Now that we know the attack vector, can we search for bitcoin related websites that were taking advantage of it?
Yess, you can start with the buttcoins website, it just advertised for a wallet stealing site.
Topic: Reports of MtGox being hacked ARE REAL (Fixed) - page 4. (Read 41607 times)
Yess, you can start with the buttcoins website, it just advertised for a wallet stealing site.
Now that we know the attack vector, can we search for bitcoin related websites that were taking advantage of it?
But I agree this is not an acceptable situation, but deal with it as adults, and remember anyone who creates a tool that can be used for mischief can also be held responsible for this.
He's been trying to get ahold of him for a week.
Both bugs are fixed now. I have just verified it.
Seconded.
I see some of you devs talking about releasing a script for the script kiddies that can be used to empty users mtGox accounts, only because you haven't been able to get hold of MagicalTux.
If you do a whois listing of mtgox.com you will find contact information, also a phone number.
Before you all go apeshit over this issue, be aware that mtGox is probably flooded with requests, so it can be difficult to get hold of them quickly.
But I agree this is not an acceptable situation, but deal with it as adults, and remember anyone who creates a tool that can be used for mischief can also be held responsible for this. It is better to try to get hold of MagicalTux or someone else at mtGox instead of trying to make the matter worse.
I feel sorry for anyone that have lost their funds, and hope everyone take proper security precations.
Edit: I see now it is claimed that the issues in question has been fixed. Good.
If you do a whois listing of mtgox.com you will find contact information, also a phone number.
Before you all go apeshit over this issue, be aware that mtGox is probably flooded with requests, so it can be difficult to get hold of them quickly.
But I agree this is not an acceptable situation, but deal with it as adults, and remember anyone who creates a tool that can be used for mischief can also be held responsible for this. It is better to try to get hold of MagicalTux or someone else at mtGox instead of trying to make the matter worse.
I feel sorry for anyone that have lost their funds, and hope everyone take proper security precations.
Edit: I see now it is claimed that the issues in question has been fixed. Good.
Both bugs are fixed now. I have just verified it.
So what this means...
If you go to another site with exploit code while you're logged into mtgox, this site can perform operations on your mtgox account.
To protect yourself, use a seperate browser for mtgox ONLY.
If you normally use firefox, install chrome and use that for mtgox. If you use chrome, install firefox.
If you use both, install a seperate copy of firefox portable if you're on windows.
If you go to another site with exploit code while you're logged into mtgox, this site can perform operations on your mtgox account.
To protect yourself, use a seperate browser for mtgox ONLY.
If you normally use firefox, install chrome and use that for mtgox. If you use chrome, install firefox.
If you use both, install a seperate copy of firefox portable if you're on windows.
for chrome, you can open mtgox in incognito-mode and that will work too, right?
nvm..
Seems to me they should take the market offline until this is fixed.
Pretty sure Mt. Gox would have legal responsibility for coins/funds lost due to the exploit.
Allowing users who haven't read this thread to lose funds is negligent.
Pretty sure Mt. Gox would have legal responsibility for coins/funds lost due to the exploit.
Allowing users who haven't read this thread to lose funds is negligent.
So the exploit has been fixed?
I have independently confirmed that MtGox has a GIGANTIC CSRF vuln that lets me empty your account.
MagicalTux, you should know better than that. Honestly.
MagicalTux, you should know better than that. Honestly.
Also confirmed. This isn't acceptable.
So they are taking my cookies? NOZ! 
Basically, when you visit their site they secretly load an iframe that contains mtgox.com. The URL of the iframe points to an XSS hole, which injects Javascript to send document.cookie (which stores your session info) to a site they own. They can then put the cookie data into their browser, and assume your session and log into mtgox.
I don't know this specific exploit but that is how it generally works.
Nope.avi.
CSRF != XSS.
XSS = put my javascript on your site
CSRF = put a form on my site that POSTs to your site, for added fun auto-submit it with JavaScript
Not sure if this is relevant, but I've noticed that TradeHill does not automatically log you out after a period of inactivity. I noticed that one morning when I hopped on my computer, I did not have to log in - I was still logged in from the night before.
So they are taking my cookies? NOZ!
Basically, when you visit their site they secretly load an iframe that contains mtgox.com. The URL of the iframe points to an XSS hole, which injects Javascript to send document.cookie (which stores your session info) to a site they own. They can then put the cookie data into their browser, and assume your session and log into mtgox.
I don't know this specific exploit but that is how it generally works.
I have independently confirmed that MtGox has a GIGANTIC CSRF vuln that lets me empty your account.
MagicalTux, you should know better than that. Honestly.
MagicalTux, you should know better than that. Honestly.
So they are taking my cookies? NOZ!
So what this means...
If you go to another site with exploit code while you're logged into mtgox, this site can perform operations on your mtgox account.
To protect yourself, use a seperate browser for mtgox ONLY.
If you normally use firefox, install chrome and use that for mtgox. If you use chrome, install firefox.
If you use both, install a seperate copy of firefox portable if you're on windows.
If you go to another site with exploit code while you're logged into mtgox, this site can perform operations on your mtgox account.
To protect yourself, use a seperate browser for mtgox ONLY.
If you normally use firefox, install chrome and use that for mtgox. If you use chrome, install firefox.
If you use both, install a seperate copy of firefox portable if you're on windows.
There's no need to install an entirely separate browser. Make a new profile, just for Mt. Gox, and run it from a shortcut like this:
firefox.exe -P "NewProfileNameHere" -no-remote
Then you can do the same for your other profile and run both at the same time, with no interaction.
Yeah, that'll work. I was trying to provide a simple solution for people who aren't techies.
So what this means...
If you go to another site with exploit code while you're logged into mtgox, this site can perform operations on your mtgox account.
To protect yourself, use a seperate browser for mtgox ONLY.
If you normally use firefox, install chrome and use that for mtgox. If you use chrome, install firefox.
If you use both, install a seperate copy of firefox portable if you're on windows.
If you go to another site with exploit code while you're logged into mtgox, this site can perform operations on your mtgox account.
To protect yourself, use a seperate browser for mtgox ONLY.
If you normally use firefox, install chrome and use that for mtgox. If you use chrome, install firefox.
If you use both, install a seperate copy of firefox portable if you're on windows.
There's no need to install an entirely separate browser. Make a new profile, just for Mt. Gox, and run it from a shortcut like this:
firefox.exe -P "NewProfileNameHere" -no-remote
Then you can do the same for your other profile and run both at the same time, with no interaction.
I want to add that phantomcircuit is an op for #bitcoin on IRC, where other folks have confirmed it as well. So don't let his mere 15 posts on the forum here dissuade you as he does speak with authority.
By the way on mtgox.com you can register names like " apple" with a space in front, separate from an account "apple". Maybe this can lead to an exploit.
Jump to: