph wrote: post #5

I'm not really sure why people are trying to store bitcoins on a VPS in the first place. You can't process credit cards on a VPS and be PCI compliant (it's against the rules), but any moron can do what they want with bitcoins.

But all that regulation is evil and it's the freedom of bitcoin that gives it the power* *for hackers to get away with the entertaining virtual train robberies we've seen in the last year

It'd be worth it if more people used Bitcoins. No, we don't NEED regulation. We need competence and standards, which can come about without incompetent government intervention.

Re: Compromised Linode, thousands of BitCoins stolen

#58

Post by wmf » Thu, Mar 01, 2012, 10:45 PM UTC

Symmetry wrote: post #38

sgornick wrote: post #9

Earlier quoted context omitted.

You mean less interested in using it as a way to profit from speculation. As a currency it is not as critical that the value only goes up. A person or merchant receiving bitcoins can easily convert them out to USDs and still lose less in fees than the same transaction would cost compared to accepting a credit card or debit card payment. For example, BTC -> USD at most exchanges is around half a percent.

It sounds like Bitcoin is doing much better in the "Medium of Exchange" side of the money coin than the "Store of Value" side.

Which is not saying much, because if you try to avoid volatility by doing a USD->BTC->USD transaction you get hit with fees that are almost as much as credit cards, not to mention the complexity.

Re: Compromised Linode, thousands of BitCoins stolen

#59

Post by [deleted] » Thu, Mar 01, 2012, 10:47 PM UTC

ajross wrote: post #42

mrb wrote: post #34

Earlier quoted context omitted.

You were gullible and invested at the peak of the bubble at $30/BTC (now worth $5/BTC). Any bubble would have crushed you, eg the dotcom stock market frenzy. Your fault. Bitcoin is up 400% over the last year (from $1 to $5/BTC), which has made it an excellent investment for other (smarter) investors not swayed by a bubble.

Has anyone solved the liquidity mess? Say I want to buy a car and have to unload $20k of bitcoins. Can I do that? With a latency of less than 24 hours? Without getting my PayPal account frozen?

[deleted]

Re: Compromised Linode, thousands of BitCoins stolen

#60

Post by darklajid » Thu, Mar 01, 2012, 10:48 PM UTC

gravitronic wrote: post #13

klodolph wrote: post #5

I'm not really sure why people are trying to store bitcoins on a VPS in the first place. You can't process credit cards on a VPS and be PCI compliant (it's against the rules), but any moron can do what they want with bitcoins.

But all that regulation is evil and it's the freedom of bitcoin that gives it the power* *for hackers to get away with the entertaining virtual train robberies we've seen in the last year

Show me your wallet with a good amount of cash and leave the room for a while.

Afterwards, let's talk about your comparison. Is 'can be stolen' really something that the state can protect you against? Let's discuss it over dinner. Depending on the contents of the wallet I'd pay.

On a more serious note: Your mockery, while amusing, is unrelated to the problem at hand. 'Stealing amounts of $currency from private persons' is not a new idea or something that bitcoin is supposed to change?