Is the Bitcoin Community Under Attack?

bittenbob

hero member

Activity: 560

Merit: 500

Quote from: DeathAndTaxes on January 18, 2012, 08:44:48 AM

Quote from: rjk on January 18, 2012, 12:39:36 AM

Can anyone say... Certificate Revocation Lists (CRLs)! Hardware-based token storage! Fingerprints! Dedicated SSL appliances!
This is fun, I can go on all day. Grin

Yeah which is why I asked how one could easily MITM a https site. I guess it was too subtle.

CRL's would only work if they knew it had been hijacked. Kind of like how a 0day exploit will usually only work once since it will be found and patched after it has been used.

cypherdoc

legendary

Activity: 1764

Merit: 1002

Quote from: BadBear on January 18, 2012, 07:46:57 AM

Quote from: bittenbob on January 17, 2012, 11:34:29 PM

SSL is not the be all and end all. Handshakes can be captured and faked quite easily. Spoofing mac addresses is also very easy.

LOL!

DeathAndTaxes

donator

Activity: 1218

Merit: 1080

Gerald Davis

Quote from: rjk on January 18, 2012, 12:39:36 AM

Can anyone say... Certificate Revocation Lists (CRLs)! Hardware-based token storage! Fingerprints! Dedicated SSL appliances!
This is fun, I can go on all day. Grin

Yeah which is why I asked how one could easily MITM a https site. I guess it was too subtle.

BadBear

legendary

Activity: 1652

Merit: 1128

Quote from: bittenbob on January 17, 2012, 11:34:29 PM

SSL is not the be all and end all. Handshakes can be captured and faked quite easily. Spoofing mac addresses is also very easy.

luv2drnkbr

hero member

Activity: 793

Merit: 1026

Quote from: jake262144 on January 17, 2012, 08:36:22 PM

@Eveofwar
Heh, everyone has a panic threshold.

Not too long ago I was at work. Not having enough work to do I checked bitcoinwatch. It showed a ridiculously low number of blocks/hour, something like 2.1
This got me thinking: wtf, better check the forums. Needless to say, the forums were down.
When I realized that MtGox was also down a red light went off and I immediately sent an alarming message to Gavin himself, describing the situation

Heck, when you're not at home you can't just take your time and research the situation carefully.

Why would you bother Gavin? He surely would find out himself anyway. He's done so much, don't pester the poor man!

bittenbob

hero member

Activity: 560

Merit: 500

Quote from: kjj on January 18, 2012, 01:49:23 AM

Quote from: bittenbob on January 17, 2012, 08:58:35 PM

Quote from: theymos on January 17, 2012, 08:56:02 PM

MtGox's HTTPS will prevent any MITM attack unless the attacker compromises a CA or something.

Just curious theymos, what is your take on what was going on with all the charts when it was cycling in a loop between 6 and 7? After about 25 minutes those cycles were erased and the market sat at 6 until orders that were placed during the swings on the charts were executed. Anything is possible and I have never seen anything like what happened today.

I will tell you exactly what happened today. Ready?

Quote from: kjj on January 17, 2012, 08:19:55 PM

Actually, gox just uses a queue with timestamps. Their order matcher can fall behind during busy times.

When the queue is busy, everyone sees huge price swings and they try to place orders, but their orders are going to the queue, not the market. The swings you are seeing right now on mtgoxlive.com are at least several minutes old already, possibly much older, and everyone frantically clicking their trade buttons and the bots scrambling to make sense of things are just making it worse.

I gave a much longer answer to (more or less) this same question several months ago. Feel free to dig it out of my post history. And, just to repeat myself:

Quote from: kjj on January 17, 2012, 08:50:40 PM

It must be hell to be alive today with no clue about how anything at all really works.

Those swings were not real since they did not show up on the chart after. There was something that happened and it wasnt that. If it was simply that they were old the lines from the back and forth would be there. They disappeared as soon as trading became active again.

kjj

legendary

Activity: 1302

Merit: 1026

Quote from: bittenbob on January 17, 2012, 08:58:35 PM

Quote from: theymos on January 17, 2012, 08:56:02 PM

MtGox's HTTPS will prevent any MITM attack unless the attacker compromises a CA or something.

Just curious theymos, what is your take on what was going on with all the charts when it was cycling in a loop between 6 and 7? After about 25 minutes those cycles were erased and the market sat at 6 until orders that were placed during the swings on the charts were executed. Anything is possible and I have never seen anything like what happened today.

I will tell you exactly what happened today. Ready?

Quote from: kjj on January 17, 2012, 08:19:55 PM

Actually, gox just uses a queue with timestamps. Their order matcher can fall behind during busy times.

When the queue is busy, everyone sees huge price swings and they try to place orders, but their orders are going to the queue, not the market. The swings you are seeing right now on mtgoxlive.com are at least several minutes old already, possibly much older, and everyone frantically clicking their trade buttons and the bots scrambling to make sense of things are just making it worse.

I gave a much longer answer to (more or less) this same question several months ago. Feel free to dig it out of my post history. And, just to repeat myself:

Quote from: kjj on January 17, 2012, 08:50:40 PM

It must be hell to be alive today with no clue about how anything at all really works.

rjk

sr. member

Activity: 448

Merit: 250

1ngldh

Can anyone say... Certificate Revocation Lists (CRLs)! Hardware-based token storage! Fingerprints! Dedicated SSL appliances!
This is fun, I can go on all day. Grin

bittenbob

hero member

Activity: 560

Merit: 500

Quote from: Maged on January 18, 2012, 12:20:50 AM

Quote from: bittenbob on January 17, 2012, 11:42:00 PM

I haven't googled anything and am going completely by memory. I rarely ever use wikipedia and especially not for technical matters. If you want to fake a handshake you will need to spoof IP and mac addresses. I am afraid it is you who doesn't know WTF you are talking about.

By the way Theymos, this thread is getting out of control and has nothing to do with the OP so feel free to lock it.

Then maybe you should start using Google. First off, just to get past the TCP handshake you need to be able to capture the response. As for the SSL handshake, you need the site's private key, otherwise all you'll get back is gibberish. And without knowing what that gibberish decrypts to, you can't send a response that will make any sense to the client. Since you are apparently good at cracking private keys, why don't you just start taking bitcoins?

Edit: I think my SSL is actually backward, and it's the client that sends their encryption key using the site's pubic key to encrypt it. But, that's just semantics.

This is all irrelevant to the OP once again. It would be possible to fake if someone got the cert from MTGox. They were hacked in the past and stolen certs is part of how the Stuxnet virus worked. I haven't hacked in a while and have no intention to do so any time soon. Stealing Bitcoins is a lot harder than MTIM for MTGox API and if someone could do it, it would have been done by now. I am not a thief either so even if I could I wouldn't out of morality.

It would be nice if MTGox put out a statement directly saying what happened when the API was cycling between 6 and 7 then disappeared. It would also put any speculation to rest.

I was worried while that was happening that the site was being hacked in some way and was shitting my pants about the relatively small amount of money and bitcoins i have on there. I still have them on there if that tells you something.

Eveofwar

sr. member

Activity: 406

Merit: 250

Quote from: ?? on ??

It ain't that eAsY unless your 5 YO knows how to compile and test code.

http://www.metasploit.com/ takes care of most of that I thought. Includes most of those already Cheesy

Maged

legendary

Activity: 1204

Merit: 1015

Quote from: bittenbob on January 17, 2012, 11:42:00 PM

I haven't googled anything and am going completely by memory. I rarely ever use wikipedia and especially not for technical matters. If you want to fake a handshake you will need to spoof IP and mac addresses. I am afraid it is you who doesn't know WTF you are talking about.

By the way Theymos, this thread is getting out of control and has nothing to do with the OP so feel free to lock it.

Then maybe you should start using Google. First off, just to get past the TCP handshake you need to be able to capture the response. As for the SSL handshake, you need the site's private key, otherwise all you'll get back is gibberish. And without knowing what that gibberish decrypts to, you can't send a response that will make any sense to the client. Since you are apparently good at cracking private keys, why don't you just start taking bitcoins?

Edit: I think my SSL is actually backward, and it's the client that sends their encryption key using the site's pubic key to encrypt it. But, that's just semantics.

bittenbob

hero member

Activity: 560

Merit: 500

This isn't a hacking lesson folks and I will not teach you a damn thing. This thread was supposed to be asking if we were under attack as a community.

As a note here ABC is still under DDOS and no reprieve is in sight.

amencon

sr. member

Activity: 410

Merit: 250

Quote from: cottoneyeJoe on January 17, 2012, 11:42:32 PM

a year from now the last poster on this thread is gonna be bittenbob

y'all know that, right?

I think I'm OK with that. But I hope he teaches me more about how to hack the whole internet before this winds down.

Eveofwar

sr. member

Activity: 406

Merit: 250

Quote from: bittenbob on January 17, 2012, 11:42:00 PM

Quote from: Eveofwar on January 17, 2012, 11:38:17 PM

Quote from: bittenbob on January 17, 2012, 11:34:29 PM

Quote from: rjk on January 17, 2012, 11:31:15 PM

Quote from: bittenbob on January 17, 2012, 11:27:57 PM

I didn't say that a 5 year old could DDOS so there was no need to answer his question. You made a very inappropriate and irrelevant comment. Do not post in my thread if you are going to be an idiot.

A DDOS can be done from a downloadable program. If you want someone to teach you to hack I won't be the one telling you directly. I probably already said too much by saying backtrack.

I am lol'ing so hard right now. Thanks for the laugh.

p.s. - http://en.wikipedia.org/wiki/Secure_Sockets_Layer

SSL is not the be all and end all. Handshakes can be captured and faked quite easily. Spoofing mac addresses is also very easy.

If all this was 100% there would never be any hacking.

What does spoofing MAC addresses have to do with SSL and Handshakes ?

You know, I'd almost feel like you didn't know WTF you were talking about if the SOPA Blackout was in place and Wikipedia was not a tool for you.

I haven't googled anything and am going completely by memory. I rarely ever use wikipedia and especially not for technical matters. If you want to fake a handshake you will need to spoof IP and mac addresses. I am afraid it is you who doesn't know WTF you are talking about.

By the way Theymos, this thread is getting out of control and has nothing to do with the OP so feel free to lock it.

Please cite your source.

cottoneyeJoe

member

Activity: 91

Merit: 10

a year from now the last poster on this thread is gonna be bittenbob

y'all know that, right?

bittenbob

hero member

Activity: 560

Merit: 500

Quote from: Eveofwar on January 17, 2012, 11:38:17 PM

Quote from: bittenbob on January 17, 2012, 11:34:29 PM

Quote from: rjk on January 17, 2012, 11:31:15 PM

Quote from: bittenbob on January 17, 2012, 11:27:57 PM

I didn't say that a 5 year old could DDOS so there was no need to answer his question. You made a very inappropriate and irrelevant comment. Do not post in my thread if you are going to be an idiot.

A DDOS can be done from a downloadable program. If you want someone to teach you to hack I won't be the one telling you directly. I probably already said too much by saying backtrack.

I am lol'ing so hard right now. Thanks for the laugh.

p.s. - http://en.wikipedia.org/wiki/Secure_Sockets_Layer

SSL is not the be all and end all. Handshakes can be captured and faked quite easily. Spoofing mac addresses is also very easy.

If all this was 100% there would never be any hacking.

What does spoofing MAC addresses have to do with SSL and Handshakes ?

You know, I'd almost feel like you didn't know WTF you were talking about if the SOPA Blackout was in place and Wikipedia was not a tool for you.

I haven't googled anything and am going completely by memory. I rarely ever use wikipedia and especially not for technical matters. If you want to fake a handshake you will need to spoof IP and mac addresses. I am afraid it is you who doesn't know WTF you are talking about.

By the way Theymos, this thread is getting out of control and has nothing to do with the OP so feel free to lock it.

theymos

administrator

Activity: 5222

Merit: 13032

Quote from: bittenbob on January 17, 2012, 11:34:29 PM

SSL is not the be all and end all. Handshakes can be captured and faked quite easily. Spoofing mac addresses is also very easy.

LOL

Eveofwar

sr. member

Activity: 406

Merit: 250

Quote from: bittenbob on January 17, 2012, 11:34:29 PM

Quote from: rjk on January 17, 2012, 11:31:15 PM

Quote from: bittenbob on January 17, 2012, 11:27:57 PM

I didn't say that a 5 year old could DDOS so there was no need to answer his question. You made a very inappropriate and irrelevant comment. Do not post in my thread if you are going to be an idiot.

A DDOS can be done from a downloadable program. If you want someone to teach you to hack I won't be the one telling you directly. I probably already said too much by saying backtrack.

I am lol'ing so hard right now. Thanks for the laugh.

p.s. - http://en.wikipedia.org/wiki/Secure_Sockets_Layer

SSL is not the be all and end all. Handshakes can be captured and faked quite easily. Spoofing mac addresses is also very easy.

If all this was 100% there would never be any hacking.

What does spoofing MAC addresses have to do with SSL and Handshakes ?

You know, I'd almost feel like you didn't know WTF you were talking about if the SOPA Blackout was in place and Wikipedia was not a tool for you.

bittenbob

hero member

Activity: 560

Merit: 500

Quote from: cottoneyeJoe on January 17, 2012, 11:33:06 PM

Is bittenbob being irresponsible for spreading hacking tips on these forums and claiming to own the threads he starts?

See...it's just a question...and I didnt say you were a five year old.

Wink

I never said anyone was a five year old if thats what you were implying and you were a little more polite than the other posters. I haven't given any direct information on hacking with the exception of something that someone could google on their own. All I said is that a 5 year old could pull off a DDOS.

bittenbob

hero member

Activity: 560

Merit: 500

Quote from: rjk on January 17, 2012, 11:31:15 PM

Quote from: bittenbob on January 17, 2012, 11:27:57 PM

I didn't say that a 5 year old could DDOS so there was no need to answer his question. You made a very inappropriate and irrelevant comment. Do not post in my thread if you are going to be an idiot.

A DDOS can be done from a downloadable program. If you want someone to teach you to hack I won't be the one telling you directly. I probably already said too much by saying backtrack.

I am lol'ing so hard right now. Thanks for the laugh.

p.s. - http://en.wikipedia.org/wiki/Secure_Sockets_Layer

SSL is not the be all and end all. Handshakes can be captured and faked quite easily. Spoofing mac addresses is also very easy.

If all this was 100% there would never be any hacking.

Topic: Is the Bitcoin Community Under Attack? (Read 3984 times)