Quote from: realnowhereman on May 14, 2012, 09:27:02 AM

Thanks for the update.

Quote from: zhoutong on May 14, 2012, 09:16:05 AM

- Later we found out that Patrick's email server was compromised, and since he is in our mailing list, all emails sent to info@bitcoinica.com were delivered to his compromised email account.

I normally don't go in for mud slinging, but Patrick has history. This is "Patrick the self-proclaimed security expert"? This is "Patrick who released all the emails of Intersango's customer base"?

How hard is it to secure an email server? Jeez, the days of ten sendmail hacks a month are long behind us.
Again: emails are postcards; can all you supposed security experts stop treating them as if they are secure point-to-point communications? Why wasn't gpg used for these reset emails?
What raving lunatic has a password reset system going to a mailing list?
A "security expert" with a compromised email server doesn't sound good to me. In all the time he was penetration testing all the other exchanges, he couldn't have done a bit to secure his own servers?
How long has this server been compromised? Is it the Intersango email server? Have all Intersango communications been compromised too?
Is this more than just an email server? What other services were running on this compromised machine?

Quote from: zhoutong on May 14, 2012, 09:16:05 AM

- We are now working on a settlement plan. Patrick is in charge of the claim page.

You'll forgive me if, given the current situation, that that doesn't inspire me with confidence.

So much so, that I think we should all start asking for considerably more detail about how Intersango is organised internally? How much is in the hot wallet there? How is that hot wallet secured? Is Intersango VPS hosted as well? Is it Rackspace too?

We don't have control over the password reset emails. They are sent by Rackspace. Basically, if you have access to one's email, you have access to all his Rackspace servers and Cloud Files.

We use a mailing list for info@bitcoinica.com for an obvious reason, everyone of us wants to know any email sent to this address. We are registering every single web service with this email address. It's like an automatic mail forwarder that forwards to multiple recipients. It's hosted by Google Apps for Business and Patrick is the only external recipient.