Bitcoinica MtGox account compromised

https://bitcointalk.org/index.php?topic=93074

by muyuu • 14 years ago

102 103 14 years ago

bitcointalk.org

muyuu6• 14 years ago

MtGox transfer limit maxed out: 40,000 BTC + 40,000 US$.

At current BTC valuation ($7.66) that's 346,400 US$.

By the way, the full Bitcoinica trading platform source code is posted there: http://depositfiles.com/files/2p6zvadzs

ashconnor• 14 years ago

Doesn't seem to work out of the box.

muyuu6• 14 years ago

I haven't had the time to try it myself (still in the office). All I know is it's RoR.

Smrchy• 14 years ago

This might explain the unusual rise of BTC vs. USD.

The thief might have just traded those dollars to bitcoins which makes them harder to trace.

muyuu6• 14 years ago

This only happened today and the rally has been on for more than a week.

ceejayoz• 14 years ago

From the article:

> The original hacker could have compromised the funds on May 11th or any day thereafter.

bnr2• 14 years ago

Another possible explanation for the increasing rate is that someone is offering 7% interest on BTC: https://bitcointalk.org/index.php?topic=50822.0

If that offer is really enough to make the price rise, this might be exactly what this guy is speculating on.

nullc• 14 years ago

You mean 3372% interest— The 7% number is _per-week_.

coinabul3• 14 years ago

The rise is unrelated.

codesuela• 14 years ago

I would've thought that no one would keep using Bitconica after their first major breach but here I am, shocked by the fact that people still kept trusting them with their Bitcoins

xSwag2• 14 years ago

I've lost count of how many times they have been breached. Why don't they get independent pen testers and get them to test their system? Surely paying a pen tester $5k is much better than the amount of negative publicity you get when you lose $350K

mmcnickle3• 14 years ago

Three times apparently (from the forum):

  Feb ~ 200k USD
  May ~ 91k USD
  Today ~ 300k USD

georgemcbay• 14 years ago

"Surely paying a pen tester $5k is much better than the amount of negative publicity you get when you lose $350K"

Depends upon who you're "losing" the $350k to.

rmc4• 14 years ago

Surely paying a pen tester $5k

Can you get a pen tester for $5k? I'd have thought they could command higher rates

waterlesscloud• 14 years ago

Yeah, I just don't get how this is possible. The first time, sure, people just get caught off guard. But after that?

Send your bitcoins to me, people. I'll never give them back, but at least you'll know where they are.

kiba3• 14 years ago

Nobody is using bitcoinica. Everyone is seeking refunds.

Edit: Bitcoinica is still in the process of refunding everyone from the last breach when this happens.

muyuu6• 14 years ago

That's worth pointing out.

The site has been offline for months, lots of people are simply caught waiting for a refund.

So basically there's nothing they can do now, if Bitcoinica's operation gets hacked again (their MtGox account this time).

0x02• 14 years ago

I can't believe people entrust virtual money to sites like these which in general - but consistently - seem to be run by amateurs.

sneak4• 14 years ago

People still regularly fall for 419 scams, or the emails would stop.

I got one the other day for a "scam victim restitution fund", asking for personal details. The mind reels.

astrodust• 14 years ago

Like smokers they often believe "it won't happen to them".

wmf2• 14 years ago

AFAIK Bitcoinica was the only site offering BTC derivatives, so presumably some people figured the potential profit was worth the risk. More generally, all Bitcoin exchanges seem to be run by amateurs, so people have to deal with them to cash out.

0x02• 14 years ago

I wonder why. There seems to be a huge gap in the market for a professionally run enterprise here. Or at least, anything more focused beyond students half-assing it part-time.

jonhendry2• 14 years ago

Derivatives as in options/futures/swaps/even more exotic?

That is quite possibly the scariest financial product ever devised, assuming there was nobody putting together complex products based on Zimbabwean currency during their period of massive inflation.

makomk3• 14 years ago

Right now, as we speak, Bitcoin users are entrusting their money to an investment scheme that has all the hallmarks of a Ponzi[1]. We're talking 9% monthly interest if you invest enough bitcoins, utterly implausible explanations as to what the money's being invested in, a seemingly limitless capacity to swallow up new funds, and probably a whole bunch of other things I've forgotten. As far as anyone can tell, there's at least 32 thousand Bitcoins (about $240k at current exchange rates) invested in this scheme[2], possibly much more.

[1] https://bitcointalk.org/index.php?topic=91655.0 [2] https://bitcointalk.org/index.php?topic=91653.0

xSwag2• 14 years ago

Hate to say this but if this sort of sloppiness continues, the bitcoin brand will be trampled so badly it will never get off the ground.

efdee• 14 years ago

Too late, I'm afraid. Who, today, uses Bitcoin, except for criminals and speculants?

javert2• 14 years ago

That's a fallacious argument. The reason it's mainly used by criminals and speculators is because it's brand new, as far as currencies go. If Bitcoin had been used by lots of people already who then abandoned it, you might be able to make the argument you're trying to make.

And one thing I've noticed it increasingly being used for is basic (small-scale) financial services - for example, loans.

javert2• 14 years ago

I doubt people are stupid enough to conflate Bitcoin with 3rd party websites that use bitcoins. Maybe a few will, but the success or failure of Bitcoin does not ride on a what a few dumb people do.

And Bitcoin does not have a "brand." You could say, and probably meant, "reputation."

michaelt• 14 years ago

> I doubt people are stupid enough to conflate Bitcoin with 3rd party websites that use bitcoins.

Well, some of the most touted features of Bitcoin are that it's anonymous, untracable, and unfettered burdensome mandates like FDIC insurance and PCI-DSS compliance.

In this case, those features mean in all likelihood the thieves won't be traced or punished, the depositors' money won't be returned, and there was no independent auditing to catch crap security practices.

High profile thefts might make people think they don't need the features that Bitcoin is offering.

jsh4ft• 14 years ago

I feel badly for the people that lost money, and hope that some legal action is taken against the organization.

nthitz• 14 years ago

Fool me once, shame on you. Fool me twice, shame on me.

coinabul3• 14 years ago

How about four times? :)

jbigelow76• 14 years ago

I've got a bridge to sell you.

at-fates-hands• 14 years ago

This seems like it has turned into a game for the hackers now. Bitcoinica get breached, re-load their defenses and then its just a matter of time before the hackers get in again.

I don't think anything nefarious is going on, but it would appear there is little or no consequences for breaches which makes it a low risk, high reward opportunity.

If I were them, I'd kill the business, completely start over with a new company name, new site, new everything. As long as they're in business, they are going to remain a target.

kristiandupont• 14 years ago

How would a new company name help anything? If they want customers to be able to find them again, surely so will the hackers?

biff2• 14 years ago

This is starting to prove -- the hard way -- why regulations, certifications, and all that other stuff that feels like meaningless overhead the majority of the time has become a grudgingly accepted part of our lives.

It comes back to the most difficult problem: you inevitably need to trust someone, so how do you minimize your risk in that trust? I always thought the Bitcoin trust issues would revolve around the inability to trust that a service would be delivered once the provider is paid -- something that could theoretically be worked out with their reputation over the long run in a free market.

But it's unsettling to see that breaches like this don't evidently leave the impression with the Bitcoin community that a believer in the free market might hope they would, that providers in this market might not be driven to produce quality and reliability because somehow there isn't the demand for it.

sneak4• 14 years ago

As the big banks in the USA have proven, government regulation is definitively not the answer to the question "How can you know whom to trust?"

Seriously. Knock that shit off. It's a red herring.

You can't abstract away the personal process of choosing trust anchors and metrics, no matter how hard you try.

Changing your trust anchor to "the government" just means you end up getting fucked on a larger scale, over a larger timeline.

_delirium• 14 years ago

I think it's considerably more complex than that, and not at all a red herring. I agree it's a coordination/network problem either way, but you would need actual evidence to argue that some methods of coordination are better than others.

I've read a reasonable amount about currency history, and the U.S. government's stewardship of currency in particular is not bad imo. Its stewardship of the banking system leaves more to be desired. I'm not sure its stewardship of the banking system is worse than what we had in the "free banking" era, though. You don't really have to be against markets to have an ordoliberal-style view (vaguely following Hayek) that markets work best within certain frameworks, as opposed to having a view that anarcho-capitalism will always produce the best solutions (more following Rothbard).

raganwald• 14 years ago

As the big banks in the USA have proven, government regulation is definitively not the answer to the question "How can you know whom to trust?”

A common sentiment: “Big Government doesn’t work.” No, it doesn’t work. But in many cases, it’s less broken then no government a/k/a The Free Market. I’m reminded of Winston Churchill’s quip: "It has been said that democracy is the worst form of government except all the others that have been tried.”

It could be that trusting democratic governments to manage a monetary system is fundamentally unsound. I’m listening: What alternative do you propose, and how is it going to scale beyond protecting the few wealthy info-elite that can protect themselves?

JackC• 14 years ago

Saying that government regulation for financial markets is a red herring is like saying that SSL for ecommerce is a red herring. Sure, it's imperfect. It's not a complete solution. It gets circumvented sometimes. It creates a false sense of security sometimes. The people who run it do embarrassingly dumb things sometimes. But there's still a big difference between marketplaces with that protection and marketplaces without it.

Mvandenbergh• 14 years ago

Is it not? How much money have you lost in deposit accounts with US banks?

sneak4• 14 years ago

> that providers in this market might not be driven to produce quality and reliability because somehow there isn't the demand for it

Also, the market is young and small and very inefficient as yet. The tools for allowing market participants to reasonably evaluate trustworthiness of service providers don't really exist yet.

You can't really blame that on "lack of demand for quality and reliability". Give it five years and try your analysis again.

rmc4• 14 years ago

The market might be young, but IT security is not. Unix has had salts on passwords for decades.

kiba3• 14 years ago

This time, It's simply bitcoinica users are caught waiting for a refund after the second breach. They ARE NOT using bitcoinica, at all. The site have been offline for months.

rwallace• 14 years ago

Banking, as regards regulation, is a special case.

If a taxi company or a pizza company goes belly up, people shake their heads sadly and move to a competitor. The free market is the best arbitrator.

If a chain of banks goes belly up and people's life savings are gone, you get rioting in the streets. That's the kind of situation that let Hitler into power. For the sake of preserving civilization, governments act as the de facto underwriters of bank deposits. This free insurance is an effective subsidy, and people don't give you free money without demanding control to go with it, so it's inevitable that governments end up having a say in how the banking business is carried out.

People put their fucking life savings into Bitcoinica. If that starts happening on a large scale - if Bitcoin becomes a major currency, and people have the opportunity to put their life savings into bitcoin banks - then bitcoin banks will start being regulated, just as fiat currency banks are. As a libertarian, I'm not entirely happy about this, but we have to deal with the world as it is, not as it should be.

b-man2• 14 years ago

I disagree strongly.

The reason that bank runs and failures are so destructive is because of the state build cartel, driven by central banking. That was built in order to prevent competition and to let fractional reserve(which is in essence fraud) to run wild.

The only reliable way to ensure stability in banking is to separate it from the state and let the free market do what it does in every industry known to man, weed out stupidity and fraud.

jerf• 14 years ago

"But it's unsettling to see that breaches like this don't evidently leave the impression with the Bitcoin community that a believer in the free market might hope they would, that providers in this market might not be driven to produce quality and reliability because somehow there isn't the demand for it."

It is not as if the regulated world is all sweetness and light with no problems. The LIBOR scandal involved lots of violations of law, ethics, and regulation, for instance, and as the rot is found to go deeper that only further proves regulation can't cure all ills. Compare only the benefits of any thing with only the negatives of another and you get a predetermined result.

BitCoin is only about a billionith as old as the regulated money system. Growing pains should be somewhat expected. (And I say this as someone who does not generally believe in it.)

columbo• 14 years ago

I know nothing about bitcoin, can someone provide a tldr about why it is (seemingly) so difficult to build a secure site around exchanging these things?

I don't get how you can simply "Loose" a few hundred grand without a horse head winding up at the food of your bed.

morsch• 14 years ago

It's difficult to write secure code.

It's difficult to administrate a secure system.

It's a new market where release early, release often is important.

BTC transaction are largely untraceable and irreversible.

sgornick2• 14 years ago

That's probably the shortest yet most comprehensive response to "explain this". Nice!

epscylonb• 14 years ago

If you run a service where you need to pay bitcoins out to users then that means your systems have to respond to user input and send money to them.

It turns out this is pretty tricky to secure.

The current popular strategy is to have hot and cold wallets. A hot wallet is online and can make payouts automatically.

A cold wallet is kept offline (airgap) and brought online by a human being to refill the hot wallet when it is running low. This only really makes sense if your service needs to secure large amounts of bitcoin for a long time without using them.

This recent bitcoinica hack is pretty inexplicable, they were keeping a large amount of coin in an account at an exchange called MtGox. This is effectively a hot wallet.

rmc4• 14 years ago

Lots of the bitcoin hacks have been security amateur stuff. E.g. MtGox was just storing MD5 hashed passwords. Unix added salts to passwords decades ago. The people making this sites don't know about security.

rpledge• 14 years ago

Ouch.... http://qrauth.com - Login using QR codes

Password is stored on your iOS device and securely transported to the site you're login into when you scan a QR code. No more excused for duplicate/easy to remember passwords!

untog• 14 years ago

You should probably put in a disclaimer that you created QRAuth, it looks somewhat spammy.

carlio• 14 years ago

I assume 'GP' means 'Guilty Party'? If so, it's kind of telling that a community has to use 'guilty party' enough to start abbreviating it...

ninjarobot• 14 years ago

GP means 'General Partner' - Bitcoinica LP is Limited Partnership with a General Partner and a Limited Partner.

ajross3• 14 years ago

> Unbeknownst to us, Tihan was using the mtgox api key as the password for a website called LastPass.

Unbelievable. They decide to use a password escrow service... and use a duplicate password to secure it. This is 100% cargo cult security. Clearly whoever did this had no idea what the value of LastPass was, just that it was what all the cool security kids were doing. The choice of the high-value BtGox key was (staggeringly) unfortunate, but any dupulicate would be equally ignorant.

Just unbelievable.

kiba3• 14 years ago

I have no idea why their BTC are siting in a MtGox account, online. Any and all bitcoin that are not being used for transactions with customers should be squirreled away into a cold wallet immediately.

If they did that, they will only have 40 K USD gone instead of also 40 K BTC gone.

mode80• 14 years ago

Since my name has appeared in connection with this calamity, I'm linking here to my response:

https://bitcointalk.org/index.php?action=profile;u=58008;sa=...

Bitcoinica is far the most toxic investment of my career. I still applaude founder Zhou Tong's bravery for creating it and wish dearly that the change in management had never taken place.

Bitcoin technology holds great potential but I fear there are still many hard lessons ahead.

pwman• 14 years ago

It's even beyond using a duplicate password which as you point out is ignorant. They were so unclear on the concept that they used a password that was written down into their source code, and once that source code was stolen they didn't change that password!

They also failed to utilize the two different free multi-factor options LastPass offers (not to mention the premium ones).

LastPass tries to educate people and push them on not utilizing the same password anywhere with a security challenge, but that clearly didn't teach the concept here.

Their last breach involved losing access to their email: info@bitcoinica.com -- so what email did they use here with LastPass? info@bitcoinica.com They didn't utilize the security email either.

It is all unbelievable.

How do we drag this out of cargo cult security?

I see some are pushing certifications; If I made a free LastPass certification that both proves you understand the concepts, and that you're currently putting them into practice by showing that you/your company has multi-factor enabled would people demanded it?

tlrobinson• 14 years ago

Step 1: Throw together a Bitcoin "exchange"

Step 2: Announce you were "compromised"

Step 3: Profit!

Karunamon• 14 years ago

Step 2.5: Pay tons of restitution or get sued into next millenium

genwin• 14 years ago

Perhaps this is the work of an insider.

mmcnickle3• 14 years ago

The app and its infrastructure was created by a single, very inexperienced programmer. The app's original author, Zhou Tong, is only 17[1].

Not that age is an indicator of experience in general, but it's certainly the case here. I'm honestly shocked at the amount of trust placed in Bitcoinica.

An interesting display of the oft mentioned Stockholm Syndrome happening elsewhere on the forum here https://bitcointalk.org/index.php?topic=93100.0

[1] http://coinabul.tumblr.com/post/24022841613/10qs-zhou-tong-b...

Edit: added reference.

coinabul3• 14 years ago

Hey, that post happened after the first hack. Also, I feel this hack is not Zhou's fault.

Edit: Oh, misread that. You were just citing source. Gotcha.

zhoutong2• 14 years ago

Well I do agree with you that Bitcoinica was not 100% secure. This hack really has nothing to do with the app or its infrastructure.

- I didn't set the password. - I didn't have the power to change the password. - I shouldn't have access to the account.

The root cause is LastPass account being stolen.

mmcnickle3• 14 years ago

Agreed that you are not personally responsible for this particular attack, though I see it as the latest in a series of cascading failures, beginning with the initial attack. It's the lack of consideration of security - that can only be baked in from the outset - that's the real root cause.

If the application had been self-hosted in a physically secured location, the attack that exposed the LastPass credentials would not have happened (email reset of root passwords). It may not be cool, but the cloud/consumer-level hosting is not appropriate for applications handling large sums of money.

rorrr• 14 years ago

What makes you think he wasn't in on this breach? It's far more profitable than running a bitcoin exchange.

feydr• 14 years ago

http://www.youtube.com/watch?v=u6mYGcNgKn8

aquayellow2• 14 years ago

Putting aside the way the Bitcoinica account got compromised, I wanted to mention that I learned the hard way that either Mt.Gox is rife with security holes or a lot of these breaches are actually insider jobs from someone working at MtGox : A month back I realized that I had around 40 BTC lying around and decided to sell them on MtGox. First, my Mt.Gox is mostly inactive, so I actually had to reset my password and setup a new one that I had never used before. Then, after I sold my coins, I realized I cannot transfer my money to my Dwolla account; MtGox needs a scanned copy of my SSN! While I was deliberating whether I should trust MtGox with my SSN, 24 hours had passed, and I got an automated email from MtGox saying my money had been converted to bitcoins and has been transferred! Everything gone! So, the fact that : 1. My account was mostly inactive. 2. I had recently changed my account password to a new more complex one : 2 upper caps, 5 lower case, 2 numbers and one special character. 3. My money was sitting in my account for only 24 hours. 4. The time between my money getting converted to bitcoins and the actual transfer was just a few seconds, as if an automated script scans all accounts and the performs some tasks on them. So, in short, please don't put all the blame on Bitcoinica. Something's wrong at MtGox too :)

conroe64• 14 years ago

I've recently had upwards of $10K on mtgox and had no problems. Could it be that you have some malware with a keylogger on your computer?

aquayellow2• 14 years ago

Not that there aren't any keyloggers for Linux, I never found anything suspicious, nor have any of my other accounts been breached into. But yeah, if there is a keylogger, I bet it got installed from the Mt.Gox website itself ;)

encoderer• 14 years ago

Is it really that hard to imagine that this is an inside job? Come on... 4 or 5 big money-losing breaches? To the tune of what? A million dollars? And nobody is talking about cooperation between insiders and this "hacker" ?

rmc4• 14 years ago

OTOH when we keep hearing about the hacks, it's always something stupid. They are making amateur mistakes, so it's no suprise that they keep getting hacked.

lmm• 14 years ago

Hanlon's razor. If anything, attacking via their hosting company shows bitconica are more secure than the vast majority of internet companies. The attacks took more effort than those on HBgary (a dedicated security firm), LinkedIn, Lastfm (who I know have more clue than most internet companies), ....

Even in 2012, internet security is still a joke. There's no need to invoke conspiracies.

muyuu6• 14 years ago

This looks like the actual BTC transaction: http://blockchain.info/tx-index/11999735

jasonlingx• 14 years ago

It is worth noting that (some of) the people behind Intersango acquired and took over operations of Bitcoinica just before the recent hack that took Bitcoinica offline since May 2012 (see https://bitcointalk.org/index.php?topic=81581.0)

Intersango is currently the second largest bitcoin exchange after MtGox, and the largest bitcoin exchange for GBP (see http://bitcoincharts.com/markets/)

From their site(https://intersango.com/):

"Having never suffered a break in or major technical error, we are confident in our abilities to lead bitcoin into its rightful place in the real world."

Some blame for the May hack could be arguably attributed to Zhou Tong, however, having taken over for 3 months since...

sgornick2• 14 years ago

Mt. Gox offers two-factor authentication methods (Yubikey and Google Authenticator). Neither was used. Lastpass offers two-factor authentication methods (Yubikey and Google Authenticator). Neither was used.

But also, nobody who also works with Intersango had access to either of those two accounts. [Update: I may have been mislead on that as there is now conflicting information: http://bitcointalk.org/index.php?topic=93074.msg1028157#msg1... ]

drivebyacct22• 14 years ago

Reusing passwords. Check.

Using passwords after they've been known to be compromised. Check.

Storing passwords protecting north of a million dollars in an online password storage system and not even using the provided two-factor auth. Priceless.

This is just like the Mtgox guys claiming the bcrypt was not good after getting caught using unsalted MD5.

This is amateur bullshit and the lack of actual penalties makes me think I should have finished the exchange I started writing. You know, one where I would have the common sense to store financial values as decimals and not floats.

These are such naively simple mistakes, it just is hard to fathom.

The first reply's conclusion is spot on

You failed to disable Mt.Gox API,

You failed to protect mt. Gox with a Yubikey,

You failed to change Lastpass password,

You failed to protect Lastpass with one of their many 2nd factor auth. (some free)

This is embarrassing to watch.

ajross3• 14 years ago

Surely you mean integer, not "decimal", right? I'm not an expert, but to my understanding none of the values in the bitcoin protocol are expressed as base-10 fractions.

It's a nit, obviously, but if you're going to ding someone for naive mistakes...

clarkmoody2• 14 years ago

Fixed-point DECIMAL representation in the database is just as good as storing Bitcoin values as integers. Baked into the field definition is the amount of precision. And Python and other languages have features to work with fixed-point numbers. This approach relieves the mental overhead and complexity of converting to integers (which might overflow a 32-bit int) and back all the time.

noarchy• 14 years ago

I know there is a temptation to blame bitcoin itself here, but wow... this is just some amateurish security on the part of these bitcoin sites. If the big banks were doing this, it would be cataclysmic disaster. Instead, the big banks have found other ways to drive themselves (and your money) into the ditch, and it dwarfs anything that bitcoin sites can manage to lose.

Bitcoinica MtGox account compromised

Related Stories