Perhaps I'm being nieve but it seems like very bad coding when front end exploits can lead to cash being stolen. I would expect the bare minimum of a message bus or some other separation between back end payment components and the public facing boxes.
Bitcoin exchange hacked via Rails exploit, funds stolen
71–80 of 279 posts
Re: Bitcoin exchange hacked via Rails exploit, funds stolen
#72There seems to be a pattern emerging in all of these 'disruptive' business models, whether it be Bitcoin (banking), AirBnb (hotels), or Uber (cabs). We look around and see these industries burdened by regulation, which tends to create entrenched players and which seem to us to be inefficient. So we create similar peer-to-peer equivalents, only to start rediscovering the reasons for all those regulations in the first…
Except that regulating things is not the same as holding a monopoly on regulations. If government is so completely confident that its currency is much more superior and stable, well, allow the competition! Make it legal to receive whatever I want to receive as a payment. Let businesses regulate the currency market and determine what currency is reliable. Oh wait, except that then government cannot tax you, of course.…
This has everything to do with regulating bit coins and the exchanges. No bank in the US would ever dare run a stock rails site, I would bet they would be rightfully sued. On top of that, funds in a bank are insured to a point so if someone at a bank messes up, the innocent people who lost their money won't lose everything they own. The free market is cruel and so are it's proponents, we've advanced past this "fuck you I've got mine" mentality as a species. If bit coin was regulated like a bank, this wouldn't be a problem. Since anti-regulation people fail to grasp this point, let me add that I do not support every bit of regulation ever passed. There is good regulation and bad regulation. Only intellectually childish people view it as ALL good or ALL bad.
Re: Bitcoin exchange hacked via Rails exploit, funds stolen
#73Basically all the comments points to how amateurish that exchange was run compared to a real online banking website.
Now how many real banks do run their website using Rails? Ruby?
You guys certainly aren't as stupid as to believe this is the latest major 0-day Rails exploit to create havoc right?
And now comes the answers containing the logical fallacy: "All languages/frameworks have security issues". Which is rubbish in that it would imply that all the languages/frameworks do offer exactly the same level of security...
Re: Bitcoin exchange hacked via Rails exploit, funds stolen
#74I suspect that a lot of anti ruby / rails people are happy to have the occasion to prove that the language and framework that they didn't want to learn is ...bad... and are posting these news all around the web... with that small grin in their mind... fair enough... but rest assured, Ruby & Rails haven't even came close to the end of their ass-kicking :)
I'm building a new site from scratch soon, and was considering what language, and decided against RoR because of this. Perhaps not rationally, but it's been 5 years since I last did RoR, and I know there's a lot I don't know that's changed in that time. So better to stick with devils I know.
Re: Bitcoin exchange hacked via Rails exploit, funds stolen
#75There seems to be a pattern emerging in all of these 'disruptive' business models, whether it be Bitcoin (banking), AirBnb (hotels), or Uber (cabs). We look around and see these industries burdened by regulation, which tends to create entrenched players and which seem to us to be inefficient. So we create similar peer-to-peer equivalents, only to start rediscovering the reasons for all those regulations in the first…
That is an absolutely terrible lesson to draw from this episode.
First and most importantly, Airbnb and Uber are not disrupting industries burdened primarily by consumer safety regulations; they are disrupting industries burdened primarily by barriers to entrance that are designed to direct economic rents to politically favored actors. Huge difference.
There is no plausible 'consumer protection' story for preventing licensed livery cab drivers from picking up curb hails, whether on the iphone or otherwise. The law is there to protect the incomes of people who buy cab licences.
There is no plausible 'consumer protection' story that would explain why building codes for permanent residence are not good enough for temporary residence as well. The law is there to protect hotel operators from vacation rental competition.
So let's not compare Bitcoin with Uber and Airbnb, because they are completely different animals.
Bank security regulations, OTOH, ARE designed to protect consumers, although I'd argue that they're mostly unnecessary in practice. Legitimate banks don't get hacked because there are billions of dollars at stake for the banking institution, and their business literally depends on their ability to secure payments. The incentives are there with or without bank regulations.
Bitcoin sites, on the other hand, regularly get hacked because they are fly-by-night operations written by idiots who are probably also trying to steal from you. It's the fake-money equivalent of using www.send-monie-through-me.co.in and then being surprised when you get ripped off.
Bottom line: there is nothing wrong with regulation designed to protect consumers from actual threats. There is everything wrong with regulation designed to protect business from competition. The latter is what needs to be 'disrupted'.
Re: Bitcoin exchange hacked via Rails exploit, funds stolen
#76Well that's not really a surprise. Perhaps the "Rails generation" will gain some engineering, product selection and QA skills now. There's a big reason banks operate the way they do with the kit they do.
Even given I must admit that this was a spectacularly stupid hole[1], I don't think your point is valid. It's not like other frameworks in other languages don't have similar issues [2]. Rails is for what it does well engineered, well tested and using it for what it's intended is usually a solid choice. Rails enables and pushes testing on all levels, thus improving quality of all rails apps that follow the lead. You c…
Bullshit.
Rails pushes low time to market. That is all. Its built with precisely no engineering design or quality control on top of a poorly specified rickety language in a community of hype.
However, my original generalizes the problem as a human issue which is where the real problem is:
Did they do a risk analysis on rails - no
Did they verify their architecture - no
Did they perform input/type checking - no (sorry but statically typed languages win here)
Did they act responsibly - no
Would you trust them with your cash? Probably not then.
This is the opposite of banks who have multiple layers of security to prevent all the associated risks of the business.
Would a bank run their OLTP on rails? Hell no, because they did the risk analysis above, which is my point.
Re: Bitcoin exchange hacked via Rails exploit, funds stolen
#77I can't get to the article at the moment, but I'd love to know why they failed to update their app especially since it handles financial transactions. I had several apps to update and the process took very little time and effort.
I think an even better question is why they didn't have multiple layers of security that would have prevented a bug in a public facing server from compromising financial data. When systems are designed with security in mind, rather than simply throwing together a web/sql application, people put a lot of time and effort into constructing barriers to protect the integrity of their data. Take for instance the CACert cer…
This is really the proper way to do it.
Other people have suggested that this black box should store public/private key pairs generated from the user's password for each user on the exchange. So when a user signs up for an account on the exchange, Javascript code generates a private key from the user's password, client side. The corresponding public key is sent and stored in the offline transaction signing box. Whenever the user wants to initiate a withdrawal, the transaction signing box creates a random number that needs to the signed with the private key that corresponds to the public key it has on store. This way an attacker need to compromise a server and install an eaves dropping application that replaces new users' (or existing users changing their password) real public keys with its own. Just breaking into the server wouldn't do the attacker any good at first.
Re: Bitcoin exchange hacked via Rails exploit, funds stolen
#78I suspect that a lot of anti ruby / rails people are happy to have the occasion to prove that the language and framework that they didn't want to learn is ...bad... and are posting these news all around the web... with that small grin in their mind... fair enough... but rest assured, Ruby & Rails haven't even came close to the end of their ass-kicking :)
I'm building a new site from scratch soon, and was considering what language, and decided against RoR because of this. Perhaps not rationally, but it's been 5 years since I last did RoR, and I know there's a lot I don't know that's changed in that time. So better to stick with devils I know.
I wouldn't call this an informed decision...
Re: Bitcoin exchange hacked via Rails exploit, funds stolen
#79Basically all the comments points to how amateurish that exchange was run compared to a real online banking website. Now how many real banks do run their website using Rails? Ruby? You guys certainly aren't as stupid as to believe this is the latest major 0-day Rails exploit to create havoc right? And now comes the answers containing the logical fallacy: "All languages/frameworks have security issues" . Which is rubb…
Many banks like to use Java rather than something amateurish like Ruby. Here's a link for you, I'll let you draw your own conclusions:
http://blog.trendmicro.com/trendlabs-security-intelligence/j...
Cheers!
Re: Bitcoin exchange hacked via Rails exploit, funds stolen
#80Earlier quoted context omitted.
Except that regulating things is not the same as holding a monopoly on regulations. If government is so completely confident that its currency is much more superior and stable, well, allow the competition! Make it legal to receive whatever I want to receive as a payment. Let businesses regulate the currency market and determine what currency is reliable. Oh wait, except that then government cannot tax you, of course.…
This has everything to do with regulating bit coins and the exchanges. No bank in the US would ever dare run a stock rails site, I would bet they would be rightfully sued. On top of that, funds in a bank are insured to a point so if someone at a bank messes up, the innocent people who lost their money won't lose everything they own. The free market is cruel and so are it's proponents, we've advanced past this "fuck y…
My point is not that all regulation is bad. People decide if a regulation is bad or good. One may think a guns regulation is a good thing, the other may decide that a drugs regulation is a good thing. You can't reach objectivity in most cases. And then regulations have side effects: we always have to look not at just the intentions of those regulations, but also at the incentives they create (and that we cannot always foresee, example: minimum wage law).