Pages:
Author

Topic: Poloniex security review - page 3. (Read 6590 times)

sr. member
Activity: 266
Merit: 251
October 15, 2016, 11:24:53 AM
#22

It's probably safe, but virustotal isn't infallible. This warning is stickied at the top of the altcoin section. It warns that virus scans is no longer sufficient to ensure safety. There are sophisticated attacks that are undetectable, you only find out you've been hacked after you realise you've been robbed.

In the past months, malware infection attempts on this forum has become increasingly sophisticated. Below is a summary of infection techniques that I have encountered. With the most sophisticated attacks, common sense and virus scans is no longer sufficient to ensure safety.


hero member
Activity: 729
Merit: 545
full member
Activity: 210
Merit: 100
October 15, 2016, 10:34:04 AM
#20
virustotal scan? i've some fear of these bitcointalk random links...
newbie
Activity: 11
Merit: 0
October 15, 2016, 10:12:13 AM
#19
Quote
I did read it. You fail to mention the need for valid hash to confirm any of those actions. Why? Because it would be less sensational, I guess.

That's the point ! There is no need of valid hash to confirme those actions ! Check yourself !
Here is a capture of the complete request !

https://i.gyazo.com/0afa447c3c27f5d5076d0d8f3264fc1d.png

Since source code is client side i suggest you read up on how a "buy transaction" is done.

Code:
$("#buyForm").submit(function (event) {
    event.preventDefault();
   
    if ($("#dimmer").is(":visible"))
    return $("#alertDivOK").click();
   
    if (document.getElementById('buyAmount').value < 0.0001) {
        $("#result").empty().append("Amount must be greater than 0.0001.");
        showAlert();
        return;
    }

    if (document.getElementById('buyRate').value < 0.00000001) {
        $("#result").empty().append("Price must be greater than zero.");
        showAlert();
        return;
    }

    showProgressBar();
    var $form = $(this),
    url = '/private.php';
    params = { currencyPair: currencyPair,
    rate: $('#buyRate').val(),
    amount: $('#buyAmount').val(),
    command: (margin ? 'marginBuy' : 'buy')};
if (margin)
params['maxRate'] = $("#buyMaxRate").val() === undefined ? 0.005 : $("#buyMaxRate").val();

if (webSocketCall(params))
return true;

    var posting = $.get(url, params);
    posting.done(function (data) {
        var content = $(data);
        $("#result").empty().append(content);
        showAlert();
        updatePrivateInfo();
    });

});

Code:
function webSocketCall(params,id){
return false;
if ('conn' in window && window.conn.readyState == 1 && 1000 in window.conn.subscriptions){
if (typeof id == "undefined")
id = ++wNonce + usid;
window.conn.send(JSON.stringify({command: "private",channel: 2000,id: id,params: params}));
return true;
} else {
return false;
}
}
hero member
Activity: 729
Merit: 545
October 15, 2016, 10:09:42 AM
#18
Quote
The best you could hope for is that you post a link, someone click it, they have sufficient balance to make a transaction, all this before a mod catches it. The result is that the victim makes a shitty purchase. ...and that's the bug they acknowledged and paid you for. The others are nonsense.

Exactly, that's only a proof of concept. How much people could I get to click on my link ? If I have luck, I fall on someone with 100+ BTC balance, which is not that rare.
But I can also use Open URL Vulnerability, which will set the Referer as poloniex.com and redirect to the GET buying/selling request.
They never paid me neither replied to my ticket reporting this vulnerability.
sr. member
Activity: 458
Merit: 265
October 15, 2016, 10:06:46 AM
#17
Quote
I did read it. You fail to mention the need for valid hash to confirm any of those actions. Why? Because it would be less sensational, I guess.

That's the point ! There is no need of valid hash to confirme those actions ! Check yourself !
Here is a capture of the complete request !


The best you could hope for is that you post a link, someone click it, they have sufficient balance to make a transaction, all this before a mod catches it. The result is that the victim makes a shitty purchase. ...and that's the bug they acknowledged and paid you for. The others are nonsense.
hero member
Activity: 729
Merit: 545
October 15, 2016, 09:57:29 AM
#16
Quote
I did read it. You fail to mention the need for valid hash to confirm any of those actions. Why? Because it would be less sensational, I guess.

That's the point ! There is no need of valid hash to confirme those actions ! Check yourself !
Here is a capture of the complete request !

sr. member
Activity: 458
Merit: 265
October 15, 2016, 09:53:39 AM
#15
Well written FUD, none of those are actual vulnerabilities. They probably stopped responding to you because this is complete nonsense.

Could you please tell me where is the nonsense ? Where is the FUD ? Please quote me where I'm wrong and arguments.
They paid you a bounty for the one bug you found, which wasn't much of a security risk really. The others are not bugs and they are not paying you a bounty for them. That said, what is your goal from making this information public? It's clearly an an attempt to FUD, probably in hopes that Polo will pay you for your "bugs" in the future for fear you will spread more FUD about them.

You should really consult security pentester. They will all agree with my arguments.
As a matter of fact, I described a possible attack in my article, which, when I got the trollbox moderator privilege escalation (which wasn't mush of a security risk ? lol ?), I was able to spread clickable buying, selling, withdraw and lending links. Sorry, but I think it is a serious vulnerability don't you ?

Don't you think I deserved, not a bounty, but maybe something like a ... reply ? "Thanks, we've corrected this bug, rest assure you can trade on Poloniex safety" ? It is the strict minimum.

I do not expect any bounty from poloniex, your theory of the conspiracy sounds a little too much.

Proof of concept links, you wouldn't have had valid hashes.
"..what is your goal from making this information public?"

That's the major problem ! There is no csrf tokens or "valid hashes" that protect those links. You should really read my paper better, or maybe my english was wrong.
My goal is to ring the alarm at the Poloniex team and expect them to have a better protection of there customers funds. This isn't FUD, a simple 4 page PDF will not destroy a big company in 1 day.
I did read it. You fail to mention the need for valid hash to confirm any of those actions. Why? Because it would be less sensational, I guess.
hero member
Activity: 729
Merit: 545
October 15, 2016, 09:47:21 AM
#14
Well written FUD, none of those are actual vulnerabilities. They probably stopped responding to you because this is complete nonsense.

Could you please tell me where is the nonsense ? Where is the FUD ? Please quote me where I'm wrong and arguments.
They paid you a bounty for the one bug you found, which wasn't much of a security risk really. The others are not bugs and they are not paying you a bounty for them. That said, what is your goal from making this information public? It's clearly an an attempt to FUD, probably in hopes that Polo will pay you for your "bugs" in the future for fear you will spread more FUD about them.

You should really consult security pentester. They will all agree with my arguments.
As a matter of fact, I described a possible attack in my article, which, when I got the trollbox moderator privilege escalation (which wasn't mush of a security risk ? lol ?), I was able to spread clickable buying, selling, withdraw and lending links. Sorry, but I think it is a serious vulnerability don't you ?

Don't you think I deserved, not a bounty, but maybe something like a ... reply ? "Thanks, we've corrected this bug, rest assure you can trade on Poloniex safety" ? It is the strict minimum.

I do not expect any bounty from poloniex, your theory of the conspiracy sounds a little too much.

Proof of concept links, you wouldn't have had valid hashes.
"..what is your goal from making this information public?"

That's the major problem ! There is no csrf tokens or "valid hashes" that protect those links. You should really read my paper better, or maybe my english was wrong.
My goal is to ring the alarm at the Poloniex team and expect them to have a better protection of there customers funds. This isn't FUD, a simple 4 page PDF will not destroy a big company in 1 day.
sr. member
Activity: 458
Merit: 265
October 15, 2016, 09:41:31 AM
#13
Well written FUD, none of those are actual vulnerabilities. They probably stopped responding to you because this is complete nonsense.

Could you please tell me where is the nonsense ? Where is the FUD ? Please quote me where I'm wrong and arguments.
They paid you a bounty for the one bug you found, which wasn't much of a security risk really. The others are not bugs and they are not paying you a bounty for them. That said, what is your goal from making this information public? It's clearly an an attempt to FUD, probably in hopes that Polo will pay you for your "bugs" in the future for fear you will spread more FUD about them.

You should really consult security pentester. They will all agree with my arguments.
As a matter of fact, I described a possible attack in my article, which, when I got the trollbox moderator privilege escalation (which wasn't mush of a security risk ? lol ?), I was able to spread clickable buying, selling, withdraw and lending links. Sorry, but I think it is a serious vulnerability don't you ?

Don't you think I deserved, not a bounty, but maybe something like a ... reply ? "Thanks, we've corrected this bug, rest assure you can trade on Poloniex safety" ? It is the strict minimum.

I do not expect any bounty from poloniex, your theory of the conspiracy sounds a little too much.

Proof of concept links, you wouldn't have had valid hashes.
"..what is your goal from making this information public?"
hero member
Activity: 729
Merit: 545
October 15, 2016, 09:36:36 AM
#12
Well written FUD, none of those are actual vulnerabilities. They probably stopped responding to you because this is complete nonsense.

Could you please tell me where is the nonsense ? Where is the FUD ? Please quote me where I'm wrong and arguments.
They paid you a bounty for the one bug you found, which wasn't much of a security risk really. The others are not bugs and they are not paying you a bounty for them. That said, what is your goal from making this information public? It's clearly an an attempt to FUD, probably in hopes that Polo will pay you for your "bugs" in the future for fear you will spread more FUD about them.

You should really consult security pentester. They will all agree with my arguments.
As a matter of fact, I described a possible attack in my article, which, when I got the trollbox moderator privilege escalation (which wasn't mush of a security risk ? lol ?), I was able to spread clickable buying, selling, withdraw and lending links. Sorry, but I think it is a serious vulnerability don't you ?

Don't you think I deserved, not a bounty, but maybe something like a ... reply ? "Thanks, we've corrected this bug, rest assure you can trade on Poloniex safety" ? It is the strict minimum.

I do not expect any bounty from poloniex, your theory of the conspiracy sounds a little too much.
sr. member
Activity: 434
Merit: 250
October 15, 2016, 09:31:18 AM
#11
I would actually be very interested to know if Poloniex and other sites ever did actual security auditing.
They would be foolish not to pay for this type of service,
but nothing would surprise me with these exchanges.

I actually asked a question regarding security on these exchanges a week or two ago and got zero replies in the thread lol.
No one cares about security until millions of dollars in coins go missing.
sr. member
Activity: 458
Merit: 265
October 15, 2016, 09:29:35 AM
#10
Well written FUD, none of those are actual vulnerabilities. They probably stopped responding to you because this is complete nonsense.

Could you please tell me where is the nonsense ? Where is the FUD ? Please quote me where I'm wrong and arguments.
They paid you a bounty for the one bug you found, which wasn't much of a security risk really. The others are not bugs and they are not paying you a bounty for them. That said, what is your goal from making this information public? It's clearly an an attempt to FUD, probably in hopes that Polo will pay you for your "bugs" in the future for fear you will spread more FUD about them.
hero member
Activity: 729
Merit: 545
October 15, 2016, 09:20:18 AM
#9
Well written FUD, none of those are actual vulnerabilities. They probably stopped responding to you because this is complete nonsense.

Could you please tell me where is the nonsense ? Where is the FUD ? Please quote me where I'm wrong in my review and arguments a little more ...
sr. member
Activity: 458
Merit: 265
October 15, 2016, 09:09:52 AM
#8
Well written FUD, none of those are actual vulnerabilities. They probably stopped responding to you because this is complete nonsense.
hero member
Activity: 729
Merit: 545
October 15, 2016, 08:17:44 AM
#7
Yes, but I believe you could take this to busoni, OMK, MICKD, MOBY DICK or someother admin of POLO through their IRC chat

I'm waiting reply since 27 days.
I've been pushing my ticket via moderator more than 6+ times. They are literally having fun of me.
That's why I wanted to share this review to show the irresponsability of their team.

Do you have some proof regarding the above statement, If you can provide that we do need to be more cautions while using poloniex to trade. But how will such a famous site ignore their security vulnerability, Which might cause them to loose members.

Yep we had our lessons from mt gox bitfinex but we will never remember anything after the heat reduces, But as far as bitcoins and altcoins trading we have to rely on some trading platforms online.

I can provide screen, but we cannot really consider it a proof as the source code can be edited to modify data.
I have also some e-mail that I sent to Poloniex.
full member
Activity: 224
Merit: 100
October 15, 2016, 08:14:32 AM
#6
Yes, but I believe you could take this to busoni, OMK, MICKD, MOBY DICK or someother admin of POLO through their IRC chat

I'm waiting reply since 27 days.
I've been pushing my ticket via moderator more than 6+ times. They are literally having fun of me.
That's why I wanted to share this review to show the irresponsability of their team.

Do you have some proof regarding the above statement, If you can provide that we do need to be more cautions while using poloniex to trade. But how will such a famous site ignore their security vulnerability, Which might cause them to loose members.

Yep we had our lessons from mt gox bitfinex but we will never remember anything after the heat reduces, But as far as bitcoins and altcoins trading we have to rely on some trading platforms online.
newbie
Activity: 31
Merit: 0
October 15, 2016, 08:07:02 AM
#6
Hey !

I've been writing a security review for poloniex those last few days.
Sorry for my poor english  Embarrassed
https://www.pdf-archive.com/2016/10/15/poloniex/poloniex.pdf

Nice job you little bitch  Cheesy Cheesy Cheesy
hero member
Activity: 729
Merit: 545
October 15, 2016, 08:05:23 AM
#5
Yes, but I believe you could take this to busoni, OMK, MICKD, MOBY DICK or someother admin of POLO through their IRC chat

I'm waiting reply since 27 days.
I've been pushing my ticket via moderator more than 6+ times. They are literally having fun of me.
That's why I wanted to share this review to show the irresponsability of their team.
hero member
Activity: 546
Merit: 500
October 15, 2016, 08:02:45 AM
#4
Yes, but I believe you could take this to busoni, OMK, MICKD, MOBY DICK or someother admin of POLO through their IRC chat
Pages:
Jump to: