Pages:
Author

Topic: Bitcoinica lost 43,554 BTC from Linode compromise, suspicious TXIDs publicized - page 8. (Read 56416 times)

legendary
Activity: 1260
Merit: 1000
Drunk Posts
http://status.linode.com/2012/03/manager-security-incident.html



Quote
Manager Security Incident

Ensuring the security of our platform is our top priority. We maintain a strong security policy and aim to communicate openly should it ever be compromised. Thus, we are posting to describe a recent incident affecting the Linode Manager.

Here are the facts:

This morning, an intruder accessed a web-based Linode customer service portal. Suspicious events prompted an immediate investigation and the compromised credentials used by this intruder were then restricted.  All activity via the web portal is logged, and an exhaustive audit has provided the following:

All activity by the intruder was limited to a total of eight customers, all of which had references to "bitcoin".  The intruder proceeded to compromise those Linode Manager accounts, with the apparent goal of finding and transferring any bitcoins.  Those customers affected have been notified.  If you have not received a notification then your account is unaffected.  Again, only eight accounts were affected.

The portal does not have access to credit card information or Linode Manager user passwords.  Only those eight accounts were viewed or manipulated -- no other accounts were viewed or accessed.

Security is our number one priority and has been for over eight years. We depend on and value the trust our customers have placed in us. Now, more than ever, we remain committed to ensuring the safety and security of our customers' accounts, and will be reviewing our policies and procedures to prevent this from ever recurring.

ok, 8 accts:  Zhou, Gavin, Slush.  who are the other 5?

I would hope zhou dosen't keep 40k btc on one server  Shocked, I assume more than 1 was bitcoinica
full member
Activity: 132
Merit: 100
Bravo to you and slush. I am sure it will come back to you in trust but what a mongrel act that's been committed.
legendary
Activity: 1304
Merit: 1015
ok, 8 accts:  Zhou, Gavin, Slush.  who are the other 5?

Seems likely an attacker would have or has had a linode account as well...
hero member
Activity: 504
Merit: 502
I cant help but know some Linode employee wont be at work tomorrow.

This all is way way way to convenient, seems like an inside job planned overtime with the knowledge of who runs worthwhile bitcoin services and on which VPS accounts.

This is alot of money, please for all of us make its your top priority to get compensation out of Linode otherwise any future losses less than this would be seen acceptable by these crappy hosting companies or other services.
legendary
Activity: 1764
Merit: 1002
http://status.linode.com/2012/03/manager-security-incident.html



Quote
Manager Security Incident

Ensuring the security of our platform is our top priority. We maintain a strong security policy and aim to communicate openly should it ever be compromised. Thus, we are posting to describe a recent incident affecting the Linode Manager.

Here are the facts:

This morning, an intruder accessed a web-based Linode customer service portal. Suspicious events prompted an immediate investigation and the compromised credentials used by this intruder were then restricted.  All activity via the web portal is logged, and an exhaustive audit has provided the following:

All activity by the intruder was limited to a total of eight customers, all of which had references to "bitcoin".  The intruder proceeded to compromise those Linode Manager accounts, with the apparent goal of finding and transferring any bitcoins.  Those customers affected have been notified.  If you have not received a notification then your account is unaffected.  Again, only eight accounts were affected.

The portal does not have access to credit card information or Linode Manager user passwords.  Only those eight accounts were viewed or manipulated -- no other accounts were viewed or accessed.

Security is our number one priority and has been for over eight years. We depend on and value the trust our customers have placed in us. Now, more than ever, we remain committed to ensuring the safety and security of our customers' accounts, and will be reviewing our policies and procedures to prevent this from ever recurring.

ok, 8 accts:  Zhou, Gavin, Slush.  who are the other 5?
vip
Activity: 490
Merit: 502
How can you reimburse that much? Have you really made that much profit?

Yes, our historical profit is fairly sufficient to cover the loss from this incident, and we believe that it's the best interest for the community to keep running the business. We will take appropriate strategies and implement more security features to prevent this from happening ever again, even with the presence of dishonest partners or employees.
legendary
Activity: 1304
Merit: 1015
hero member
Activity: 609
Merit: 500
*whew* my coins are still safe on his server.  Cheesy
legendary
Activity: 1330
Merit: 1000
Bitcoin
legendary
Activity: 1764
Merit: 1002
there goes Zhou's tuition.
legendary
Activity: 1764
Merit: 1002
unbelievable.  and you're going to be able to reimburse all your customers?
administrator
Activity: 5222
Merit: 13032
How can you reimburse that much? Have you really made that much profit?
vip
Activity: 490
Merit: 502
We didn't have the opportunity to scan our whole system for suspicious transactions that were not initiated from our customers because we had to shut down the system immediately after we've discovered the huge loss. We did get a rough estimate and we published a press release to warn our users about the deposit address replacement.

However, now we have concluded that we lost 43,554 BTC from this incident and we will reimburse our customers for the full amount. For transparency, we would like to disclose all the suspicious transaction ids in this incident:

{
        "account" : "",
        "address" : "1F3czt4VGUGdmrXW4qbh8hbQZ1hcHpwFGT",
        "category" : "send",
        "amount" : -1999.00000000,
        "fee" : -0.01750000,
        "confirmations" : 99,
        "txid" : "5a09f4ef0e91bc7bc044365cd27236fe4ac3c02088ac21ab51c93c8a11d33d4b",
        "time" : 1330584607
    },
    {
        "account" : "",
        "address" : "1DMuVKe9PKpx3dbs2b2MnXuVmLfA4drHif",
        "category" : "send",
        "amount" : -20555.00000000,
        "fee" : 0.00000000,
        "confirmations" : 99,
        "txid" : "7b45c1742ca9f544cccd92d319ef8a5e19b7dcb8742990724c6a9c2f569ae732",
        "time" : 1330584607
    },
    {
        "account" : "",
        "address" : "13CmJpbAueuWiPKw3UYU4vXEcZ4WzP6nxt",
        "category" : "send",
        "amount" : -3000.00000000,
        "fee" : 0.00000000,
        "confirmations" : 99,
        "txid" : "901dbcef30a541b8b55fae8f7ad9917ef0754bda5b643705f3773e590785c4d3",
        "time" : 1330584607
    },
    {
        "account" : "",
        "address" : "1978kFf3WKYiZsy89WX6qJ8vxWAbRWFGLq",
        "category" : "send",
        "amount" : -0.01002773,
        "fee" : 0.00000000,
        "confirmations" : 99,
        "txid" : "901dbcef30a541b8b55fae8f7ad9917ef0754bda5b643705f3773e590785c4d3",
        "time" : 1330584607
    },
    {
        "account" : "",
        "address" : "1JL7vc2Ecn8QeeBYdpAP22pVpaSP6Cni3J",
        "category" : "send",
        "amount" : -3000.00000000,
        "fee" : 0.00000000,
        "confirmations" : 99,
        "txid" : "a57132e2cbc580ac262aa3f7bac1e441d6573f9633118bc48009618585a0967e",
        "time" : 1330584607
    },
    {
        "account" : "",
        "address" : "13CmJpbAueuWiPKw3UYU4vXEcZ4WzP6nxt",
        "category" : "send",
        "amount" : -3000.00000000,
        "fee" : 0.00000000,
        "confirmations" : 99,
        "txid" : "a82ad85286c68f37a2feda1f5e8a4efa9db1e642b4ef53cb9fd86170169e5e68",
        "time" : 1330584607
    },
    {
        "account" : "",
        "address" : "15WoJ7L4AUfGHWdGj45NY9rFNiwU48woX2",
        "category" : "send",
        "amount" : -0.01002644,
        "fee" : 0.00000000,
        "confirmations" : 99,
        "txid" : "a82ad85286c68f37a2feda1f5e8a4efa9db1e642b4ef53cb9fd86170169e5e68",
        "time" : 1330584607
    },
    {
        "account" : "",
        "address" : "1NRy8GbX56MymBhDYMyqsNKwW9VupqKVG7",
        "category" : "send",
        "amount" : -2000.00000000,
        "fee" : 0.00000000,
        "confirmations" : 99,
        "txid" : "ff04763e3e8c93e43799dbbca833e183faad7e2611f20f136f47c2f1049481ae",
        "time" : 1330584607
    },
   {
        "account" : "",
        "address" : "1AaXeH5DuP6FpPxdCn9RGXKWhSG4r9Hq9q",
        "category" : "send",
        "amount" : -10000.00000000,
        "fee" : 0.00000000,
        "confirmations" : 99,
        "txid" : "0268b7285b95444808753969099f7ae43fb4193d442e3e0deebb10e2bb1764d0",
        "time" : 1330584607
    }

Again, we would like to reassure that trading will not be in any way affected and we are already in the process of contacting Linode regarding this incident. The Bitcoinica system has not been compromised and our reserves are more than sufficient for regular trading activities.
Pages:
Jump to: