Ninjastic
PostEdited versionsQuotes to this post
Post
Topic
Board Speculation
Re: Wall Observer BTC/USD - Bitcoin price movement tracking & discussion
by
edwardspitz
on 03/05/2014, 22:27:03 UTC
Quote from: seldon on May 03, 2014, 09:54:29 PM
Quote from: soullyG on May 03, 2014, 09:37:38 PM
Looks like someone tried to hack LocalBitcoins:

Quote
LocalBitcoins received a very dangerous attack against the site infrastructure on Saturday 3.5.2014.
For now
  • All user data and Bitcoins are safe;
  • The site will be down for a while as the system is being rebuilt

Details
LocalBitcoins hosting provided received a request to restart the LocalBitcoins.com website server and give access to the server console (root) on Sat May 3 13:32:27. LocalBitcoins team did not initiate this request. For now, it looks like the request was made using spoofed email addresses and other weakness in the hosting provider support system.
  • LocalBitcoins team was alerted about the abnormal activity when the hosting provider restarted the server.
  • The attacker gained a root access to the server for ~40 minutes before the attacker was kicked out and the server shutdown.
  • All data on the website server is encrypted. Manual actions are needed to make this data readable, so the attacker could not gain access to the data even when having a server console access.
It is very unlikely that the attacker gained access to any data;  LocalBitcoins is still performing full investigation on the matter.
  • Bitcoins in hot wallet and cold wallet are safe, as LocalBitcoins runs its bitcoind and wallets on a separate server.
  • LocalBitcoins team has started to rebuild the website server on fresh hardware.
LocalBitcoins team will make further announcements when the investigation proceeds and the site becomes available again.  We expect to spend at least 24 hours on this. LocalBitcoins team apologizes the issues the downtime may cause to the users.

It sounds like the localbitcoin guys did everything right. Anyways, it is incredible, that people are still able to pull the "reboot my server please" attack in 2014..

I don't mean to scare people, but if the attacker gained root access the attack was not just a (failed) hacking attempt but really serious. I doubt that everything was encrypted on the server, so the attacker may have had time to gain valuable insight into their systems that could be used for future exploits. I think it is good that Localbitcoins are being open about it, and it sounds like they are on top of the situation. But if the attacker has had a peek into their code it could be a bit of a nightmare for their security team.