I suspect that this could be a faucet code issue and not a inputs.io problem
This hacker may be targeting sites that surely would have had an input.io account with API enabled, looking for vulnerability, trying to obtain read privileges of the config.php in which almost all current faucet keep it in plain API key and pin codes
I've also found a strange activity on my site and services overflow attempts, but without any success
Topic: Inputs.io | Instant Payments, Offchain API, Secure Wallet, 235k+ BTC transferred - page 32. (Read 158152 times)
November 06, 2013, 07:06:13 AM
November 06, 2013, 06:51:05 AM
Yeah, you really have to calm down. Leaving all your BTC in the same wallet isn't a very good idea. Anyway, I'm sure TF is working harder than you may think to solve this.
November 06, 2013, 06:33:53 AM
i try to withdraw 0.5 btc, inputs.io say "Sent!" but he is not, trxid generated not exist and ofc my balance is now with -0.5005 btc 
[edit]
all ok, transaction show up after some time
[/edit]
[edit]
all ok, transaction show up after some time
[/edit]
November 06, 2013, 04:10:15 AM
Why is my "hotpocket empty"?
Same happened here.
Have all (or most of) funds from "hot wallets" been removed to cold storage?
First: it's not your hot pocket, it's inputs'.
I guess TF moved all coins to a secure cold wallet until he fixed the security breaches.
So calm down and use electrum to keep huge amounts next time
November 05, 2013, 02:49:04 PM
weird, I had an api-key enabled and no issues...
I hope you guys aren't setting your api key & pin variables directly in the code
(like in the callback example here: https://inputs.io/api#callbackexample )
hopefully TF gets the API back online soon
-Minty
I hope you guys aren't setting your api key & pin variables directly in the code
(like in the callback example here: https://inputs.io/api#callbackexample )
hopefully TF gets the API back online soon
-Minty
Haha lucky you. I guess the hacker didn't target everyone with an API key.
November 05, 2013, 09:36:48 PM
Why is my "hotpocket empty"?
Same happened here.
Have all (or most of) funds from "hot wallets" been removed to cold storage?
November 05, 2013, 08:33:26 PM
Has anyone got any updates yet? I've moved my money to cold storage until this is resolved. I'm confident TF will fix everything
November 05, 2013, 08:02:53 PM
CoinLenders should probably have it's withdraw disabled - I withdrew and found nothing shows up in my Inputs.IO wallet... then I come and look and the API is disabled. (which is probably why the deposit part didn't take effect)
CoinLenders should probably have caught some sort of error and not deducted my balance... hopefully this item is easy to fix and get balances right!
My luck is not too good these days - lose some BTC to an "auto-refund" by Coinbase and now to API key for CoinLenders...
CoinLenders should probably have caught some sort of error and not deducted my balance... hopefully this item is easy to fix and get balances right!
My luck is not too good these days - lose some BTC to an "auto-refund" by Coinbase and now to API key for CoinLenders...
I agree with your suggestion. I withdraw 5 BTC yesterday from Coinlenders and they never show up in inputs. I've sending email to TF and not receive any reply for this. This might be a serious problem for all of us.
November 05, 2013, 04:01:58 PM
CoinLenders should probably have it's withdraw disabled - I withdrew and found nothing shows up in my Inputs.IO wallet... then I come and look and the API is disabled. (which is probably why the deposit part didn't take effect)
CoinLenders should probably have caught some sort of error and not deducted my balance... hopefully this item is easy to fix and get balances right!
My luck is not too good these days - lose some BTC to an "auto-refund" by Coinbase and now to API key for CoinLenders...
CoinLenders should probably have caught some sort of error and not deducted my balance... hopefully this item is easy to fix and get balances right!
My luck is not too good these days - lose some BTC to an "auto-refund" by Coinbase and now to API key for CoinLenders...
November 05, 2013, 08:46:27 AM
I recently used the API, just to check how it works :S. Unlucky I guess 
. We'll be patient while TF works his magic
. We'll be patient while TF works his magic November 05, 2013, 03:46:34 PM
A full update will be posted soon, don't panic. Only people with the API key enabled was compromised (and will be reimbursed), passwords are securely stored one way in the database.
Security is obviously the most important thing to a Bitcoin wallet, and it's unfortunate that a compromise occurred, and we're learning a lot from it (things that pentests won't catch).
There will be a full update soon, but this compromise was not through a fault of the code but rather like a 'side channel' attack.
Security is obviously the most important thing to a Bitcoin wallet, and it's unfortunate that a compromise occurred, and we're learning a lot from it (things that pentests won't catch).
There will be a full update soon, but this compromise was not through a fault of the code but rather like a 'side channel' attack.
The attacker was able to empty the balance on accounts with the API key enabled. The issue is being actively looked upon. API access has been disabled.
Everyone who has lost money will be fully reimbursed.
Everyone who has lost money will be fully reimbursed.
Thank you TF. You're the best.
November 05, 2013, 11:25:49 AM
weird, I had an api-key enabled and no issues...
I hope you guys aren't setting your api key & pin variables directly in the code
(like in the callback example here: https://inputs.io/api#callbackexample )
hopefully TF gets the API back online soon
-Minty
I hope you guys aren't setting your api key & pin variables directly in the code
(like in the callback example here: https://inputs.io/api#callbackexample )
hopefully TF gets the API back online soon
-Minty
November 05, 2013, 10:17:24 AM
just want to ask all reimbursed or what is policy about this I lost 0.127 btc and its in my account for last 1 month
I lost 0.2445 BTC
November 05, 2013, 09:27:08 AM
just want to ask all reimbursed or what is policy about this I lost 0.127 btc and its in my account for last 1 month
November 05, 2013, 08:05:02 AM
A full update will be posted soon, don't panic. Only people with the API key enabled was compromised (and will be reimbursed), passwords are securely stored one way in the database.
Security is obviously the most important thing to a Bitcoin wallet, and it's unfortunate that a compromise occurred, and we're learning a lot from it (things that pentests won't catch).
There will be a full update soon, but this compromise was not through a fault of the code but rather like a 'side channel' attack.
Security is obviously the most important thing to a Bitcoin wallet, and it's unfortunate that a compromise occurred, and we're learning a lot from it (things that pentests won't catch).
There will be a full update soon, but this compromise was not through a fault of the code but rather like a 'side channel' attack.
Glad to hear you're resolving it so quickly. Can you check if anything was lost my faucet account? ([email protected]), and I think it might but I get so many cashouts it's a pain to go through.
November 05, 2013, 06:42:54 AM
Why is my "hotpocket empty"?
November 05, 2013, 05:59:03 AM
but you still need the pin to use the api.
That was just an example. Apparently this hacker found a way to exploit API keys and pins.
November 05, 2013, 03:46:51 AM
but you still need the pin to use the api.
November 05, 2013, 02:29:52 AM
A full update will be posted soon, don't panic. Only people with the API key enabled was compromised (and will be reimbursed), passwords are securely stored one way in the database.
Security is obviously the most important thing to a Bitcoin wallet, and it's unfortunate that a compromise occurred, and we're learning a lot from it (things that pentests won't catch).
There will be a full update soon, but this compromise was not through a fault of the code but rather like a 'side channel' attack.
Security is obviously the most important thing to a Bitcoin wallet, and it's unfortunate that a compromise occurred, and we're learning a lot from it (things that pentests won't catch).
There will be a full update soon, but this compromise was not through a fault of the code but rather like a 'side channel' attack.
by the way, just wondering, what are API keys? are they some special feature which allows access to our account, and how do I disable such a feature if it is ON
Just some quick info:
An API (Application Programming Interface) is a key that allows use of features of an application without having to provide a username/password combo, and performing a login. Typically, it's paired with some sort of JSON or XML response, for responses, and for retrieving information. Here's an example. (Disclaimer: Not real info
I'm not sure of the structure of the Inputs.io API)A user with an API key runs a faucet. He uses the Inputs.io API to send his payments automatically, instead of having to do it manually, or having to hack up a solution to emulate a real user. For old time's sake, let's call him Bob.
Bob's application requests the following page to send some Bitcoins.
Code:
https://inputs.io/api/v1/sendBitcoin?apikey=ThisIsHisAPIKey&amount=100&recipient=13373CuvtwQGgDWYv28pm3mTxy2bGS5U4D
This would authenticate to the API with his API key, and send 100 satoshis to the address 13373CuvtwQGgDWYv28pm3mTxy2bGS5U4D (I'm using my own for this example), or perhaps an Inputs.io user instead, where recipient could be replaced with "caffeinewriter" instead, or something similar.
Now let's say Mallory has somehow acquired Bob's API key. She now can use the Inputs.io API to manipulate Bob's account without ever logging in.
First, she could figure out his balance using the API, assuming there is a method for that.
Code:
https://inputs.io/api/v1/getBalance?apikey=ThisIsHisAPIKey&user=bitcoinbob
This could return a JSON object, for example.
Code:
{
"user": "bitcoinbob",
"balance": 214150000
}
"user": "bitcoinbob",
"balance": 214150000
}
Now Mallory can make another API request to withdraw Bob's entire balance of BTC2.14150000.
Code:
https://inputs.io/api/v1/sendBitcoin?apikey=ThisIsHisAPIKey&amount=214150000&recipient=1F1tAaz5x1HUXrCNLbtMDqcw6o5GNn4xqX
API keys are dangerous
Be safe guys. Hope this helped illustrate how this happened at least a little bit. 
November 05, 2013, 12:53:23 AM
The attacker was able to empty the balance on accounts with the API key enabled. The issue is being actively looked upon. API access has been disabled.
Everyone who has lost money will be fully reimbursed.
Everyone who has lost money will be fully reimbursed.
Great to hear!
My coins were also lost (Transaction e3da16d145fac74403c6c55bcfd0eb1529548267f30c28a5ef009b7b69243dc1)
If that could be please reimburst when you have the problem solved. Thanks for the great service.
Jump to: