More than $215,000 stolen from Bitcoinica in Linode incident

https://bitcointalk.org/index.php?topic=66979.0

by redegg • 14 years ago

102 55 14 years ago

Steko2• 14 years ago

No dollars were actually stolen. Dollars are a real currency, the kind you can put in real banks so this kind of thing never happens to you.

badclient• 14 years ago

Oh, traditional banks have never been hacked and dollars transferred? Somehow I'm not buying it.

seldo• 14 years ago

Traditional banks have insurance which protects them in case money is stolen:

http://www.fdic.gov/consumers/consumer/information/fdiciorn....

Individual cash deposits are also guaranteed by governments in most countries.

Bitcoins are not controlled by any government or central bank, but neither are they backed by one. And here we see the downside of that trade-off.

Tossrock2• 14 years ago

I think you're nitpicking. The goods stolen had a value corresponding to the amount listed. Is converting the amounts from a transaction carried out in euros to dollars objectionable? I would argue no.

kylebrown5• 14 years ago

Unless someone gets your bank login/pw, transfers it out, and the bank decides that you were responsible for protecting your login/pw.

http://www.wired.com/threatlevel/2011/06/bank-ach-theft/

27182818284• 14 years ago

I see what you're doing, you're being purposefully condescending. You aren't dumb enough to actually believe that something people trade for real dollars has absolutely no value. Whether you like it or not, people do use Bitcoins and a value can be assigned the same way a super model's legs can be insured for a value. Deal with it.

nhebb• 14 years ago

Yes, he's egging the crowd on, but his comment did make me wonder what the legal ramifications of someone stealing bitcoins are. If one of the account holders tried to take Linode to court, do you think a US court would even acknowledge the value of a digital currency?

Steko2• 14 years ago

"I see what you're doing, you're being purposefully condescending."

I'm pointing out the obvious. X bitcoins could be "worth" 5 cents or 500,000 in a matter of hours. Bitcoins were stolen not dollars therefore an accurate headline would say how many bitcoins were stolen and possibly the USD (or whatever) value parenthetically.

"You aren't dumb enough"

Stay classy.

"to actually believe that something people trade for real dollars has absolutely no value."

I never said it had no value. Baseball cards have value, no one pretends they are a currency and if anyone did people would rightly point out the many disadvantages like your baseball cards don't get the advantages of a real bank.

dmoy• 14 years ago

I am not well-versed in the technical details behind bitcoins, but does the nature of bitcoins make them vastly easier to track than normal currency? E.g. if the attackers try to cash out or transfer the stolen bitcoins, is it much easier to flag them?

joeyh3• 14 years ago

Where the money goes is all publically available, yes. But it can be split up and fed through any number of accounts (you can make as many accounts as you like) to try to launder it. Also, does Silk Road care where the bitcoin being used to buy drugs came from?

kiba2• 14 years ago

I believe Silk Road is operated by actual agorist, or market anarchists to be more general. If that is true, even they would care about where the money comes from, especially if it is stolen money.

maaku• 14 years ago

Not if you know what you're doing, no. Investigations of previous thefts have shown that you can't really hide bitcoins by shuffling them around. However there is a number of bitcoin addresses from services like exchanges that you can transfer bitcoins into and then out of to effectively launder money. An investigator would need the cooperation of the exchanges to track this money. The attacker will almost certainly move this money through a half dozen or more exchanges in equally many legal jurisdictions. Good luck following that trail.

joeyh3• 14 years ago

So they looked for connections to the IRC channel bitcoin uses to find linode IP's (or portscanned linode, but why bother when every bitcoin daemon hangs out advertising its IP on IRC?).

And they stole from at least 3 systems. One had $5; one $15 thousand, and one had nearly a quarter $million. Which makes me curious why they bothered with the $5 account at all. It's like robbing a bank, and stopping to smash a gumball machine in the lobby on your way in or out.

My guess is that the attackers have a fully automated exploit payload that transfers the bitcoin out. And ran it on every system they could get on, indiscrimitely. So this is not a one-off. I'd be very cautious about running the bitcoin daemon, at least without setting noirc=1 in its configuration.

kiba2• 14 years ago

My guess is that the attacker doesn't know how many bitcoin were stored on the target's.

joeyh3• 14 years ago

The alternative is that they knew Bitcoinia was hosted on Linode, and when this customer service exploit became available for purchase on the 0day market (or whatever), they went in explicitly targeting Bitcoinia, but not knowing which IPs on Linode belonged to it. It's not clear if Bitcoinia separated its web server VM from its bitcoin VM, and if the attackers didn't know, it'd be best to target all the IPs.

kylebrown5• 14 years ago

Bitcoin faucet had 5 BTC or $20, but it was a service operated by the lead developer of bitcoin, Gavin Andresen. I think the attacker was just showing control of all of linode (rather than individual services). Also a bit of flexing, as he did when crafting a transaction size of 1337 bytes[1] using the stolen coins.

http://blockchain.info/tx-index/2893660/d9804de366aa4c2a0156...

jakubw• 14 years ago

They bothered with the $5 account because by stealing a wallet, they'd not only acquire its balance but also any future incoming transfers to one of its addresses.

MCompeau• 14 years ago

I feel incidents like these raise an interesting question about the long term credibility of any crypto currency system. For instance if a traditional nation state felt its monetary system was threatened by a crypto currency could they employ an organization such as the NSA to attempt to undermine the credibility of the crypto currency in this way? I know its a very speculative proposition but it makes one wonder if even in a geographically agnostic realm like the internet the force of a nation state is required to maintain crediblity/stability for a new money system.

Jach• 14 years ago

Much larger thefts than this in $USD happen pretty frequently, you just don't hear about them that much. I don't know how the government could guarantee any credibility (Edit: beyond already existing measures, this was theft so if the thief is caught there is punishment available and if Linode was negligent they might also be liable)--the stability is inherent in the network. All the BTC thefts have been to improper security measures taken by the owner(s) and in some cases a misplaced trust in the security of others. Anyone or group with over 1000 BTC in one place should be taking way more security precautions than these guys.

rmc5• 14 years ago

could they employ an organization such as the NSA

The NSA is a US Governmental organisation. I don't they are available for private tenders.

However there are loads of private security companies.

DiabloD3• 14 years ago

I wish people would quit using Linode. They have a track record of having security issues, they are not PCI compliant; and unless they replace every single last BTC, I am going to just go ahead and state they never did care about their customers.

I just can only hope the attacker spends the BTC instead of burns them: burning would do far more damage to Bitcoin than just stealing them.

krasin• 14 years ago

>I wish people would quit using Linode.

Yet another man who wants to punish honesty? They could claim that the attacker used the proper user credentials to login on the server and nobody would be able to disprove that.

>They have a track record of having security issues

Please, provide a proof-link.

>they are not PCI compliant;

No credit card credentials have been stolen. It's that bitcoin service kept the keys insecurely. Bitcoin transactions should be signed on a machine w/o public access from the Internet (1) and have a threshold for transactions which have not yet been reviewed manually (2). Having these two practices implemented they would lose not more than that threshold (say, $1k-$5k).

>and unless they replace every single last BTC, I am going to just go ahead and state they never did care about their customers.

I have not heard about such a practice in the digital world. Nobody can make a 100%-secure system. But everyone can stay honest and improve security when a vulnerability has been found.

tylermenezes• 14 years ago

> they are not PCI compliant

They're a VPS host. I mean, cats aren't PCI compliant either, but it doesn't say much.

You shouldn't be using a VPS for this sort of thing for many reasons, mind you.

ceejayoz• 14 years ago

It is possible for a VPS host to become PCI compliant. Amazon EC2 is, for example.

neofutur• 14 years ago

I ll also boycott linode, calling this an incident and repeating "Ensuring the security of our platform is our top priority" and "Security is our number one priority and has been for over eight years." is clearly not enough.

teyc• 14 years ago

$215,000 is bigger than the size of an average bank robbery ($5,000) source: http://www2.fbi.gov/ucr/cius_02/html/web/specialreport/05-SR...

This reminds me of a tangentially related incident where government servers were physically stolen by people dressed up as technicians. Even if you co-lo a dedicated server, if you store enough coins there, it becomes an attractive target for an attacker with some inside help.

nextparadigms• 14 years ago

This is not an average Bitcoin "robbery" either.

matdwyer• 14 years ago

I'm not trying to troll here at all, but if "$215,000" worth of bitcoins are stolen, do the authorities investigate as they would $215,000 worth of cash?

Is there taskforces that recognizes this? or is it just the wild west?

rmc5• 14 years ago

Unlikely. It's worth $215k on some open markets. But that's highly variable, so it's not obvious that it's actually worth that amount of USD.

And yes, it is like the Wild West. That's part of the point of BitCoin, there are no chargebacks, and no-one can freeze your account. Once the money moves, the money moves. This has disadvantages if you are the victim of a theft (like this) and you're bitcoins are essentially gone.

JoachimSchipper• 14 years ago

Ah, Bitcoin. Security amateur hour. Again.

Seriously, trusting ~$200 000 to the security of a general-purpose VPS provider? With no failsafes of any kind? Ever notice how real banks don't do that? Even if you don't want to build your own data center, you could at least chat with http://www.thebunker.net/colocation/ or another properly-paranoid data center.

At least these guys didn't leave all their Bitcoins on this machine...

peteretep• 14 years ago

> Ever notice how real banks don't do that

https://news.ycombinator.com/item?id=3656063

noduerme• 14 years ago

+1. The real issues here are that the coins were all stored in a hot wallet, and that wallet was on a VPS. For some bizarre reason people have started to act like having a VPS is as good as running a dedicated box with a backup power supply and physical (cage) security. A VPS is just a big shared server dolled up with OS partitions. There's no reason to assume that a the provider doesn't have non-physical root access to all the accounts, or that a single compromised account can't escalate via god-knows what kinds of buffer overflows or other exploits into gaining control of the whole machine.

I run a Bitcoin site that keeps a very small percentage profit out of a relatively large amount of coins in and out, which have to be held in trust for customers. Not only is our bitcoin daemon not running on our webservers (it's got its own dedicated box with all unnecessary ports closed and a vicious denyhosts policy that's locked me out more than once), we also set up low limits to immediate withdrawals so that no more is stored in the hot/withdrawals wallet than could be withdrawn immediately by players currently online (usually no more than $250), with all larger withdrawals processed in batches on demand. That lets us offload the excess coins to another wallet as soon as they're deposited, so in the worst-case scenario we might lose a couple hundred bucks. The cold wallet is stored in a truecrypt archive on a thumb drive in my pocket, with an encrypted backup stored on a server in a third country, manually, with each batch transaction. Moreover, a lot of our funds are moved out into USD and held for safekeeping to avoid excess Bitcoin risk.

This is why banks keep their money in a safe, not in the little drawers in front of the teller. And no offense to Zhou, but this should have been the obvious step to take from the beginning. Hopefully they'll do it now.

woodall• 14 years ago

Aside from all the issues that plague bitcoin, what would be a more secure way of 'touching' the wallet.dat file?

Keep in mind that:

1) IO is expensive

2) the file will not be encrypted

3) the file will/should not be hosted on the same machine

4) the file will be accessed in excess of 1,000,000 times a day; maybe more.

The only thing I can think to do is do all the transactions with imaginary bitcoins until the end of the day then, at night, push all the transfers; almost like banks do.

maxerickson• 14 years ago

It seems like it would be feasible to split the coins across wallets, with more hassle surrounding the wallet with most of the coins.

I can't think of any huge disadvantage to manually managing the float on the transaction server.

sharth• 14 years ago

So I've a question about situations like this. I believe that a chain of transfers can be created with bitcoin. So couldn't a blacklist be created? That would allow users to ignore illegally obtained coins?

rmc5• 14 years ago

In theory yes, in practice no. There is nothing in the bitcoin design to allow this. The only real way to do it is to fork bitcoin and to get everyone to change to your new rolled-back block chain. Not everyone will agree (since co-ordinating all these people to change at about the same time is hard), and hence you'll have 2 different versions of bitcoin.

This also removes features of bitcoin that some view as advantages, namely that there are no chargebacks and no-one can forcibly remove your funds. In bitcoin, once you have it, no-one can take it from you (unlike, say, paypal). This has disadvantages if you're the victim of a theft. Bitcoin is also a decentralised system, so you'd have to convince everyone that you are the victim of a theft, and that these transactions are to be rolled back. Other wise someone could pay for a service in bitcoins, then try to get everyone to roll back the transaction, and hence deprive someone of the bitoins.

More than $215,000 stolen from Bitcoinica in Linode incident

Related Stories