MyBitcoin Incident Report - August 4th 2011

https://www.mybitcoin.com/

by jayzee • 15 years ago

67 28 15 years ago

wglb• 15 years ago

Who thought you would have to backup money?

wccrawford• 15 years ago

Even if it was backed, up, the attacker would simply have transferred the BTC to a different wallet so they couldn't be recovered.

I mean, if you could, then you could duplicate BTC. lol That would be some flaw.

daeken• 15 years ago

While sad, this doesn't surprise me in the least. I reported probably half a dozen vulnerabilities, none of which I believe were ever fixed. I tried to stress the impact of the vulnerabilities (which ranged from CSRF to XSS to, I believe, SQLi, although I can't recall whether that was MyBitcoin or elsewhere) and it just didn't sink in.

If you're going to deal with money in any way, please for the love of god, think about security. Even if you're not going to have an external security test, at least internalize the OWASP Top 10, how to recognize and discover them, and their mitigations.

cookiecaper• 15 years ago

I also found mybtc unresponsive to mail -- I made a Python interface, whose source I had planned on releasing, to their SCI and needed help with one portion of it, sent a mail asking about it, and received no reply. Disappointing. :(

kiba• 15 years ago

Mybitcoin doesn't understand the value of communicating early when a crisis is ongoing.

doublextremevil• 15 years ago

When will people learn that trusting a (possibly unreliable) third party with your money was exactly the sort of thing that bitcoin was supposed to obviate?

rick888• 15 years ago

well, naturally, we are seeing why banks exist. Because people need a safe place to put their money.

drivebyacct23• 15 years ago

But banks offer better protection for my money than can be afforded in a home settings. Quite the opposite with BitCoins. My TrueCrypt volume with keyfiles that I keep on my person and in a safebox with my BitCoins inside is far superior to... well... ANY internet-connected service.

Steko• 15 years ago

Possible shorter version of events:

People left their money with some guy on the internet.

He promised them he wouldn't steal it.

But then he stole it.

dfc4• 15 years ago

Is trusting a third party with your BTC any different than trusting an online storage company with your data?

stuhood• 15 years ago

Yes, it is: assuming you use client side encryption, an online storage company never needs to know your secrets. It's the difference between a trusted and untrusted third party.

fragsworth• 15 years ago

You have to trust someone (even if for a very short period of time) in order to make a transaction between bitcoins and legal tender.

drivebyacct23• 15 years ago

But there's no reason to leave a quarter of a million dollars in BitCoins in an untrusted 3rd party's hands. Unless you're lazy or naive. It takes almost no effort to transfer them to your own wallet which can be trivially encrypted or stored on a device unconnected to the Internet.

monkeypizza• 15 years ago

but there's no reason to do it all at once. if you are trading 1 btc for money there should be an automated way to do the transfer in increasing steps, after each of which the other party would reply - so transfer 0.0001, 0.001, 0.01 etc. til you are done. You wouldn't lose much, and you could vary the rate depending on how much you trusted the other party.

gamble• 15 years ago

Most Bitcoin enthusiasts are speculators. These exchanges and online wallets are popular because they allow speculators to respond instantly to opportunities.

dreamdu5t• 15 years ago

Looks like the online wallet niche just got a little more breathing room...

jhuckestein• 15 years ago

How would one prove that they didn't just make the bitcoins disappear themselves, only to sell them anonymously a while later?

dfc4• 15 years ago

It would be hard. Even if the disclose the wallet address that was compromised it would be hard to prove that the transfers were not done by the alleged hackers.

I wonder if this is the reason for the drop in btc price lately.

kaerast• 15 years ago

I believe this incident probably is the reason for the drop in price, along with the incident at Bitomat just before. It's just people reacting to vulnerabilities in the market though, so far there has been no evidence to suggest any of these bitcoins have been sold. If they were to be sold off in bulk then it would cause a much larger crash.

alanfalcon• 15 years ago

The best line from the release:

"We are sure that, unknowingly to us, that our processing system has been used for nefarious purposes."

How can you be sure of something that is unknown to you? They're trying to disclaim responsibility while acknowledging the reality of what BTC is used for in some situations, I suppose, but it's a very strange way to phrase it. Then again, they're in "receivership" but declining to appoint an actual receiver.

there• 15 years ago

[T]here are known knowns; there are things we know we know. We also know there are known unknowns; that is to say we know there are some things we do not know. But there are also unknown unknowns – the ones we don't know we don't know.

MyBitcoin Incident Report - August 4th 2011

Related Stories