Pages:
Author

Topic: [Payout Updates] Bitcoinica site is taken offline for security investigation - page 74. (Read 156711 times)

sr. member
Activity: 462
Merit: 250
I heart thebaron
Sub  Shocked

Naughty...

Are you an Intersango sock puppet ?

Hello all,
I'll be incorporating here in the UK and setting up bank accounts in England to accept sterling and Ireland to accept Euros. There doesn't seem to be any easy way accept US dollars without substantial wire fees.

...sorry. Had to ask.
full member
Activity: 184
Merit: 100
Just going to leave this here, where it will get more eyes watching it Wink
Well bitlane, I like you so I'll leave you some leads for you to follow...

You can see in this IRC log that BitcoinicaHacker used the usernames B1tcoinz and ageis on IRC http://ibot.rikers.org/20120521.html.gz

Looking for ageis on IRC logs I found some on #postfix IRC channel, which isn't much surprising, given that the dude used an exploited mailserver to pawn Bitcoinica and he's asking questions about, get ready, SASL and authentication stuff.
http://echelog.com/logs/browse/postfix/1321657200
http://echelog.com/logs/browse/postfix/1321743600

Also found an ageis on the IRC Bitcoin dev channel:
http://bitcoinstats.com/irc/bitcoin-dev/logs/2012/04/09/1
http://bitcoinstats.com/irc/bitcoin-dev/logs/2012/04/14/1
And the following that I found on #bitcoin-dev tells me that he's the same ageis on the #postfix
Quote
03:08    ageis [email protected]

Keep digging...
Every human makes mistakes and this dude is nothing else but human.

Now, if this helps to catch the guy, I want 10k BTC of reward lol

I think we should be extremely careful not to turn this into an baseless witch hunt.  But in case somebody wants to contact I think this seems to be the person you are trying to reach:
https://plus.google.com/116237107120834353559/posts
sr. member
Activity: 462
Merit: 250
I heart thebaron
The difference here is that the money that vanished was not all in Bitcoin, so the story doesn't hold up.

My point exactly. THEY FUCKED UP....and this 'theft' is nothing more than an 'opportunity'......

Atleast they still 'have' ~75,000 BTC in offline storage, as was stated by ZT....with the theft being the 20% amount of total that is.
legendary
Activity: 1358
Merit: 1002
Just going to leave this here, where it will get more eyes watching it Wink
Well bitlane, I like you so I'll leave you some leads for you to follow...

You can see in this IRC log that BitcoinicaHacker used the usernames B1tcoinz and ageis on IRC http://ibot.rikers.org/20120521.html.gz

Looking for ageis on IRC logs I found some on #postfix IRC channel, which isn't much surprising, given that the dude used an exploited mailserver to pawn Bitcoinica and he's asking questions about, get ready, SASL and authentication stuff.
http://echelog.com/logs/browse/postfix/1321657200
http://echelog.com/logs/browse/postfix/1321743600

Also found an ageis on the IRC Bitcoin dev channel:
http://bitcoinstats.com/irc/bitcoin-dev/logs/2012/04/09/1
http://bitcoinstats.com/irc/bitcoin-dev/logs/2012/04/14/1
And the following that I found on #bitcoin-dev tells me that he's the same ageis on the #postfix
Quote
03:08    ageis [email protected]

Keep digging...
Every human makes mistakes and this dude is nothing else but human.

Now, if this helps to catch the guy, I want 10k BTC of reward lol
hero member
Activity: 568
Merit: 500
Just take this into consideration....then compare it to what the story changes to by the time this gets taken care of.

Remember, only 20% of total BTC was stolen as noted below...NO OTHER CURRENCY AT RISK, so there shouldn't be any reason for everything NOT to get paid back 100%.

Out of that remaining 80%, I would hope there are enough profits to cover the stolen 20%.....or so one would think.

Quote
We have over 80% of our Bitcoins in offline wallets at the moment before the attack. We had to keep a large balance because the withdrawals are huge!
https://bitcointalksearch.org/topic/m.894305

If zhoutong was being completely upfront (perhaps why he was shunned by the 'powers that be') then the Bitcoinica Consultancy shouldn't be out of pocket any more than say, 10% total at worst ?

I do, A. And moreover, what was in USD should never have been online at all.
The more likely explanation was that they had a major position in the market when they were hacked, and were leveraging all their customer funds. Or that the hack was an inside job and the plan was to use a mere $90k theft to cover $1M+ in vanished money.
The difference here is that the money that vanished was not all in Bitcoin, so the story doesn't hold up.
sr. member
Activity: 462
Merit: 250
I heart thebaron
Just take this into consideration....then compare it to what the story changes to by the time this gets taken care of.

Remember, only 20% of total BTC was stolen as noted below...NO OTHER CURRENCY AT RISK, so there shouldn't be any reason for everything NOT to get paid back 100%.

Out of that remaining 80%, I would hope there are enough profits to cover the stolen 20%.....or so one would think.

Quote
We have over 80% of our Bitcoins in offline wallets at the moment before the attack. We had to keep a large balance because the withdrawals are huge!
https://bitcointalksearch.org/topic/m.894305

If zhoutong was being completely upfront (perhaps why he was shunned by the 'powers that be') then the Bitcoinica Consultancy shouldn't be out of pocket any more than say, 10% total at worst ?
hero member
Activity: 662
Merit: 545

30 May 23:30: We're going to proceed with payouts of the few people we have verified hopefully tomorrow for 80% of their claims (the remaining 20% will be refunded later). A more lengthy process will be applied to everyone else.


Have these "few people" gotten paid yet?

Genjix - I had a measly $11 in bitcoinica all transfered via mtgoxUSD code.  It should be very easy to confirm this shouldn't it?  Has MtGox been willing to cooperate?   I'm starting to get annoyed in the lack of updates/ no response from [email protected], and the fact that we got to come to a forum to get any type of news.  I understand I am not a user with thousands of dollars tied up and they may take precedence.   But this is just starting to get redonkulous.  

legendary
Activity: 1918
Merit: 1570
Bitcoin: An Idea Worth Spending
Quote
WITH NO ROOT PASSWORDS SENT BY EMAIL

Herein lies the weakest link.

~Bruno~


Welcome to Fort Knox. The key is in the mailbox.
hero member
Activity: 568
Merit: 500
For these reasons, I personally will never use Rackspace Cloud again unless they address all of these issues. AWS is way more secure than them.

Some guys have the fate of repeating the same mistakes over and over and over again. Roll Eyes


Yeah. Seriously? The lesson from this should be DEDICATED HARDWARE IN A LOCKED CAGE, WITH NO ROOT PASSWORDS SENT BY EMAIL, AND NO EMAIL HOSTED BY A THIRD PARTY. It doesn't matter if it's 2x as expensive, or even 10x as expensive. It's called being "insurance poor". When you try to cut as many corners as possible to save a dollar, you end up losing $90,000.

Don't be cheap with other people's safety. No one in their right mind would use a fucking VPS for anything, let alone leave the keys to the castle on one.

And where the hell is my response email?
legendary
Activity: 1358
Merit: 1002
For these reasons, I personally will never use Rackspace Cloud again unless they address all of these issues. AWS is way more secure than them.

Some guys have the fate of repeating the same mistakes over and over and over again. Roll Eyes
legendary
Activity: 826
Merit: 1001
rippleFanatic
For these reasons, I personally will never use Rackspace Cloud again unless they address all of these issues. AWS is way more secure than them.

But that's still no excuse for not having offline backups. If you weren't online to notice the unauthorized rackspace session, the Rackspace admin "delete servers" bug (unable to disable) would still be an unknown bug/feature.

As for AWS, remember last year when bitomat.pl lost 17k BTC (iirc) in the blink of an eye when their AWS VPS was rebooted? MtGox bought them out and gauranteed depositor funds.

Don't trust a "cloud". (this is opposed to: first I trusted Linode, then I trusted Rackspace, and after getting burnt by Rackspace I finally decided to trust Amazon Web Services). Live and learn.
hero member
Activity: 616
Merit: 502
I sent several e-mail, including screenshots of all transfers Gox (the only source of funding), forwarded to the email-confirmation Bitcoinica No answer. Nothing at all.  Sad

I'm beginning to think that cracking did not have ... (was - no hacking. Just a way to prevent washout. (drain) )

If so - I hope that well paid. Why do you tighten the process? Return the money (it's a penny) - start the service on a reliable host, and earn more .. The trust has a habit of recovering. Moreover, everyone here understands that it's "growing pains" ..

edit. it`s penny, compared to how much can give a "cash cow" in the future
donator
Activity: 452
Merit: 252
I've sent numerous emails to [email protected] and still never received one single reply.

No answer to my question on the status of my claim, which is completely in USD. No reply whatsoever. Is anyone actually reading the mail there? Because it seems like no one else has received a response either.

I don't think thats a reply to inbox, iirc they use it to match email+claim and nothing else.
hero member
Activity: 568
Merit: 500
I've sent numerous emails to [email protected] and still never received one single reply.

No answer to my question on the status of my claim, which is completely in USD. No reply whatsoever. Is anyone actually reading the mail there? Because it seems like no one else has received a response either.
hero member
Activity: 868
Merit: 1000
The week is coming to end and I believe you have said that by the end of the week some people will get refunded. So how is it?

This update was posted just under 12 hours ago.

Quote
02 June 2012 21:26: The process is at an impasse because of some legal wrangling.

https://bitcointalksearch.org/topic/m.937203

It's currently just after 8am Sunday in London, so perhaps there'll be some progress later in the day.
vip
Activity: 490
Merit: 502
The week is coming to end and I believe you have said that by the end of the week some people will get refunded. So how is it?

Even though I'm in their mailing list, I don't have any official progress information.

I wasn't involved in the process except for very little moderation work. I think they are almost ready now. Hope someone from Bitcoinica Consultancy can post an update soon.
hero member
Activity: 607
Merit: 500
The week is coming to end and I believe you have said that by the end of the week some people will get refunded. So how is it?
vip
Activity: 490
Merit: 502
Quote
The entire Cloud Sites FTP structure is backed up every four hours, which totals six daily backups. Those backups are rolled into a nightly backup, which are retained for two days. However, these backups are for disaster recovery on the server side. If for any reason a storage node on our side were to crash, our backups will be there to replace any lost data.

That said, we recommend that you make periodic backups of your site and data to your local computer since we are unable to extract an individual site's data from the nightly backups.

Was it, or was it not, possible to recover lost data from Rackspaces servers during that first 48 hour window? I don't understand how Rackspace is able to recover data from their servers following a "disaster" yet unable to after a phone call is made to them about data being erased by other means.

I'm puzzled!

~Bruno~

According to an unknown source, the data retention for deleted servers is 12 hours. However, Rackspace suspended the servers made me feel that they are "safe", because I couldn't do anything against the servers. No one, not even the Rackspace manager knew that the servers can be deleted.

When I was ready to re-start the servers and continue Bitcoinica operations I found everything gone. And it's 17 hours since deletion.
vip
Activity: 490
Merit: 502
I almost forgot to mention, I know people who work at rackspace and I've talked to them.  Your logs & database being deleted is effectively a non-issue, it's a pain to recover but you can bet that they have the capability of recovering every last byte of missing information.
This has bugged me as well.  Until this episode I had the impression that Rackspace was a serious hosting provider.  Not some garage with a couple of racks on UPS and a fat ADSL line.  A serious hosting provider keep multiple backups of customer data off-site, because losing a lot of customer data due to some catastrophic event means losing their business.  Unlinking it from a web page just makes the data a bit more inconvenient to get to.  Impossible for the customer, but in no way impossible for Rackspace.  The data may be older than current, but I find it hard to believe that off-site backups were instantly deleted along with the servers.  Backup systems just aren't built for easy deletion.

Perhaps someone from Bitoinica can comment on how they have worked with Rackspace to rescue data?

We have talked to a manager and he confirms that no data can be recovered. We have even offered a $10,000 tip for any information recovered, but later they got the bad news again.

Rackspace shouldn't be used for serious applications, because of the following "features":

- You can own all servers in an account with an email.
- You can't force someone to log out, not even any Rackspace employee.
- You can suspend the servers through customer support. They will say it's safe. But anyone can delete the servers.
- When you delete something, even in Cloud Files, it's permanent.
- When the thief is in your account, you can't do anything to prevent him from doing anything destructive.

For these reasons, I personally will never use Rackspace Cloud again unless they address all of these issues. AWS is way more secure than them.
legendary
Activity: 1050
Merit: 1000
Sooo... the extra cost additional backups are just more snapshots on the LVM, essentially? If so, that's lame. Paying extra for something that is already happening is stupid. However, if the extra paid option is actually a full disk clone, I would suspect that it would therefore be trivial to restore deleted data from backup in that case.

i'm no expert on backups but know there are solutions (probably most of them) where you can't extract specific data from a backup, only everything at once, and it must be slow as hell. i can understand their position - they would not nuke all their cloud clients to last backed-up snapshot just because of a single client request, doesn't make sense. and that's why they offer optional backup services  for clients who do require it
Pages:
Jump to: