Topic: Poloniex security review (Read 6577 times)
Polo are crooks!!!
For informations : https://www.reddit.com/r/PoloniexForum/comments/6t4tvs/i_managed_to_bypass_2fa_and_email_verification_is/
That's a very concerning thread. The most interesting comment was the following:
https://www.reddit.com/r/PoloniexForum/comments/6t4tvs/i_managed_to_bypass_2fa_and_email_verification_is/dlits1b/
Quote
The Poloniex database wasn't leaked. I found a user reusing credentials from another leaked database that had already been cracked. The user had 2FA, and I managed to use an exploit to make it useless, and another bug caused their email client to verify the transaction by just opening the confirmation email (due to improperly configured robots.txt).
Don't re-use passwords, people. Make a new 14 character password for every site you use.
Also, the email exploit where the email was being confirmed without clicking was an Outlook email. If you use Outlook, change your email to something else.
as long as trading in polo its good exchange
waiting for ICN go to there
waiting for ICN go to there
add a #Cloakcoin coin we requested a so many times
Umm... so polo has been hacked before, they raised security measures and repaid the users who lost funds. It has been over a year since then and the staff (both behind the scenes and in the TB) have grown significantly.
You would think that with their history and man power, they would have security pretty tight. The only vulnerabilities I see are "user-error" in which some dumb-ass (either mod or user) makes a mistake. Even if an attacker managed to send withdraw requests, the coins are (from what I remember) in cold storage and you need 2fa or email confirm to do a full withdraw.
You would think that with their history and man power, they would have security pretty tight. The only vulnerabilities I see are "user-error" in which some dumb-ass (either mod or user) makes a mistake. Even if an attacker managed to send withdraw requests, the coins are (from what I remember) in cold storage and you need 2fa or email confirm to do a full withdraw.
you need to take into consideration the volume of a year ago and the volume of today. its a huge difference.
Ah, I missed the "Referer" part. In that specific case GET is worse then yeh.
Quote
I was able to spread clickable buying, selling, withdraw and lending links. Sorry, but I think it is a serious vulnerability don't you ?
Is this really true though?First of all there is barely a difference between GET and POST. If there is a CSRF vulnerability, an attacker can abuse it. Although GET might make the attacks slightly more practical, one could still make a simple HTML form on another domain/site (auto-submit with JS) and just send the parameters through there.. equally vulnerable (can be all in hidden iframe on legitimate looking page too.) I always use the following code for proof of concepts:
Code:
The real fix is using CSRF tokens. However, I am getting the impression that they are still verifying the request by the header "X-Requested-With: XMLHttpRequest" (as seen in your screenshot too.) This can only be made from an AJAX request on the same domain. Therefor it wouldn't be possible as clickable link on same domain, nor any link/form/etc on another domain. Did you try making a request without that request header?
The reason why CSRF tokens are superior is because there has been some browser/Flash vulnerabilities where they didn't fully respect CORS (and allowed to make request with those X- headers.) But still if they verify that "X-Requested-With" header properly, I don't think it's fair to call it a vulnerability.
Overall it seems like the PDF is a bit exaggerated IMO
The 0.2 BTC bounty does seem very low though. I understand that an open-redirect vulnerability isn't very crucial, but for a site like Poloniex it does seem very important. The "toString" thing is a very nice trick, I never realized that 
so thanks for sharing that.Your wrong, they aren't equally vulnerable. As a matter of fact, it wouldn't have been possible to do the attack I described if they were using POST.
They are not verifying the header X-Requested-With: XMLHttpRequest as you supposed. They check for the Referer header (poloniex.com), which only allow an attack via trollbox link (so again, it isn't possible with post)
Glad to see my reports learnt you some security things btw :p
Quote
I was able to spread clickable buying, selling, withdraw and lending links. Sorry, but I think it is a serious vulnerability don't you ?
Is this really true though?First of all there is barely a difference between GET and POST. If there is a CSRF vulnerability, an attacker can abuse it. Although GET might make the attacks slightly more practical, one could still make a simple HTML form on another domain/site (auto-submit with JS) and just send the parameters through there.. equally vulnerable (can be all in hidden iframe on legitimate looking page too.) I always use the following code for proof of concepts:
Code:
The real fix is using CSRF tokens. However, I am getting the impression that they are still verifying the request by the header "X-Requested-With: XMLHttpRequest" (as seen in your screenshot too.) This can only be made from an AJAX request on the same domain. Therefor it wouldn't be possible as clickable link on same domain, nor any link/form/etc on another domain. Did you try making a request without that request header?
The reason why CSRF tokens are superior is because there has been some browser/Flash vulnerabilities where they didn't fully respect CORS (and allowed to make request with those X- headers.) But still if they verify that "X-Requested-With" header properly, I don't think it's fair to call it a vulnerability.
Overall it seems like the PDF is a bit exaggerated IMO
The 0.2 BTC bounty does seem very low though. I understand that an open-redirect vulnerability isn't very crucial, but for a site like Poloniex it does seem very important. The "toString" thing is a very nice trick, I never realized that so thanks for sharing that. Poloniex is safe according to their post on reddit.
They were unlucky that I didn't release all the vulnerability in one row.
Oups ! goo.gl/xcbG5G
They were unlucky that I didn't release all the vulnerability in one row.
Oups ! goo.gl/xcbG5G
This open url vulnerability just got patched. But well, it was just another proof that Polo wasn't safe, even after the reddit post.
Poloniex is safe according to their post on reddit.
They were unlucky that I didn't release all the vulnerability in one row.
Oups ! goo.gl/xcbG5G
They were unlucky that I didn't release all the vulnerability in one row.
Oups ! goo.gl/xcbG5G
Somebody exploit the vulnerabilities yet?
I need an exchange to collapse to get more cheap coins.
I need an exchange to collapse to get more cheap coins.
I can't argue on the matter as I'm not a coder.
I think we've crossed streams here.
Nah, all is good.
Polo has been decent in their response, and I think take it all seriously but OP raised proper points and has gotten his 0.2 btc bounty for pointing out a 200 btc problem.
As long as companies don't take these things seriously there'll always be incentive for good people to do the wrong thing.
For all the bad PR that's come up, polo should actually be grateful for this guy, he did good.
As long as companies don't take these things seriously there'll always be incentive for good people to do the wrong thing.
For all the bad PR that's come up, polo should actually be grateful for this guy, he did good.
I agree on everything, but the decent part (well, I may add the size of the bounty, giving the fact that Poloniex is operating with 10s of millions $). Notice part of their response:
Quote
This same person then found another client-side exploit where he could alter the style of his Trollbox name to resemble the color of a moderator. Despite what has been falsely reported, he did not gain moderator privileges. Still, we would have considered this a bounty-worthy bug, but rather than report this to us, he decided it would be a spectacular idea to go into the Trollbox and flaunt what he had found. He was quickly banned, and a fix for this bug was implemented in a matter of minutes. Should a 'security review' of a company by an unknown, unidentifiable person be trusted without asking the question - what is his objective? Should a 'news source' that eagerly publishes the statements of a person without verifiable identity or proper vetting of his accusations be considered legitimate news?
I thought they are joking. Should that 'news source' name to be Kevin Mitnick in order to investigate the problem? It sounded like: "We are Poloniex and he is nobody".
Not cool.
I can't argue on the matter as I'm not a coder.
I think we've crossed streams here.
Polo has been decent in their response, and I think take it all seriously but OP raised proper points and has gotten his 0.2 btc bounty for pointing out a 200 btc problem.
As long as companies don't take these things seriously there'll always be incentive for good people to do the wrong thing.
For all the bad PR that's come up, polo should actually be grateful for this guy, he did good.
I can't argue on the matter as I'm not a coder.
We are arguing man? I'm in complete agreeance.
As far as it stands now.
Yes.
Yes.
You do realize that Emin Gun Siner is Associate Professor at Cornell's Computer Science Dept.? And as I said - I don't think their answer is professional. They talked against Xavier for too much and I believe they have better things to do.
As far as it stands now.
Yes.
Yes.
Their problem is that no one 'informed them first', and that is what needs to be proven.
So where's the proof.
Emails or gtfo
So where's the proof.
Emails or gtfo
You think?
https://twitter.com/el33th4xor/status/787610289369784320
Your security risk claim has been dealt with (if it was even a 'risk' to begin with...).
So was it a risk or not? That's the real question.
Polo admits that mod escalation happened, this is admitted on both reddit and btctalk by legitimate spokepeople
Their problem is that no one 'informed them first', and that is what needs to be proven.
So where's the proof.
Emails or gtfo
Umm... so polo has been hacked before, they raised security measures and repaid the users who lost funds. It has been over a year since then and the staff (both behind the scenes and in the TB) have grown significantly.
You would think that with their history and man power, they would have security pretty tight. The only vulnerabilities I see are "user-error" in which some dumb-ass (either mod or user) makes a mistake. Even if an attacker managed to send withdraw requests, the coins are (from what I remember) in cold storage and you need 2fa or email confirm to do a full withdraw.
You would think that with their history and man power, they would have security pretty tight. The only vulnerabilities I see are "user-error" in which some dumb-ass (either mod or user) makes a mistake. Even if an attacker managed to send withdraw requests, the coins are (from what I remember) in cold storage and you need 2fa or email confirm to do a full withdraw.
Your security risk claim has been dealt with (if it was even a 'risk' to begin with...).
So you rely on a post posted by the website himself ? Sure, they will say Yes, we fucked up, withdraws your coins. That's just stupid.
Again, it isn't FUD, I like to believe after that, they will consider their customers and increase security.
Umm... so polo has been hacked before, they raised security measures and repaid the users who lost funds. It has been over a year since then and the staff (both behind the scenes and in the TB) have grown significantly.
You would think that with their history and man power, they would have security pretty tight. The only vulnerabilities I see are "user-error" in which some dumb-ass (either mod or user) makes a mistake. Even if an attacker managed to send withdraw requests, the coins are (from what I remember) in cold storage and you need 2fa or email confirm to do a full withdraw.
You would think that with their history and man power, they would have security pretty tight. The only vulnerabilities I see are "user-error" in which some dumb-ass (either mod or user) makes a mistake. Even if an attacker managed to send withdraw requests, the coins are (from what I remember) in cold storage and you need 2fa or email confirm to do a full withdraw.
Not sure why POLO BOSS BUSONI is so angry on XAVIER59..
Xavier59 tried to help, report vulnerablilites and move on with the support guys.
He had to post this public only because of the support team, keep pushing the tickets in a circle
But as usual, support guys behave like dicks even in emergencies like these and take 48hrs for each reply.
I guess both XAVIER59 and BUSONI can sign a peace treaty or something!!!
Xavier59 tried to help, report vulnerablilites and move on with the support guys.
He had to post this public only because of the support team, keep pushing the tickets in a circle
But as usual, support guys behave like dicks even in emergencies like these and take 48hrs for each reply.
I guess both XAVIER59 and BUSONI can sign a peace treaty or something!!!
Xavier59 has my full support along with a huge group of concerned people who will make polo wake up and hopefully (fingers crossed) hire a decent coder. This isn't the 1990's. Wake up and smell the payload. Polo is more so as was before now in the radar of malicious users looking to get rich from this.
And I won't spoil it for you, but there are many more vulnerabilities left wide open. Do your research and get educated. Xavier isn't spreading FUD, but all those who are trying to cover this up realize they will lose money over this if polo loses clientele or memberships.
And I won't spoil it for you, but there are many more vulnerabilities left wide open. Do your research and get educated. Xavier isn't spreading FUD, but all those who are trying to cover this up realize they will lose money over this if polo loses clientele or memberships.
Answer to Poloniex reddit post : https://www.reddit.com/r/CryptoCurrency/comments/57q9gf/poloniex_is_secure_were_good/
You're totally off the mark. Never said multithreadying is a vulnerability, as well as get request. It's the way you use them wich is a vulnerability. It becomes one when multiple thread can share the same ressources at the same time.
I wonder how you can say that after what I did write in my reports. I reported you every GET request you did was easily shared with the moderator clickable link. This wouldn't be possible using POST request. Same for Open URL Vulnerability. So YES, you're using GET request in the bad way, and if you can't see that, I feel only much worried.
As I wrote, I'm not a professionnal pentester. I feel the need to test my payloads before reporting them, because I'm never sure it will work. I have been posting exactly 3 messages using the moderator client-side privilege. I wonder where you see in my article that I did a falsefy report ! Quoting me : "Taking this username will grant me moderation client privilege which includes: having my name in blue and the ability to share clickable link."
This is exactly what it did, and I specified that it was moderation client privilege only.
If you think I wrote as moderator just to be spectacular, remember that I only posted 3 messages, and then directly reported the vulnerability as suggested by the moderators.
And this is your principal mistake. Because I didn't neither I do hide myself. Some research on any search engines could easily lead you to my identify. Moreover, I would like to remind you that I shared my personnal identy with the support.
I would be very interested knowing which company did a security audit of your website ?
Btw, I'm still waiting your answer, tickets #66023. Pending since 29 days now. Tic tac tic tac ...
Quote
-- Anyone who is familiar with web services should know that multithreading, in and by itself, is not a vulnerability. In fact, it is necessary when processing more than one request at any given time. Our trading engine processes 200-300 transactions per second, and that's on a slow day.
You're totally off the mark. Never said multithreadying is a vulnerability, as well as get request. It's the way you use them wich is a vulnerability. It becomes one when multiple thread can share the same ressources at the same time.
Quote
-- For those who may be concerned with us using GET in any context: We agree that POST is best practice, and we currently use POST for sensitive information. We have plans to move more requests to POST, but in the meantime, it’s worth noting that GET is not inherently insecure and POST is not inherently secure. What matters much more is how each is used.
I wonder how you can say that after what I did write in my reports. I reported you every GET request you did was easily shared with the moderator clickable link. This wouldn't be possible using POST request. Same for Open URL Vulnerability. So YES, you're using GET request in the bad way, and if you can't see that, I feel only much worried.
Quote
-- This same person then found another client-side exploit where he could alter the style of his Trollbox name to resemble the color of a moderator. Despite what has been falsely reported, he did not gain moderator privileges. Still, we would have considered this a bounty-worthy bug, but rather than report this to us, he decided it would be a spectacular idea to go into the Trollbox and flaunt what he had found. He was quickly banned, and a fix for this bug was implemented in a matter of minutes
As I wrote, I'm not a professionnal pentester. I feel the need to test my payloads before reporting them, because I'm never sure it will work. I have been posting exactly 3 messages using the moderator client-side privilege. I wonder where you see in my article that I did a falsefy report ! Quoting me : "Taking this username will grant me moderation client privilege which includes: having my name in blue and the ability to share clickable link."
This is exactly what it did, and I specified that it was moderation client privilege only.
If you think I wrote as moderator just to be spectacular, remember that I only posted 3 messages, and then directly reported the vulnerability as suggested by the moderators.
Quote
Should a 'security review' of a company by an unknown, unidentifiable person be trusted without asking the question - what is his objective?
And this is your principal mistake. Because I didn't neither I do hide myself. Some research on any search engines could easily lead you to my identify. Moreover, I would like to remind you that I shared my personnal identy with the support.
I would be very interested knowing which company did a security audit of your website ?
Btw, I'm still waiting your answer, tickets #66023. Pending since 29 days now. Tic tac tic tac ...
Quote
but if your story is a mash-up of half-truths and inaccuracies, what are you really after?
Regardless, besides being a trader or getting good lending rates from polo (>80% p.a for me), anyone storing their coins on exchanges is asking for trouble.
Do not believe the bad news entirely but we should also be careful.
There's no current danger.
It's just a huge question mark hanging over polo, and how seriously they take security?
OP has been upfront, notified polo a month ago, got a tiny bounty for one of the issues, and they won't respond about another vulnerability despite fixing that too
That pdf would sell on the darkweb for much more than 0.2 btc. I hope people here realise that.
Keen to hear Polo response.
It is already starting coming out of the news sites in the cryptosphere.
https://www.cryptocoinsnews.com/cryptocurrency-exchange-poloniex-insecure-security-review-claims/
It would be good to choose the safer option of holding your coins in your wallet or maybe even convert back to bitcoins. If the security flaws are exploited by some other hacker that is smarter than the thread starter then panic selling of the altcoins listed in Poloniex might be possible. No one believed in the Cryptsy situation now look what happened with that exchange.
Do not believe the bad news entirely but we should also be careful.
https://www.cryptocoinsnews.com/cryptocurrency-exchange-poloniex-insecure-security-review-claims/
It would be good to choose the safer option of holding your coins in your wallet or maybe even convert back to bitcoins. If the security flaws are exploited by some other hacker that is smarter than the thread starter then panic selling of the altcoins listed in Poloniex might be possible. No one believed in the Cryptsy situation now look what happened with that exchange.
Do not believe the bad news entirely but we should also be careful.
I can assert that the OP cannot exploit any vulnerability against Poloniex that involves loss of funds
Moderator privilege escalation doesn't worry you? That's a social engineering disaster waiting to happen.
"Taking this username will grant me moderation client privilege which includes: having my name in blue and the ability to share clickable link."
As i said that's ripe to be exploited. Social engineering is one of the greatest threats. You could infect people with all sorts of malware, after that, loss of funds.
Do you also assert "OP cannot exploit any vulnerability against Poloniex that involves loss of funds"?
Because I'd say that's a straight up lie.
I can assert that the OP cannot exploit any vulnerability against Poloniex that involves loss of funds
Moderator privilege escalation doesn't worry you? That's a social engineering disaster waiting to happen.
"Taking this username will grant me moderation client privilege which includes: having my name in blue and the ability to share clickable link."
I can assert that the OP cannot exploit any vulnerability against Poloniex that involves loss of funds
Moderator privilege escalation doesn't worry you? That's a social engineering disaster waiting to happen.
When Poloniex did a code review of Vcash we performed a 3 month security audit including penetration tests and double spending tests against many assets. We personally discussed this with Tristan and made "minor" recommendations "at best". Why can we talk to Tristan yet you post this here? I can assert that the OP cannot exploit any vulnerability against Poloniex that involves loss of funds, in fact he should prove his loose and fast wording is not simply hand waving instead of Bantha fodder. 
dont worry guys, DEx are starting to make there way into the crypto world. and there will always be vulnerabilities in centralized exchanges. soon you will be able to make exchanges without worry of leaving your BTC in someone elses control and we will all be free of this worry.
Imagine the order books of BTC and other projects when we wont have to live in fear of losing our wealth to exchanges when we leave buy orders/sell orders in place.
cant wait to see the true dawn of decentralized trading!!!
Imagine the order books of BTC and other projects when we wont have to live in fear of losing our wealth to exchanges when we leave buy orders/sell orders in place.
cant wait to see the true dawn of decentralized trading!!!
This thread isn't about marketing or advertising any other exchange. It is about Poloniex and only Poloniex.
Thanks.
ok... but is there any exchanges that are proveably free of bugs, or even worse human error or manipulation... Nope.
Its time for poloniex, and all centralized exchanges to move aside so crypto can finally become what it was meant to be.
On Wall Street, Customers are protected with insurance funds and policies...
There is no way to make any exchange of any kind fully secure.
Based on crypto history...
Any rational trader must assume that Polo has roughly a 50% chance of suffering a total loss...
So if you are leaving > 10-20% of your BTC on Polo you are a hardcore gambler.
As for decentralized versus centralized exchanges...
There is some sort of fundamental law that prevents them from developing comparable liquidity...
But this is never addressed by people hyping all things decentralized.
could you please go into greater depth about the fundamental law?
I've read the .pdf and I support Xavier59. Keep it up
All arguments are valid, and while they might not be exploitable right now, they're proof of bad coding practices and should not be ignored.
All arguments are valid, and while they might not be exploitable right now, they're proof of bad coding practices and should not be ignored.
dont worry guys, DEx are starting to make there way into the crypto world. and there will always be vulnerabilities in centralized exchanges. soon you will be able to make exchanges without worry of leaving your BTC in someone elses control and we will all be free of this worry.
Imagine the order books of BTC and other projects when we wont have to live in fear of losing our wealth to exchanges when we leave buy orders/sell orders in place.
cant wait to see the true dawn of decentralized trading!!!
Imagine the order books of BTC and other projects when we wont have to live in fear of losing our wealth to exchanges when we leave buy orders/sell orders in place.
cant wait to see the true dawn of decentralized trading!!!
This thread isn't about marketing or advertising any other exchange. It is about Poloniex and only Poloniex.
Thanks.
ok... but is there any exchanges that are proveably free of bugs, or even worse human error or manipulation... Nope.
Its time for poloniex, and all centralized exchanges to move aside so crypto can finally become what it was meant to be.
On Wall Street, Customers are protected with insurance funds and policies...
There is no way to make any exchange of any kind fully secure.
Based on crypto history...
Any rational trader must assume that Polo has roughly a 50% chance of suffering a total loss...
So if you are leaving > 10-20% of your BTC on Polo you are a hardcore gambler.
As for decentralized versus centralized exchanges...
There is some sort of fundamental law that prevents them from developing comparable liquidity...
But this is never addressed by people hyping all things decentralized.
dont worry guys, DEx are starting to make there way into the crypto world. and there will always be vulnerabilities in centralized exchanges. soon you will be able to make exchanges without worry of leaving your BTC in someone elses control and we will all be free of this worry.
Imagine the order books of BTC and other projects when we wont have to live in fear of losing our wealth to exchanges when we leave buy orders/sell orders in place.
cant wait to see the true dawn of decentralized trading!!!
Imagine the order books of BTC and other projects when we wont have to live in fear of losing our wealth to exchanges when we leave buy orders/sell orders in place.
cant wait to see the true dawn of decentralized trading!!!
This thread isn't about marketing or advertising any other exchange. It is about Poloniex and only Poloniex.
Thanks.
ok... but is there any exchanges that are proveably free of bugs, or even worse human error or manipulation... Nope.
Its time for poloniex, and all centralized exchanges to move aside so crypto can finally become what it was meant to be.
dont worry guys, DEx are starting to make there way into the crypto world. and there will always be vulnerabilities in centralized exchanges. soon you will be able to make exchanges without worry of leaving your BTC in someone elses control and we will all be free of this worry.
Imagine the order books of BTC and other projects when we wont have to live in fear of losing our wealth to exchanges when we leave buy orders/sell orders in place.
cant wait to see the true dawn of decentralized trading!!!
Imagine the order books of BTC and other projects when we wont have to live in fear of losing our wealth to exchanges when we leave buy orders/sell orders in place.
cant wait to see the true dawn of decentralized trading!!!
This thread isn't about marketing or advertising any other exchange. It is about Poloniex and only Poloniex.
Thanks.
dont worry guys there will always be vulnerabilities in centralized exchanges, but DEx's are starting to make there way into the crypto world. Soon you will be able to trade without worrying about leaving your BTC in someone elses control, and will finally be free of this worry.
Imagine the order books of BTC and other projects when we wont have to live in fear of losing our wealth to exchanges when we leave buy orders/sell orders in place.
cant wait to see the true dawn of decentralized trading!!!
Imagine the order books of BTC and other projects when we wont have to live in fear of losing our wealth to exchanges when we leave buy orders/sell orders in place.
cant wait to see the true dawn of decentralized trading!!!
virustotal scan? i've some fear of these bitcointalk random links...
It is safe :
https://www.virustotal.com/en/url/536e926f2ec715ca3287356073b275d762e96dabe50d274f4c2f224cc369125e/analysis/1476545937/
It's probably safe, but virustotal isn't infallible. This warning is stickied at the top of the altcoin section. It warns that virus scans is no longer sufficient to ensure safety. There are sophisticated attacks that are undetectable, you only find out you've been hacked after you realise you've been robbed.
In the past months, malware infection attempts on this forum has become increasingly sophisticated. Below is a summary of infection techniques that I have encountered. With the most sophisticated attacks, common sense and virus scans is no longer sufficient to ensure safety.
virustotal scan? i've some fear of these bitcointalk random links...
It is safe :
https://www.virustotal.com/en/url/536e926f2ec715ca3287356073b275d762e96dabe50d274f4c2f224cc369125e/analysis/1476545937/
virustotal scan? i've some fear of these bitcointalk random links...
Quote
I did read it. You fail to mention the need for valid hash to confirm any of those actions. Why? Because it would be less sensational, I guess.
That's the point ! There is no need of valid hash to confirme those actions ! Check yourself !
Here is a capture of the complete request !
https://i.gyazo.com/0afa447c3c27f5d5076d0d8f3264fc1d.png
Since source code is client side i suggest you read up on how a "buy transaction" is done.
Code:
$("#buyForm").submit(function (event) {
event.preventDefault();
if ($("#dimmer").is(":visible"))
return $("#alertDivOK").click();
if (document.getElementById('buyAmount').value < 0.0001) {
$("#result").empty().append("Amount must be greater than 0.0001.");
showAlert();
return;
}
if (document.getElementById('buyRate').value < 0.00000001) {
$("#result").empty().append("Price must be greater than zero.");
showAlert();
return;
}
showProgressBar();
var $form = $(this),
url = '/private.php';
params = { currencyPair: currencyPair,
rate: $('#buyRate').val(),
amount: $('#buyAmount').val(),
command: (margin ? 'marginBuy' : 'buy')};
if (margin)
params['maxRate'] = $("#buyMaxRate").val() === undefined ? 0.005 : $("#buyMaxRate").val();
if (webSocketCall(params))
return true;
var posting = $.get(url, params);
posting.done(function (data) {
var content = $(data);
$("#result").empty().append(content);
showAlert();
updatePrivateInfo();
});
});
Code:
function webSocketCall(params,id){
return false;
if ('conn' in window && window.conn.readyState == 1 && 1000 in window.conn.subscriptions){
if (typeof id == "undefined")
id = ++wNonce + usid;
window.conn.send(JSON.stringify({command: "private",channel: 2000,id: id,params: params}));
return true;
} else {
return false;
}
}
Quote
The best you could hope for is that you post a link, someone click it, they have sufficient balance to make a transaction, all this before a mod catches it. The result is that the victim makes a shitty purchase. ...and that's the bug they acknowledged and paid you for. The others are nonsense.
Exactly, that's only a proof of concept. How much people could I get to click on my link ? If I have luck, I fall on someone with 100+ BTC balance, which is not that rare.
But I can also use Open URL Vulnerability, which will set the Referer as poloniex.com and redirect to the GET buying/selling request.
They never paid me neither replied to my ticket reporting this vulnerability.
Quote
I did read it. You fail to mention the need for valid hash to confirm any of those actions. Why? Because it would be less sensational, I guess.
That's the point ! There is no need of valid hash to confirme those actions ! Check yourself !
Here is a capture of the complete request !
Quote
I did read it. You fail to mention the need for valid hash to confirm any of those actions. Why? Because it would be less sensational, I guess.
That's the point ! There is no need of valid hash to confirme those actions ! Check yourself !
Here is a capture of the complete request !
Well written FUD, none of those are actual vulnerabilities. They probably stopped responding to you because this is complete nonsense.
Could you please tell me where is the nonsense ? Where is the FUD ? Please quote me where I'm wrong and arguments.
You should really consult security pentester. They will all agree with my arguments.
As a matter of fact, I described a possible attack in my article, which, when I got the trollbox moderator privilege escalation (which wasn't mush of a security risk ? lol ?), I was able to spread clickable buying, selling, withdraw and lending links. Sorry, but I think it is a serious vulnerability don't you ?
Don't you think I deserved, not a bounty, but maybe something like a ... reply ? "Thanks, we've corrected this bug, rest assure you can trade on Poloniex safety" ? It is the strict minimum.
I do not expect any bounty from poloniex, your theory of the conspiracy sounds a little too much.
Proof of concept links, you wouldn't have had valid hashes.
"..what is your goal from making this information public?"
That's the major problem ! There is no csrf tokens or "valid hashes" that protect those links. You should really read my paper better, or maybe my english was wrong.
My goal is to ring the alarm at the Poloniex team and expect them to have a better protection of there customers funds. This isn't FUD, a simple 4 page PDF will not destroy a big company in 1 day.
Well written FUD, none of those are actual vulnerabilities. They probably stopped responding to you because this is complete nonsense.
Could you please tell me where is the nonsense ? Where is the FUD ? Please quote me where I'm wrong and arguments.
You should really consult security pentester. They will all agree with my arguments.
As a matter of fact, I described a possible attack in my article, which, when I got the trollbox moderator privilege escalation (which wasn't mush of a security risk ? lol ?), I was able to spread clickable buying, selling, withdraw and lending links. Sorry, but I think it is a serious vulnerability don't you ?
Don't you think I deserved, not a bounty, but maybe something like a ... reply ? "Thanks, we've corrected this bug, rest assure you can trade on Poloniex safety" ? It is the strict minimum.
I do not expect any bounty from poloniex, your theory of the conspiracy sounds a little too much.
Proof of concept links, you wouldn't have had valid hashes.
"..what is your goal from making this information public?"
That's the major problem ! There is no csrf tokens or "valid hashes" that protect those links. You should really read my paper better, or maybe my english was wrong.
My goal is to ring the alarm at the Poloniex team and expect them to have a better protection of there customers funds. This isn't FUD, a simple 4 page PDF will not destroy a big company in 1 day.
Well written FUD, none of those are actual vulnerabilities. They probably stopped responding to you because this is complete nonsense.
Could you please tell me where is the nonsense ? Where is the FUD ? Please quote me where I'm wrong and arguments.
You should really consult security pentester. They will all agree with my arguments.
As a matter of fact, I described a possible attack in my article, which, when I got the trollbox moderator privilege escalation (which wasn't mush of a security risk ? lol ?), I was able to spread clickable buying, selling, withdraw and lending links. Sorry, but I think it is a serious vulnerability don't you ?
Don't you think I deserved, not a bounty, but maybe something like a ... reply ? "Thanks, we've corrected this bug, rest assure you can trade on Poloniex safety" ? It is the strict minimum.
I do not expect any bounty from poloniex, your theory of the conspiracy sounds a little too much.
Proof of concept links, you wouldn't have had valid hashes.
"..what is your goal from making this information public?"
Well written FUD, none of those are actual vulnerabilities. They probably stopped responding to you because this is complete nonsense.
Could you please tell me where is the nonsense ? Where is the FUD ? Please quote me where I'm wrong and arguments.
You should really consult security pentester. They will all agree with my arguments.
As a matter of fact, I described a possible attack in my article, which, when I got the trollbox moderator privilege escalation (which wasn't mush of a security risk ? lol ?), I was able to spread clickable buying, selling, withdraw and lending links. Sorry, but I think it is a serious vulnerability don't you ?
Don't you think I deserved, not a bounty, but maybe something like a ... reply ? "Thanks, we've corrected this bug, rest assure you can trade on Poloniex safety" ? It is the strict minimum.
I do not expect any bounty from poloniex, your theory of the conspiracy sounds a little too much.
I would actually be very interested to know if Poloniex and other sites ever did actual security auditing.
They would be foolish not to pay for this type of service,
but nothing would surprise me with these exchanges.
I actually asked a question regarding security on these exchanges a week or two ago and got zero replies in the thread lol.
No one cares about security until millions of dollars in coins go missing.
They would be foolish not to pay for this type of service,
but nothing would surprise me with these exchanges.
I actually asked a question regarding security on these exchanges a week or two ago and got zero replies in the thread lol.
No one cares about security until millions of dollars in coins go missing.
Well written FUD, none of those are actual vulnerabilities. They probably stopped responding to you because this is complete nonsense.
Could you please tell me where is the nonsense ? Where is the FUD ? Please quote me where I'm wrong and arguments.
Well written FUD, none of those are actual vulnerabilities. They probably stopped responding to you because this is complete nonsense.
Could you please tell me where is the nonsense ? Where is the FUD ? Please quote me where I'm wrong in my review and arguments a little more ...
Well written FUD, none of those are actual vulnerabilities. They probably stopped responding to you because this is complete nonsense.
Yes, but I believe you could take this to busoni, OMK, MICKD, MOBY DICK or someother admin of POLO through their IRC chat
I'm waiting reply since 27 days.
I've been pushing my ticket via moderator more than 6+ times. They are literally having fun of me.
That's why I wanted to share this review to show the irresponsability of their team.
Do you have some proof regarding the above statement, If you can provide that we do need to be more cautions while using poloniex to trade. But how will such a famous site ignore their security vulnerability, Which might cause them to loose members.
Yep we had our lessons from mt gox bitfinex but we will never remember anything after the heat reduces, But as far as bitcoins and altcoins trading we have to rely on some trading platforms online.
I can provide screen, but we cannot really consider it a proof as the source code can be edited to modify data.
I have also some e-mail that I sent to Poloniex.
Yes, but I believe you could take this to busoni, OMK, MICKD, MOBY DICK or someother admin of POLO through their IRC chat
I'm waiting reply since 27 days.
I've been pushing my ticket via moderator more than 6+ times. They are literally having fun of me.
That's why I wanted to share this review to show the irresponsability of their team.
Do you have some proof regarding the above statement, If you can provide that we do need to be more cautions while using poloniex to trade. But how will such a famous site ignore their security vulnerability, Which might cause them to loose members.
Yep we had our lessons from mt gox bitfinex but we will never remember anything after the heat reduces, But as far as bitcoins and altcoins trading we have to rely on some trading platforms online.
Hey !
I've been writing a security review for poloniex those last few days.
Sorry for my poor english
https://www.pdf-archive.com/2016/10/15/poloniex/poloniex.pdf
I've been writing a security review for poloniex those last few days.
Sorry for my poor english
https://www.pdf-archive.com/2016/10/15/poloniex/poloniex.pdf
Nice job you little bitch
Yes, but I believe you could take this to busoni, OMK, MICKD, MOBY DICK or someother admin of POLO through their IRC chat
I'm waiting reply since 27 days.
I've been pushing my ticket via moderator more than 6+ times. They are literally having fun of me.
That's why I wanted to share this review to show the irresponsability of their team.
Yes, but I believe you could take this to busoni, OMK, MICKD, MOBY DICK or someother admin of POLO through their IRC chat
Post it in public, so POLONIEX could get hacked and almost $1 Billion dollar worth of ALTS/BTC get hacked.
GOOD JOB!!!
GOOD JOB!!!
I didn't release any unfixed Poloniex vulnerability but I think that customers have to know Poloniex is unsecure and do not even reply to people reporting them vulnerability
Post it in public, so POLONIEX could get hacked and almost $1 Billion dollar worth of ALTS/BTC get hacked.
GOOD JOB!!!
GOOD JOB!!!
Hey !
I've been writing a security review for poloniex those last few days.
Sorry for my poor english
https://www.pdf-archive.com/2016/10/15/poloniex/poloniex.pdf
I've been writing a security review for poloniex those last few days.
Sorry for my poor english
https://www.pdf-archive.com/2016/10/15/poloniex/poloniex.pdf
Jump to: