Possible false alarm: MtGox break in - page 3.

kjj

legendary

Activity: 1302

Merit: 1026

Quote from: DiabloD3 on September 12, 2011, 11:28:01 PM

Quote from: phantomcircuit on September 12, 2011, 10:42:15 PM

I believe that fraudulent EV certificates were issued.

For reasons unrelated to this, I would like to have this citation notated.

I only found one useful article that mentions that EVSSL may have been included in the breach.

http://isc.sans.edu/diary.html?storyid=11500

I'm assuming that you and MagicalTux checked the IPs used on your account. Anything strange there?

cypherdoc

legendary

Activity: 1764

Merit: 1002

Quote from: DiabloD3 on September 12, 2011, 11:31:52 PM

Quote from: cypherdoc on September 12, 2011, 11:15:07 PM

Quote from: Valhalla1 on September 12, 2011, 11:00:10 PM

Quote from: DiabloD3 on September 12, 2011, 10:24:38 PM

Tux has replaced the missing BTC.

oh wow. How many BTC are we talking about here? So can I now log in to my own account from some foreign VPN or Tor, withdraw my own bitcoins and claim I was hacked and get free BTC? Or do I have to have one of those "staff" labels to qualify?

he spent 17000 BTC bailing out Bitomat. he could've just let them and their btc holders die on the vine and he would've been better off than buying a worthless exchange.

$60 USD worth. It was a trivial amount, I was more worried about a large scale attack, which doesn't seem to be underway. Its better to warn everyone instead of sit on the information. I'm glad I was the only one hit so far.

i would suggest you change the title of this thread to something much less ominous. you're scaring people.

DiabloD3

legendary

Activity: 1162

Merit: 1000

DiabloMiner author

Quote from: julz on September 12, 2011, 10:44:43 PM

Quote from: DiabloD3 on September 12, 2011, 09:34:51 PM

I notified MagicTux through his support email, and he sent back a useless form letter as a reply.

Quote

Recently there has been a large increase in the number of “phishing” attacks that have been made against the users of Mt.Gox.
...
We sincerely apologize for the inconvenience our users have suffered at the hands of phishers, and are doing all that we can to prevent further attacks in the future.

Thanks,

MtGox.com Team

I consider this a smoking gun.

What about browsing other sites whilst you are logged into mtgox?
Due to CSRF attacks - this is something you shouldn't do when you are logged in to an important account.

You can argue that the site should be fully protected against CSRF, especially as this has come up before regarding mtgox - but it's possible there is a regression in this area or even that your specific browser version is contributing to this risk.

XSRF attacks are largely difficult to perform in many cases. The problem is I would have had to visit the attacker's website at some point inside of the same environment I use to access mtgox to allow it.

fastandfurious

full member

Activity: 224

Merit: 100

Quote from: DiabloD3 on September 12, 2011, 11:30:02 PM

Quote from: fastandfurious on September 12, 2011, 11:20:28 PM

I have to say one more thing. It is not right to bail out some (because they are a staff member on Bitcoin forum etc.) ans let others that get hacked for different reasons get nothing. This sounds to me like what the Federal Reserve did and are doing today, they bailed out friends/banks with trillions of dollars of interest free/low interest money and let "Main street" take the hit.

As a supporter of Ron Paul, that is the most slanderous and insulting thing I've seen said on this message board in awhile.

As it stands, there are no other people reporting account problems. I still believe I was targeted because I'm a well known face for the Bitcoin community and a developer of software that is used in conjunction with Bitcoin frequently.

What exactly did you think was "slanderous and insulting"?

My statement is a general point o view and are not targeted on you, I don't know all the exact details of what happened in your case, but in general I think that what I stated is something that is important to think about.

DiabloD3

legendary

Activity: 1162

Merit: 1000

DiabloMiner author

Quote from: fcmatt on September 12, 2011, 11:05:44 PM

Quote from: fastandfurious on September 12, 2011, 11:03:27 PM

I can recommend everyone with a larger amount of BTC/fiat on Mt.Gox to start using a Yubikey, I really think it will make a different security-wise. If anyone can give facts that tells me it is the contrary of my thinking, please tell me.

It does appear it would stop a lot of the most common attacks that take place around here when it comes to mtgox.
Now if an attacker has control of the mysql db as well as possible write permits to the file system.. I do not think a yubikey
will matter much.

I will expand on this. If someone gains control of mtgox, the attacker can just alter logs and dbs to make it appear that users are doing it themselves with little to no evidence that the machine was broken into.

Magic hardware oracles only make it harder for attackers to attack from the perspective of the user. They are also not perfect due to lack of public third party auditing. The one RSA produces and is used by secure government and corporate facilities and was recently defeated.

tl;dr: It prevents attacks like keylogging, it doesn't prevent attacking mtgox itself.

fastandfurious

full member

Activity: 224

Merit: 100

Quote from: cypherdoc on September 12, 2011, 11:30:14 PM

Quote from: fastandfurious on September 12, 2011, 11:20:28 PM

I have to say one more thing. It is not right to bail out some (because they are a staff member on Bitcoin forum etc.) ans let others that get hacked for different reasons get nothing. This sounds to me like what the Federal Reserve did and are doing today, they bailed out friends/banks with trillions of dollars of interest free/low interest money and let "Main street" take the hit.

except that the Fed uses USD it prints up out of thin air at taxpayer expense via devaluation of the USD. MagTux used his own BTC.

The principle is the same. If he just bails out some people, the others have to pay for that through higher trading fees, trading fees that in theory could have been lower because bailing out is a cost that in the end has to be taking from somewhere.

tvbcof

legendary

Activity: 4760

Merit: 1283

Quote from: JonHind on September 12, 2011, 02:47:46 PM

This was yesterday in the MtGox IRC channel:

Quote

17:31 < kinlo> there is something wrong, how can it have gone above 10 when my sell order at 8 didn't occur?
17:31 < molecular> it didnt reall go above 10, I assume
17:31 < Ymgve> kinlo: bugs, the orders didn't happen or there was something wrong in the matching algorithm
17:32 < kinlo> MagicalTux: ?
17:32 < molecular> likely has to do with the "new currency markets"
17:32 <@MagicalTux> no
17:32 <@MagicalTux> has to do with hackers trying their best to do stuff normal people wouldn't by dropping large amounts of stolen funds/coins

...

17:35 < molecular> flushing bad orders? How do I make a "bad sell order" at 30 USD? ^^
17:35 < xelister> molecular: =)
17:35 <@MagicalTux> molecular, I blocked ~2000 accounts created most likely for the purpose of killing bitcoin on 9/11
17:35 <@MagicalTux> their trades do remain however
17:35 < molecular> MagicalTux, holy moly!
17:35 <@MagicalTux> but they cannot execute, causing weird results

I must say, it would take balls of steel to fuck with people who have stolen a large amount of money and wish to capitalize. If one does not have a pretty good sense of their dispositions and means at least. That would be a much bigger commitment to Bitcoin than I could ever muster.

DiabloD3

legendary

Activity: 1162

Merit: 1000

DiabloMiner author

Quote from: cypherdoc on September 12, 2011, 11:15:07 PM

Quote from: Valhalla1 on September 12, 2011, 11:00:10 PM

Quote from: DiabloD3 on September 12, 2011, 10:24:38 PM

Tux has replaced the missing BTC.

oh wow. How many BTC are we talking about here? So can I now log in to my own account from some foreign VPN or Tor, withdraw my own bitcoins and claim I was hacked and get free BTC? Or do I have to have one of those "staff" labels to qualify?

he spent 17000 BTC bailing out Bitomat. he could've just let them and their btc holders die on the vine and he would've been better off than buying a worthless exchange.

$60 USD worth. It was a trivial amount, I was more worried about a large scale attack, which doesn't seem to be underway. Its better to warn everyone instead of sit on the information. I'm glad I was the only one hit so far.

cypherdoc

legendary

Activity: 1764

Merit: 1002

Quote from: fastandfurious on September 12, 2011, 11:20:28 PM

I have to say one more thing. It is not right to bail out some (because they are a staff member on Bitcoin forum etc.) ans let others that get hacked for different reasons get nothing. This sounds to me like what the Federal Reserve did and are doing today, they bailed out friends/banks with trillions of dollars of interest free/low interest money and let "Main street" take the hit.

except that the Fed uses USD it prints up out of thin air at taxpayer expense via devaluation of the USD. MagTux used his own BTC.

DiabloD3

legendary

Activity: 1162

Merit: 1000

DiabloMiner author

Quote from: fastandfurious on September 12, 2011, 11:20:28 PM

I have to say one more thing. It is not right to bail out some (because they are a staff member on Bitcoin forum etc.) ans let others that get hacked for different reasons get nothing. This sounds to me like what the Federal Reserve did and are doing today, they bailed out friends/banks with trillions of dollars of interest free/low interest money and let "Main street" take the hit.

As a supporter of Ron Paul, that is the most slanderous and insulting thing I've seen said on this message board in awhile.

As it stands, there are no other people reporting account problems. I still believe I was targeted because I'm a well known face for the Bitcoin community and a developer of software that is used in conjunction with Bitcoin frequently.

Valhalla1

newbie

Activity: 51

Merit: 0

Quote from: cypherdoc on September 12, 2011, 11:15:07 PM

Quote from: Valhalla1 on September 12, 2011, 11:00:10 PM

Quote from: DiabloD3 on September 12, 2011, 10:24:38 PM

Tux has replaced the missing BTC.

oh wow. How many BTC are we talking about here? So can I now log in to my own account from some foreign VPN or Tor, withdraw my own bitcoins and claim I was hacked and get free BTC? Or do I have to have one of those "staff" labels to qualify?

he spent 17000 BTC bailing out Bitomat. he could've just let them and their btc holders die on the vine and he would've been better off than buying a worthless exchange.

so is that a 'yes' answer to my question? Awesome, everybody load up, bitcoin bailouts for all!

DiabloD3

legendary

Activity: 1162

Merit: 1000

DiabloMiner author

Quote from: phantomcircuit on September 12, 2011, 10:42:15 PM

Quote from: DiabloD3 on September 12, 2011, 10:24:38 PM

Quote from: ElectricMucus on September 12, 2011, 09:54:01 PM

-a third party is engaging in a cyberwar against bitcoin using man in the middle attacks.

After a lengthy conversation with MagicTux, unless it does turn up that mtgox has been hacked, neither of us can figure out what happened. Its obviously not me and I didn't fall for a phishing expedition, and Im pretty sure its not on his end. His description of security on the new post-hack mtgox is pretty decent. Its not perfect, but he has gone to great lengths to prevent a repeat.

Even if they dumped the password database, the passwords are sufficiently salted and hashed that it is extremely unlikely they grabbed my password first.

I also do not think it is likely the recent DigiNotar or Globalsign break ins have produced SSL certs to attack mtgox with (which WOULD explain this) because mtgox uses EV certs and as far as I know none of the fake certs were for EV, but DigiNotar and Globalsign both DO issue EV certs. Although I am not ruling this out.

DigiNotar knew about the break in for months, and I obviously have logged in since then.

Tux has replaced the missing BTC.

I believe that fraudulent EV certificates were issued.

For reasons unrelated to this, I would like to have this citation notated.

fastandfurious

full member

Activity: 224

Merit: 100

I have to say one more thing. It is not right to bail out some (because they are a staff member on Bitcoin forum etc.) ans let others that get hacked for different reasons get nothing. This sounds to me like what the Federal Reserve did and are doing today, they bailed out friends/banks with trillions of dollars of interest free/low interest money and let "Main street" take the hit.

cypherdoc

legendary

Activity: 1764

Merit: 1002

Quote from: Valhalla1 on September 12, 2011, 11:00:10 PM

Quote from: DiabloD3 on September 12, 2011, 10:24:38 PM

Tux has replaced the missing BTC.

oh wow. How many BTC are we talking about here? So can I now log in to my own account from some foreign VPN or Tor, withdraw my own bitcoins and claim I was hacked and get free BTC? Or do I have to have one of those "staff" labels to qualify?

he spent 17000 BTC bailing out Bitomat. he could've just let them and their btc holders die on the vine and he would've been better off than buying a worthless exchange.

fastandfurious

full member

Activity: 224

Merit: 100

Quote from: fcmatt on September 12, 2011, 11:05:44 PM

Quote from: fastandfurious on September 12, 2011, 11:03:27 PM

I can recommend everyone with a larger amount of BTC/fiat on Mt.Gox to start using a Yubikey, I really think it will make a different security-wise. If anyone can give facts that tells me it is the contrary of my thinking, please tell me.

It does appear it would stop a lot of the most common attacks that take place around here when it comes to mtgox.
Now if an attacker has control of the mysql db as well as possible write permits to the file system.. I do not think a yubikey
will matter much.

I understand that is not 100 % secure, nothing is. But having said that it will make it much harder if we think Mt.Gox is using a two-factor authentication plus having a secure site that together gives a very high security level. This is the way banks does it, and last I looked they are still in business.

fcmatt

legendary

Activity: 2072

Merit: 1001

Quote from: fastandfurious on September 12, 2011, 11:03:27 PM

I can recommend everyone with a larger amount of BTC/fiat on Mt.Gox to start using a Yubikey, I really think it will make a different security-wise. If anyone can give facts that tells me it is the contrary of my thinking, please tell me.

It does appear it would stop a lot of the most common attacks that take place around here when it comes to mtgox.
Now if an attacker has control of the mysql db as well as possible write permits to the file system.. I do not think a yubikey
will matter much.

fcmatt

legendary

Activity: 2072

Merit: 1001

Quote from: stsbrad on September 12, 2011, 11:03:07 PM

Quote from: Valhalla1 on September 12, 2011, 11:00:10 PM

Quote from: DiabloD3 on September 12, 2011, 10:24:38 PM

Tux has replaced the missing BTC.

oh wow. How many BTC are we talking about here? So can I now log in to my own account from some foreign VPN or Tor, withdraw my own bitcoins and claim I was hacked and get free BTC? Or do I have to have one of those "staff" labels to qualify?

+1

did the users who got hacked due to the password file being taken on mtgox and whatever else went on during that time frame get
reimbursed? Why random users and the polish exchange but not all the customers of mtgox? Hey.. i felt like piling in.

fastandfurious

full member

Activity: 224

Merit: 100

I can recommend everyone with a larger amount of BTC/fiat on Mt.Gox to start using a Yubikey, I really think it will make a different security-wise. If anyone can give facts that tells me it is the contrary of my thinking, please tell me.

stsbrad

full member

Activity: 168

Merit: 100

Brad Willman, SSCP, LTCP, MCTS,SCE,BCE

Quote from: Valhalla1 on September 12, 2011, 11:00:10 PM

Quote from: DiabloD3 on September 12, 2011, 10:24:38 PM

Tux has replaced the missing BTC.

oh wow. How many BTC are we talking about here? So can I now log in to my own account from some foreign VPN or Tor, withdraw my own bitcoins and claim I was hacked and get free BTC? Or do I have to have one of those "staff" labels to qualify?

+1

Valhalla1

newbie

Activity: 51

Merit: 0

Quote from: DiabloD3 on September 12, 2011, 10:24:38 PM

Tux has replaced the missing BTC.

oh wow. How many BTC are we talking about here? So can I now log in to my own account from some foreign VPN or Tor, withdraw my own bitcoins and claim I was hacked and get free BTC? Or do I have to have one of those "staff" labels to qualify?

Topic: Possible false alarm: MtGox break in - page 3. (Read 15376 times)