VIRCUREX - page 3. | Bitcointalksearch.org

eramus

newbie

Activity: 27

Merit: 0

Quote from: Kumala on January 11, 2013, 01:58:42 PM

It's been a couple of stressful hours here.

No we did not switch servers, we:
- applied the Ruby Rails patch
- backed up all log files for further analysis
- log files show the XML code injection, we validated all triggered commands to ensure nothing other than withdrawing funds (e.g. backdoor) was done.

2AM here, will need to catch some sleep, mistakes are easily made when being too tired.

This seems like a terrible plan of action. Your server could still be compromised, but site actions have been restored? Why is your wallet easily accessible by your web server?

finkleshnorts

sr. member

Activity: 336

Merit: 250

I'm not sure if I feel worse for bitcoin, vicurex, the people with funds there, or ruby on rails.

kiba

legendary

Activity: 980

Merit: 1014

DId you hold ALL your money in cold wallets?

mc_lovin

legendary

Activity: 1190

Merit: 1000

www.bitcointrading.com

Total value lost in the heist?

Sorry for your loss indeed. Sucks that the vulnerability was in rails and not in your app.

Kumala

hero member

Activity: 525

Merit: 500

It's been a couple of stressful hours here.

No we did not switch servers, we:
- applied the Ruby Rails patch
- backed up all log files for further analysis
- log files show the XML code injection, we validated all triggered commands to ensure nothing other than withdrawing funds (e.g. backdoor) was done.

2AM here, will need to catch some sleep, mistakes are easily made when being too tired.

davout

legendary

Activity: 1372

Merit: 1007

1davout

Quote from: Kumala on January 11, 2013, 01:05:41 PM

Service restored: deposits, trading and withdrawals are working again

Did you switch servers ?

Atruk

hero member

Activity: 700

Merit: 500

Kumala

hero member

Activity: 525

Merit: 500

Service restored: deposits, trading and withdrawals are working again

For the time being, some restrictions apply until we have sorted out the account details and validated data integrity.

	Trading	Deposits	Withdrawals
BTC	Active	Active	On hold
NMC	Active	Active	On hold
LTC	Active	Active	On hold
DVC	Active	Active	Active
SC	Active	Active	On hold
IXC	Active	Active	Active
PPC	Active	Active	Active
USD	Active	Active	Active
EUR	Active	Active	Active

makomk

hero member

Activity: 686

Merit: 564

Quote from: thebaron on January 11, 2013, 11:10:11 AM

Exploit released yesterday, eh? How convenient...

Bit slow of the attacker. I was actually half-expecting someone to start hacking Bitcoin sites before any exploit was even publicly released.

davout

legendary

Activity: 1372

Merit: 1007

1davout

Quote from: thebaron on January 11, 2013, 11:10:11 AM

Exploit released yesterday, eh? How convenient...

It's the truth.

davout

legendary

Activity: 1372

Merit: 1007

1davout

Quote from: ?? on ??

Ouch, good luck with it. Bitcoin central's down too, looks like someone's being a pain in the ass.

That's just scheduled maintenance

We deployed the fixes within five minutes after receiving the notification from the Rails security mailing list.

Kumala

hero member

Activity: 525

Merit: 500

Before the wild speculations beginn, the service will be recovered and we pay the losses out of our own pockets.

thebaron

sr. member

Activity: 434

Merit: 250

Exploit released yesterday, eh? How convenient...

ripper234

legendary

Activity: 1358

Merit: 1003

Ron Gross

Quote from: Kumala on January 11, 2013, 09:58:50 AM

Further update: The system was not breached, no passwords were compromised (they are salted and multiple times hashed anyways). The attacker used a RubyOnRails vulnerability that was released yesterday (http://www.exploit-db.com/exploits/24019/) to withdraw the funds therefore.

Sorry for your lose.

Amm ... the RoR volnurability was posted to multiple large forums, including Slashdot.

Did the attacker see the announcement before you were able to realize it affects you and shut off your systems? How come you missed it for so long that you didn't shut your stuff off / upgrade in time?

Kumala

hero member

Activity: 525

Merit: 500

Further update: The system was not breached, no passwords were compromised (they are salted and multiple times hashed anyways). The attacker used a RubyOnRails vulnerability that was released yesterday (http://www.exploit-db.com/exploits/24019/) to withdraw the funds therefore.

Endgame

sr. member

Activity: 412

Merit: 250

Sorry to hear that. How bad is the loss? Will users be out of pocket, or can vircurex cover it?

John (John K.)

legendary

Activity: 1288

Merit: 1226

Away on an extended break

Posted an announcement regarding this at Important Announcements subforum.

Kumala

hero member

Activity: 525

Merit: 500

We sadly need to announce that our wallet has been compromised thus DO NOT send any further funds to any of the coin wallets, BTC, DVC, LTC, etc. We will setup a new wallet and reset all the addresses. This will most likely take the whole weekend.

Topic: VIRCUREX - page 3. (Read 64667 times)