Topic: [Emergency ANN] Bitcoinica site is taken offline for security investigation - page 3. (Read 224563 times)

Oh dear, bitomat.pl all over again.

I sincerely hope that the community will learn from this.

And good luck in sorting out this mess.

No backups.  I guess this explains why the whole process of officially acknowledging the hack (via the bitcoinica web site) and the claims process has been so slow.

You can find them here in the forums. Information upon which I think I will keep my BTC at bay 

Well good luck then, it's never too late to lose your money at some new Bitcoinica clone. Waiting to see how they operate won't make their service any more secure. I'm sure you've found out their identities before you trust them, say from their "who we are" page - but wait, there isn't one.

I haven't lost a cent in Bitcoinica. I will continue doing my own risk assessment and yes, most if not all investments involve risk.

You seem to be making wrong connections here, placing trust over those who have screwed you over above those who haven't. Once I see how they operate their business I will make a decision (obviously they can also lie about this, you have to factor everything).

I'm not ready to lose any more funds, and so should you. I don't trust Bitcoinica more than the next man. But why should Kronos be more trustworthy? I don't see how any such business earns any trust at the moment.

I have no idea about Kronos and its operation, but Bitcoinica was run terribly. I don't know why would anyone extrapolate what happened to Bitcoinica to any other business, while still keeping the slightest degree of trust in Bitcoinica. Just doesn't make sense.

So Bitcoinica was running on a cheap cloud server, got hacked and learnt absolutely nothing from the incident. Got hacked again, while in another cheap cloud server (in Rackspace, who also offers several more secure options including one aimed at financial security standards - yet they opted to be cheap again despite the massive running profits) and you somehow still give them more credibility than you'd give to a new service that, for starters, had a beta testing period. Which Bitcoinica didn't. Bitcoinica was running, apparently, less than 1 week after ZhouTong laid the first line of code. To top it off, they made significant changes to their core business structure in complete secrecy, and when asked about particular details they repeatedly lied. It simply doesn't get much worse or unprofessional than this.

As with any other "financial" bitcoin operation, not running under any regulations and not liable, obviously I'd put any amount of BTC in Kronos at my own risk. If you're not ready to lose them, don't put them there. This should apply to any business not offering you any sort of legal guarantee over your funds.

The hacker didn't know anything about Bitcoinica. He first requested the username, then requested a password reset. I have to say that Rackspace Cloud's security protection for customers is not very up to standard - you can re-use the password reset link after it's already used! And password changes don't have any effect on the sessions. (Usually everyone should be logged out once there's a password change, but it didn't happen at all.) I'm not blaming Rackspace here. Just a kind warning to those who wish to use them for anything serious.

Did the hacker also retrieve the username using the compromised email account - you need the username in order to reset the password for cloud hosting services and you need the account number/username to reset the password for managed services.

...Bitcoinica Memorial Day anyone, when we remember those brave & contagious souls who risked their all in a dodgy margin trading scheme, we recall those funds that were for ever lost, mislaid or indefinitely detained without due process, we vow never to repeat such a madness ever again, or at least not until Kronos.io opens for business next week


Who would be crazy enough to put another Satoshi into Kronos.io after what happened to the most renowned trading platform out there??? For all I care such hacks could be staged and there could be the same secret investors opening the same page under a new name preparing for the same heist once again. It's obviously untrue but are people truly so naive to think they can be successful now with the same business model- after what just happened TWICE, and with a solution for full security yet to be found???

+1 btw for handing over all claims to Zhoutong ASAP, at least the kid has some kind of a strategy to deal with refunds even though he deceived us about Bitcoinica's ownership for a long time.

From previous Hacker News thread, in which zhoutong participated.


http://news.ycombinator.com/item?id=2974770

https://en.bitcoin.it/wiki/Securing_online_services

That's cool, I'd heard of them but didn't realize they were level 3 certified. Maybe I should get one to play with.

If you're just talking about data storage, there are commercially available FIPS-140-2 level 3 devices that can be unlocked under Linux such as IronKey: http://www.imation.com/en-US/Mobile-Security/Mobile-Security-Products/Secure-Data/ (the S200 series is SLC, D200 is MLC, and Enterprise includes remote wipe next time its plugged in performed by the unlocking software).

well wouldnt the open source nature of the bitcoin protocol be somewhat similar?  the bitcoin protocol is out there for anyone to view.  why cant their be a wiki style of tested and proven security methods?

It sounds like there were too many people in charge at Bitcoinica.  Zhou kinda operated it, there was some main owner, and now some Bitcoin Consultancy general partners.  I am always against forming partnerships for this reason.  It is like getting married.  Instead of giving part of the company to someone, just give part of the profits.

Make one person in charge and then delegate other responsibilities to everyone else.  Don't let everyone in the company make public statements about the company.

One of Tihan's partners in CoinLab already spoke publicly about how raising VC for their projects was made more difficult by the fact that they involved Bitcoin.  If Bitcoin businesses continue to be seen as entities which just do whatever they want when something goes wrong rather than following established business practice, they will continue to have problems attracting venture capital.

It should not take an accountant (and there's already one associated with Bitcoinica and it's FSP, even if he might not have anticipated having to actually do something in relation to the business beyond setting it up) very long to communicate to Bitcoinica Consultancy the essential elements which must be considered when processing and disbursing claims.  This is not a business whose financial practices are not subject to external scrutiny - they are a registered financial services provider and that means they can't just do whatever the hell they want in terms of financial activity and accounting practices.

Messes like this one happen in part because many Bitcoin enterprises start out as one man operations and when they expand appropriate professional standards are not applied to their operations - areas in which the founder has little expertise often get ignored until something goes wrong.  Bitcoina's technical security was inadequate.  It should not compound an already bad situation by implementing a claims process which is also inadequate and which has no independent oversight.

para 1 - The only person involved it seems with the slightest understanding of even kinder garden level of security was the hacker here

para 2 - Indeed, why didn't they just do as in the Bond films & pull the mains plug, internet cable, cut some wires etc

para 3 - So now 90% of sequestrated funds will go to lawyers, accountants, receivers, loss adjusters, etc & the process will take years, really just throw it to Zhou Tong to fix as best he can, it won't be perfect but at least he will try & do the right thing by everyone & fast then move on

It's still extremely bizarre that Rackspace had no way to log the hacker out and that he was still able to delete the emergency backup in spite of the servers supposedly being suspended.  That's a huge security flaw for a hosting service to have and you do have to wonder whether the hacker was aware of that "hidden feature".  Whatever mistakes were made by Bitcoinica were certainly compounded by the inability of Rackspace to totally lock down the compromised servers.

Zhou, I notice that you are focusing primarily on what is technically possible.  For a whole lot of reasons, the claims process must also have integrity from an accounting point of view.  The principals have little choice but to assume that the manner in which they process user claims may be the subject of legal action in the future and to ensure that the process complies with recognised business and accounting standards (in fact, the process should really be independently audited).  While your proposals have merit, they need to be considered in a broader business context and it would be foolish of the principals to implement them without first obtaining professional advice.

OMG.

The first rule of computer using is that you *always* make backups. You backup early and you backup often, on-site and off-site.

I learned that the hard way in the early years of my 30-year computer programming career. If you don't do this then eventually you can get a *really big problem* like Bitcoinica has now.