Possible false alarm: MtGox break in - page 2.

DiabloD3

legendary

Activity: 1162

Merit: 1000

DiabloMiner author

Quote from: mrb on September 13, 2011, 02:41:22 AM

Quote from: hightax on September 13, 2011, 02:22:39 AM

Forging a SSL cert only enables the possibility of a man-in-the-middle attack from being transparently obvious when it's no longer signed properly. However, you still have to accept the change in certificate for the forged-SSL MIM attack to work. Did you log in to MtGox from strange internet connections in shady places? Or did MtGox get their DNS forged as well?

No, a forged cert from DigiNotar would allow to transparently execute a MiTM attack against an end-user, without her seeing any security warning whatsoever. Except in 1 scenario, see below...

Quote from: kjj

Is there actually a browser that will remember a certificate and complain if that cert is replaced with a different valid CA-signed cert?

...only 1 browser would warn you: Chrome, because Google hard-coded hashes of the public keys for a small number of high-profile websites certificates keys. This is called public key pinning.

Mozilla is considering pinning keys on first site access. So the only way to MITM false certs is during the first access (which makes it same to ssh's flaw on server fingerprint (aka ~/.ssh/known_hosts)).

DigiNotar is a clusterfuck, regardless.

DiabloD3

legendary

Activity: 1162

Merit: 1000

DiabloMiner author

Quote from: hightax on September 13, 2011, 02:22:39 AM

Quote from: DiabloD3 on September 12, 2011, 10:24:38 PM

I also do not think it is likely the recent DigiNotar or Globalsign break ins have produced SSL certs to attack mtgox with (which WOULD explain this) because mtgox uses EV certs and as far as I know none of the fake certs were for EV, but DigiNotar and Globalsign both DO issue EV certs. Although I am not ruling this out.

Forging a SSL cert only enables the possibility of a man-in-the-middle attack from being transparently obvious when it's no longer signed properly. However, you still have to accept the change in certificate for the forged-SSL MIM attack to work. Did you log in to MtGox from strange internet connections in shady places? Or did MtGox get their DNS forged as well?

The problem is you DONT need to accept the cert since its signed by a CA. Thats why this was so dangerous. All you need is someone at Tux's ISP juping the traffic and bam MITM attack and no one is the wiser.

makomk

hero member

Activity: 686

Merit: 564

Quote from: DiabloD3 on September 12, 2011, 10:24:38 PM

Tux has replaced the missing BTC.

That's unusual. He didn't even do that for people whose accounts were compromised in circumstances suggesting it was due to the password database being extracted by hackers...

mrb

legendary

Activity: 1512

Merit: 1028

Quote from: hightax on September 13, 2011, 02:22:39 AM

Forging a SSL cert only enables the possibility of a man-in-the-middle attack from being transparently obvious when it's no longer signed properly. However, you still have to accept the change in certificate for the forged-SSL MIM attack to work. Did you log in to MtGox from strange internet connections in shady places? Or did MtGox get their DNS forged as well?

No, a forged cert from DigiNotar would allow to transparently execute a MiTM attack against an end-user, without her seeing any security warning whatsoever. Except in 1 scenario, see below...

Quote from: kjj

Is there actually a browser that will remember a certificate and complain if that cert is replaced with a different valid CA-signed cert?

...only 1 browser would warn you: Chrome, because Google hard-coded hashes of the public keys for a small number of high-profile websites certificates keys. This is called public key pinning.

kjj

legendary

Activity: 1302

Merit: 1026

Quote from: hightax on September 13, 2011, 02:22:39 AM

Quote from: DiabloD3 on September 12, 2011, 10:24:38 PM

I also do not think it is likely the recent DigiNotar or Globalsign break ins have produced SSL certs to attack mtgox with (which WOULD explain this) because mtgox uses EV certs and as far as I know none of the fake certs were for EV, but DigiNotar and Globalsign both DO issue EV certs. Although I am not ruling this out.

Forging a SSL cert only enables the possibility of a man-in-the-middle attack from being transparently obvious when it's no longer signed properly. However, you still have to accept the change in certificate for the forged-SSL MIM attack to work. Did you log in to MtGox from strange internet connections in shady places? Or did MtGox get their DNS forged as well?

Is there actually a browser that will remember a certificate and complain if that cert is replaced with a different valid CA-signed cert?

stergium

hero member

Activity: 655

Merit: 500

Quote from: DiabloD3 on September 12, 2011, 01:05:03 PM

It seems Mt Gox has been broken into again. My account was just liquidated and send to a foreign address, the IP of which seems to be in the Ukraine. I assume I was targeted because I'm a Bitcoin developer.

Since I use Linux and use unique high entropy passwords, I am ruling out any nonsense like local trojans.

Everyone: Clear out your accounts if you have anything in them.

again?
http://www.youtube.com/watch?v=TVpkIuutIqw
they seem to have more holes than a sponge...
and the bitcointalk incident these days..
ppl should implement temporary accounts..

hightax

newbie

Activity: 42

Merit: 0

Quote from: DiabloD3 on September 12, 2011, 10:24:38 PM

I also do not think it is likely the recent DigiNotar or Globalsign break ins have produced SSL certs to attack mtgox with (which WOULD explain this) because mtgox uses EV certs and as far as I know none of the fake certs were for EV, but DigiNotar and Globalsign both DO issue EV certs. Although I am not ruling this out.

Forging a SSL cert only enables the possibility of a man-in-the-middle attack from being transparently obvious when it's no longer signed properly. However, you still have to accept the change in certificate for the forged-SSL MIM attack to work. Did you log in to MtGox from strange internet connections in shady places? Or did MtGox get their DNS forged as well?

phillipsjk

legendary

Activity: 1008

Merit: 1001

Let the chips fall where they may.

Quote from: cypherdoc on September 13, 2011, 12:27:51 AM

Quote from: fastandfurious on September 12, 2011, 11:57:01 PM

When you understand Economics 101, come back and I promise you we can continue this discussion.

you're an arrogant ass. educate me now.

In MicroEconomics, you make several 'reasonable' assumptions, including:

Rational Market participants
The price system is a good way to communicate efficiency
Easy entry and exit in the market place

I think fastandfurious is arguing that if Mt.Gox can't cover their costs, they will leave the market. Of course, by the same argument, competitors less "inefficient" should be able to enter the market and undercut the Mt.Gox fees. The easy entry and exit assumption assumes captical costs don't exist (or that they are ammortized perfectly).

mrb

legendary

Activity: 1512

Merit: 1028

Quote from: DiabloD3 on September 12, 2011, 10:24:38 PM

After a lengthy conversation with MagicTux, unless it does turn up that mtgox has been hacked, neither of us can figure out what happened. Its obviously not me and I didn't fall for a phishing expedition, and Im pretty sure its not on his end. His description of security on the new post-hack mtgox is pretty decent. Its not perfect, but he has gone to great lengths to prevent a repeat.

Your compromise may be linked to a huge mystery that was never solved during the MtGox hack of June 19, 2011: many supremely strong passwords were cracked, but no one, not even Mark Karpelès, knows how it happened. One of the theories I posted in this comment is that the MtGox infrastructure has been deeply compromised, and attackers still have access to it. (I hope this is not true.)

If not that, I know that we, security-conscious people, like to think it would never happen to us, but you may have fallen to sophisticated targeted attack. There are occurrences of paranoiac security guys who do get compromised. For example even if your Linux workstation is relatively secure and updated, all it would take to compromise you is a Flash 0-day and to entice you to visit a malicious site. You may say you won't fall for it, but you do it all the time: you hang in #bitcoin-mining, someone posts a URL, you click on it. Bam! User-level X11 keylogger now running on your fully patched Linux machine. Flash is by far the scariest client-side attack vector these days...

WiseOldOwl

full member

Activity: 238

Merit: 100

Quote from: phillipsjk on September 12, 2011, 11:55:22 PM

Quote from: DiabloD3 on September 12, 2011, 01:05:03 PM

Since I use Linux and use unique high entropy passwords, I am ruling out any nonsense like local trojans.

I'm not so sure you can completely rule those out. Last month kernel.org was compromized. In order to compromise the kernel, several developement machines would need to be compromized as well. Which is about as unlikely as Intel installing a back-door in one of their chips. Note: I think that 'Intel Insider' is probably just a modified version of DTCP with latency limits on the initial hop relaxed.

Edit: Tabnabbing looks like it may work on even sophisticated users, unless they leave JavaScript disabled.

Damn this is a bust.

cypherdoc

legendary

Activity: 1764

Merit: 1002

Quote from: fastandfurious on September 12, 2011, 11:57:01 PM

Quote from: cypherdoc on September 12, 2011, 11:53:10 PM

Quote from: fastandfurious on September 12, 2011, 11:51:12 PM

Quote from: cypherdoc on September 12, 2011, 11:48:41 PM

Quote from: fastandfurious on September 12, 2011, 11:34:53 PM

Quote from: cypherdoc on September 12, 2011, 11:30:14 PM

Quote from: fastandfurious on September 12, 2011, 11:20:28 PM

I have to say one more thing. It is not right to bail out some (because they are a staff member on Bitcoin forum etc.) ans let others that get hacked for different reasons get nothing. This sounds to me like what the Federal Reserve did and are doing today, they bailed out friends/banks with trillions of dollars of interest free/low interest money and let "Main street" take the hit.

except that the Fed uses USD it prints up out of thin air at taxpayer expense via devaluation of the USD. MagTux used his own BTC.

The principle is the same. If he just bails out some people, the others have to pay for that through higher trading fees, trading fees that in theory could have been lower because bailing out is a cost that in the end has to be taking from somewhere.

you're assuming that the tx fees will increase. how do you know that?

Study Economics 101.

Studying Economics 101 will allow me to predict that MagTux will raise his tx fees as a result of this incident?

When you understand Economics 101, come back and I promise you we can continue this discussion.

you're an arrogant ass. educate me now.

DiabloD3

legendary

Activity: 1162

Merit: 1000

DiabloMiner author

Quote from: phillipsjk on September 12, 2011, 11:55:22 PM

I'm not so sure you can completely rule this out. Last month kernel.org was compromized. In order to compromise the kernel, several developement machines would need to be compromized as well.

Yes, I'm aware of the kernel.org break in. This does not apply here as the kernel I am running predates the break in and I do not get my kernel source from kernel.org.

Mmm delicious git.

fastandfurious

full member

Activity: 224

Merit: 100

Quote from: cypherdoc on September 12, 2011, 11:53:10 PM

Quote from: fastandfurious on September 12, 2011, 11:51:12 PM

Quote from: cypherdoc on September 12, 2011, 11:48:41 PM

Quote from: fastandfurious on September 12, 2011, 11:34:53 PM

Quote from: cypherdoc on September 12, 2011, 11:30:14 PM

Quote from: fastandfurious on September 12, 2011, 11:20:28 PM

I have to say one more thing. It is not right to bail out some (because they are a staff member on Bitcoin forum etc.) ans let others that get hacked for different reasons get nothing. This sounds to me like what the Federal Reserve did and are doing today, they bailed out friends/banks with trillions of dollars of interest free/low interest money and let "Main street" take the hit.

except that the Fed uses USD it prints up out of thin air at taxpayer expense via devaluation of the USD. MagTux used his own BTC.

The principle is the same. If he just bails out some people, the others have to pay for that through higher trading fees, trading fees that in theory could have been lower because bailing out is a cost that in the end has to be taking from somewhere.

you're assuming that the tx fees will increase. how do you know that?

Study Economics 101.

Studying Economics 101 will allow me to predict that MagTux will raise his tx fees as a result of this incident?

When you understand Economics 101, come back and I promise you we can continue this discussion.

phillipsjk

legendary

Activity: 1008

Merit: 1001

Let the chips fall where they may.

Quote from: DiabloD3 on September 12, 2011, 01:05:03 PM

Since I use Linux and use unique high entropy passwords, I am ruling out any nonsense like local trojans.

I'm not so sure you can completely rule those out. Last month kernel.org was compromized. In order to compromise the kernel, several developement machines would need to be compromized as well. Which is about as unlikely as Intel installing a back-door in one of their chips. Note: I think that 'Intel Insider' is probably just a modified version of DTCP with latency limits on the initial hop relaxed.

Edit: Tabnabbing looks like it may work on even sophisticated users, unless they leave JavaScript disabled.

cypherdoc

legendary

Activity: 1764

Merit: 1002

Quote from: fastandfurious on September 12, 2011, 11:51:12 PM

Quote from: cypherdoc on September 12, 2011, 11:48:41 PM

Quote from: fastandfurious on September 12, 2011, 11:34:53 PM

Quote from: cypherdoc on September 12, 2011, 11:30:14 PM

Quote from: fastandfurious on September 12, 2011, 11:20:28 PM

I have to say one more thing. It is not right to bail out some (because they are a staff member on Bitcoin forum etc.) ans let others that get hacked for different reasons get nothing. This sounds to me like what the Federal Reserve did and are doing today, they bailed out friends/banks with trillions of dollars of interest free/low interest money and let "Main street" take the hit.

except that the Fed uses USD it prints up out of thin air at taxpayer expense via devaluation of the USD. MagTux used his own BTC.

The principle is the same. If he just bails out some people, the others have to pay for that through higher trading fees, trading fees that in theory could have been lower because bailing out is a cost that in the end has to be taking from somewhere.

you're assuming that the tx fees will increase. how do you know that?

Study Economics 101.

Studying Economics 101 will allow me to predict that MagTux will raise his tx fees as a result of this incident?

DiabloD3

legendary

Activity: 1162

Merit: 1000

DiabloMiner author

Quote from: fastandfurious on September 12, 2011, 11:51:12 PM

Quote from: cypherdoc on September 12, 2011, 11:48:41 PM

Quote from: fastandfurious on September 12, 2011, 11:34:53 PM

Quote from: cypherdoc on September 12, 2011, 11:30:14 PM

Quote from: fastandfurious on September 12, 2011, 11:20:28 PM

I have to say one more thing. It is not right to bail out some (because they are a staff member on Bitcoin forum etc.) ans let others that get hacked for different reasons get nothing. This sounds to me like what the Federal Reserve did and are doing today, they bailed out friends/banks with trillions of dollars of interest free/low interest money and let "Main street" take the hit.

except that the Fed uses USD it prints up out of thin air at taxpayer expense via devaluation of the USD. MagTux used his own BTC.

The principle is the same. If he just bails out some people, the others have to pay for that through higher trading fees, trading fees that in theory could have been lower because bailing out is a cost that in the end has to be taking from somewhere.

you're assuming that the tx fees will increase. how do you know that?

Study Economics 101.

Thats assuming tx fees are not already set high enough to cover projected fraud issues.

DiabloD3

legendary

Activity: 1162

Merit: 1000

DiabloMiner author

Quote from: kjj on September 12, 2011, 11:48:31 PM

Quote from: DiabloD3 on September 12, 2011, 11:28:01 PM

Quote from: phantomcircuit on September 12, 2011, 10:42:15 PM

I believe that fraudulent EV certificates were issued.

For reasons unrelated to this, I would like to have this citation notated.

I only found one useful article that mentions that EVSSL may have been included in the breach.

http://isc.sans.edu/diary.html?storyid=11500

I'm assuming that you and MagicalTux checked the IPs used on your account. Anything strange there?

See the third post, MtGox emails you the IP that made the request on withdraws.

fastandfurious

full member

Activity: 224

Merit: 100

Quote from: cypherdoc on September 12, 2011, 11:48:41 PM

Quote from: fastandfurious on September 12, 2011, 11:34:53 PM

Quote from: cypherdoc on September 12, 2011, 11:30:14 PM

Quote from: fastandfurious on September 12, 2011, 11:20:28 PM

I have to say one more thing. It is not right to bail out some (because they are a staff member on Bitcoin forum etc.) ans let others that get hacked for different reasons get nothing. This sounds to me like what the Federal Reserve did and are doing today, they bailed out friends/banks with trillions of dollars of interest free/low interest money and let "Main street" take the hit.

except that the Fed uses USD it prints up out of thin air at taxpayer expense via devaluation of the USD. MagTux used his own BTC.

The principle is the same. If he just bails out some people, the others have to pay for that through higher trading fees, trading fees that in theory could have been lower because bailing out is a cost that in the end has to be taking from somewhere.

you're assuming that the tx fees will increase. how do you know that?

Study Economics 101.

DiabloD3

legendary

Activity: 1162

Merit: 1000

DiabloMiner author

Quote from: cypherdoc on September 12, 2011, 11:47:55 PM

i would suggest you change the title of this thread to something much less ominous. you're scaring people.

Changed. But until me or Tux can figure out what exactly happened, the issue remains open.

cypherdoc

legendary

Activity: 1764

Merit: 1002

Quote from: fastandfurious on September 12, 2011, 11:34:53 PM

Quote from: cypherdoc on September 12, 2011, 11:30:14 PM

Quote from: fastandfurious on September 12, 2011, 11:20:28 PM

I have to say one more thing. It is not right to bail out some (because they are a staff member on Bitcoin forum etc.) ans let others that get hacked for different reasons get nothing. This sounds to me like what the Federal Reserve did and are doing today, they bailed out friends/banks with trillions of dollars of interest free/low interest money and let "Main street" take the hit.

except that the Fed uses USD it prints up out of thin air at taxpayer expense via devaluation of the USD. MagTux used his own BTC.

The principle is the same. If he just bails out some people, the others have to pay for that through higher trading fees, trading fees that in theory could have been lower because bailing out is a cost that in the end has to be taking from somewhere.

you're assuming that the tx fees will increase. how do you know that?

and the principle is totally different.

Topic: Possible false alarm: MtGox break in - page 2. (Read 15376 times)