Suspect #1: Linode admins/insiders | Bitcointalksearch.org

Otoh

donator

Activity: 3136

Merit: 1167

Quote from: Jered Kenna (TradeHill) on March 02, 2012, 07:57:51 AM

I'm not going to jump to any conclusions on who did it yet but I'm up to discuss possible scenarios.

I'm not a security expert so maybe someone who is could speak up. A lone employee (or 2 working together etc) might not be "Linode dropping the ball". There is always a human element and it's always the hardest to protect against. If it turns out some employee went off and did this and Linode comes clean / takes responsibility / makes it right and it wasn't easily preventable then I'll maintain my respect for them. On the other hand if someone can point out how they "really screwed up" when the facts come out please do it.
-Jered

I'm not a security expert either but I've watched many an episode of Mission Impossible & seen the Ocean's 11, then for $2k Benjies sans armes, ni haine, ni violence & the prospect of much more (or less) if they hadn't already had an ongoing peak somehow & timed it for max balances which it doesn't sound like, the MI scenario starts to sound quite plausible - get a temp job on Linode's cleaning services Co team & install key-loggers or spy-cams, a telephone sanitizer dood with smarts, most likely though borrow an admin colleague's log in details or say that yours must have been pinched & for plausible deny-ability say that you found a USB stick on the ground in the company car park one morning & foolishly plugged it in to your admin company computer out of curiosity (it had gay porn on it so you dumped it) - I wonder if he/they got more or less than they'd hoped for, anyway here's hoping that they get a nice long term inside to write a memoir on their heist & it can all be good for the inevitable The Bitcoin Story film that already has plenty of juicy Ocean's 11 type plot material

Raoul Duke

legendary

Activity: 1386

Merit: 1002

Quote from: marked on March 03, 2012, 03:02:30 PM

Quote from: Matthew N. Wright on March 03, 2012, 02:03:20 PM

I'm having trouble finding where I said he told anyone where he held his wallet....

http://help.bitcoinica.com/kb/faq/how-secure-bitcoinica-is

2nd para, 2nd sentence: "... And more importantly, we don't even operate a Bitcoin wallet, which means that hackers have nothing to steal. ..."

marked

Priceless!

Wish I also had "nothing" to steal... Roll Eyes

marked

full member

Activity: 168

Merit: 100

Quote from: Matthew N. Wright on March 03, 2012, 02:03:20 PM

I'm having trouble finding where I said he told anyone where he held his wallet....

http://help.bitcoinica.com/kb/faq/how-secure-bitcoinica-is

2nd para, 2nd sentence: "... And more importantly, we don't even operate a Bitcoin wallet, which means that hackers have nothing to steal. ..."

marked

Otoh

donator

Activity: 3136

Merit: 1167

Quote from: Matthew N. Wright on March 02, 2012, 07:22:08 AM

Did you know that if someone breaks into your house and gets wounded by your careless arrangement of knives or something they can sue you for that in some cases? We're not talking about sanity here, we're talking about law.

Welcome to the Dark Side.

none of my intruders have sued me as yet Wink

but then none of my knives are ever carelessly arranged

though a lawyer did come round once to talk about that, he's top right

Raoul Duke

legendary

Activity: 1386

Merit: 1002

Quote from: Matthew N. Wright on March 03, 2012, 02:26:35 PM

Quote from: Raoul Duke on March 03, 2012, 02:12:26 PM

Quote from: Matthew N. Wright on March 02, 2012, 06:59:53 AM

Nothing but the payment functions need to have been hosted there. Zhou made a grave mistake by not collocating as he was advised to do by DCAO representatives when he first joined. He held the belief that there was bigger chance of outside security threats or single collocation operator trust issues than with major companies.

Are you going to tell me that when he described the part about less trust issues with major companies he didn't mentioned the company he was using? c'mon... Roll Eyes

Uhh. Yes. That's exactly what I'm telling you.

We were having a discussion related to collocation vs cloud in regards to general security for bitcoin applications.

I believe you.

Matthew N. Wright

hero member

Activity: 588

Merit: 500

Hero VIP ultra official trusted super staff puppet

Quote from: Raoul Duke on March 03, 2012, 02:12:26 PM

Quote from: Matthew N. Wright on March 02, 2012, 06:59:53 AM

Nothing but the payment functions need to have been hosted there. Zhou made a grave mistake by not collocating as he was advised to do by DCAO representatives when he first joined. He held the belief that there was bigger chance of outside security threats or single collocation operator trust issues than with major companies.

Are you going to tell me that when he described the part about less trust issues with major companies he didn't mentioned the company he was using? c'mon... Roll Eyes

Uhh. Yes. That's exactly what I'm telling you.

We were having a discussion related to collocation vs cloud in regards to general security for bitcoin applications.

Raoul Duke

legendary

Activity: 1386

Merit: 1002

Quote from: Matthew N. Wright on March 02, 2012, 06:59:53 AM

Nothing but the payment functions need to have been hosted there. Zhou made a grave mistake by not collocating as he was advised to do by DCAO representatives when he first joined. He held the belief that there was bigger chance of outside security threats or single collocation operator trust issues than with major companies.

Are you going to tell me that when he described the part about less trust issues with major companies he didn't mentioned the company he was using? c'mon... Roll Eyes

Matthew N. Wright

hero member

Activity: 588

Merit: 500

Hero VIP ultra official trusted super staff puppet

Quote from: Raoul Duke on March 03, 2012, 02:00:44 PM

Matthew, don't get mad for what I'm about to say. It's not an attack on you or your organization, it's just something that makes sense.

So, Zhoutong told you guys where he was hosting his hot wallet... Sorry to say, but that makes you(DCAO) suspects also. It's a lot easier to steal something if you know where it is exactly.
I would step out of that investigation if I was in your place.
It would be the almost perfect crime: You steal and then you "help" to try and catch the "thieves"...

I'm having trouble finding where I said he told anyone where he held his wallet....

We all knew where he was hosted (everyone in the community) though.

Also, I love being suspect. Cheesy

When you guys are ready for an interview, I'll start with the first time I ran away from home at 7.

Raoul Duke

legendary

Activity: 1386

Merit: 1002

Matthew, don't get mad for what I'm about to say. It's not an attack on you or your organization, it's just something that makes sense.

So, Zhoutong told you guys where he was hosting his hot wallet... Sorry to say, but that makes you(DCAO) suspects also. It's a lot easier to steal something if you know where it is exactly.
I would step out of that investigation if I was in your place.
It would be the almost perfect crime: You steal and then you "help" to try and catch the "thieves"...

majamalu

legendary

Activity: 1652

Merit: 1000

Quote from: cypherdoc on March 03, 2012, 11:38:33 AM

No one will insure a speculative asset like Bitcoin. Can you imagine the liability if the price spiked to 100 just before a heist?

That would not be a problem if they charge in bitcoins.

cypherdoc

legendary

Activity: 1764

Merit: 1002

No one will insure a speculative asset like Bitcoin. Can you imagine the liability if the price spiked to 100 just before a heist?

Matthew N. Wright

hero member

Activity: 588

Merit: 500

Hero VIP ultra official trusted super staff puppet

Quote from: CA Coins on March 02, 2012, 01:35:00 PM

IMHO, it would be tough to get the losses directly from the courts. Settlement is much more likely. Linode had revenue of $10 million in 2010 and looked to be growing rapidly. Bad press (servers hacked, assets lost) can cost them dearly.

Finally, someone who understand US legal precedings.

CA Coins

donator

Activity: 305

Merit: 250

IMHO, it would be tough to get the losses directly from the courts. Settlement is much more likely. Linode had revenue of $10 million in 2010 and looked to be growing rapidly. Bad press (servers hacked, assets lost) can cost them dearly.

Daily Anarchist

hero member

Activity: 614

Merit: 500

Quote from: Aggro on March 02, 2012, 01:25:21 PM

Quote from: Daily Anarchist on March 02, 2012, 01:11:05 PM

The only individuals responsible for this are the criminals themselves, be they Linode employees or not. Linode has no moral responsibility to refund the victims. However, if they do not they risk gaining a seriously bad reputation forcing others to look for a VPS that assumes responsibility for loss or theft of a client's assets. Like all things, competition will allow for a diversity in quality of services. Some VPS's will be insured against theft, others will not. Some will refund victims, others will not. If Linode chooses not to refund the victims, so be it. If you don't like that about Linode, find a VPS provider that will.

I would be very surprised if any hosting company (VPS or otherwise) will assume responsibility in the form of economical compensation for incidents like this. Every Terms and Conditions I have read from virtually every hosting company I have worked with is very clear about no compensation for damages of any kind, for any reason.

If there is enough of a demand it will happen. Sure, the VPS premiums are likely going to be a lot higher, but it can happen. What we're really talking about here is insurance. If the VPS doesn't supply the optional insurance, then individuals will have to get it themselves. Take Tradehill. They could have gotten some insurance before this situation ever happened. They could have been insured up to, what was it, 45,000 BTC? In the case they got ripped off the insurance would have kicked in, and the insurance provider would have the most interest in catching the criminal and recovering the stolen bitcoins. Now, I'm sure no CORPORATE, "legal" insurance company exists like this right now. But there is definitely a need for one. Wasn't there a poll the other day asking people what is most necessary for Bitcoin? One of the poll answers was "insurance." I didn't participate in the poll, but my answer was "insurance" when I read it. Nobody else picked that one though. Perhaps it's time for a Bitcoin insurance company to pop up, preferably one that is totally underground, i.e. not sanctioned by the government at all.

Matthew N. Wright

hero member

Activity: 588

Merit: 500

Hero VIP ultra official trusted super staff puppet

Quote from: Aggro on March 02, 2012, 01:25:21 PM

Quote from: Daily Anarchist on March 02, 2012, 01:11:05 PM

The only individuals responsible for this are the criminals themselves, be they Linode employees or not. Linode has no moral responsibility to refund the victims. However, if they do not they risk gaining a seriously bad reputation forcing others to look for a VPS that assumes responsibility for loss or theft of a client's assets. Like all things, competition will allow for a diversity in quality of services. Some VPS's will be insured against theft, others will not. Some will refund victims, others will not. If Linode chooses not to refund the victims, so be it. If you don't like that about Linode, find a VPS provider that will.

I would be very surprised if any hosting company (VPS or otherwise) will assume responsibility in the form of economical compensation for incidents like this. Every Terms and Conditions I have read from virtually every hosting company I have worked with is very clear about no compensation for damages of any kind, for any reason.

That has its limitations. You can't have employees working at your company willfully stealing things from customers and saying "woops! You agreed! haha".

There needs to be an investigation and it's something Zhou, Slush, and the proposed attorney will be discussing over the next few days.

Aggro

donator

Activity: 296

Merit: 250

Quote from: Daily Anarchist on March 02, 2012, 01:11:05 PM

The only individuals responsible for this are the criminals themselves, be they Linode employees or not. Linode has no moral responsibility to refund the victims. However, if they do not they risk gaining a seriously bad reputation forcing others to look for a VPS that assumes responsibility for loss or theft of a client's assets. Like all things, competition will allow for a diversity in quality of services. Some VPS's will be insured against theft, others will not. Some will refund victims, others will not. If Linode chooses not to refund the victims, so be it. If you don't like that about Linode, find a VPS provider that will.

I would be very surprised if any hosting company (VPS or otherwise) will assume responsibility in the form of economical compensation for incidents like this. Every Terms and Conditions I have read from virtually every hosting company I have worked with is very clear about no compensation for damages of any kind, for any reason.

Matthew N. Wright

hero member

Activity: 588

Merit: 500

Hero VIP ultra official trusted super staff puppet

Quote from: Daily Anarchist on March 02, 2012, 01:19:50 PM

Quote from: Matthew N. Wright on March 02, 2012, 01:14:01 PM

Quote from: Daily Anarchist on March 02, 2012, 01:11:05 PM

The only individuals responsible for this are the criminals themselves

I'm sorry, are you a circuit court judge? Why don't you let people who understand the laws better make such statements?

I'm not talking about a government law. I'm talking about principle. You're talking to an anarchist, somebody who has zero respect for the government and its definitions of right and wrong.

Oh, okay. Please carry on then. ^_^

Daily Anarchist

hero member

Activity: 614

Merit: 500

Quote from: Matthew N. Wright on March 02, 2012, 01:14:01 PM

Quote from: Daily Anarchist on March 02, 2012, 01:11:05 PM

The only individuals responsible for this are the criminals themselves

I'm sorry, are you a circuit court judge? Why don't you let people who understand the laws better make such statements?

I'm not talking about a government law. I'm talking about principle. You're talking to an anarchist, somebody who has zero respect for the government and its definitions of right and wrong.

Matthew N. Wright

hero member

Activity: 588

Merit: 500

Hero VIP ultra official trusted super staff puppet

Quote from: Daily Anarchist on March 02, 2012, 01:11:05 PM

The only individuals responsible for this are the criminals themselves

I'm sorry, are you a circuit court judge? Why don't you let people who understand the laws better make such statements?

Daily Anarchist

hero member

Activity: 614

Merit: 500

The only individuals responsible for this are the criminals themselves, be they Linode employees or not. Linode has no moral responsibility to refund the victims. However, if they do not they risk gaining a seriously bad reputation forcing others to look for a VPS that assumes responsibility for loss or theft of a client's assets. Like all things, competition will allow for a diversity in quality of services. Some VPS's will be insured against theft, others will not. Some will refund victims, others will not. If Linode chooses not to refund the victims, so be it. If you don't like that about Linode, find a VPS provider that will.

Topic: Suspect #1: Linode admins/insiders (Read 4785 times)