Search content
Sort by
Showing 20 of 27 results by eramus
It's been a couple of stressful hours here.
No we did not switch servers, we:
- applied the Ruby Rails patch
- backed up all log files for further analysis
- log files show the XML code injection, we validated all triggered commands to ensure nothing other than withdrawing funds (e.g. backdoor) was done.
2AM here, will need to catch some sleep, mistakes are easily made when being too tired.
This seems like a terrible plan of action. Your server could still be compromised, but site actions have been restored? Why is your wallet easily accessible by your web server?No we did not switch servers, we:
- applied the Ruby Rails patch
- backed up all log files for further analysis
- log files show the XML code injection, we validated all triggered commands to ensure nothing other than withdrawing funds (e.g. backdoor) was done.
2AM here, will need to catch some sleep, mistakes are easily made when being too tired.
Not true, when the botnet first got noticed and moved to another pool we were able to see it and exactly how many comps were hitting and how much hash power. it was surprisginly high hash for the number of comps. I do not have the info recroded down to verify so one of the pool ops would have to report, but there is a grph I'm willing to bet someone still has that showed the number of zombies hashing and what their rate was. Believe it was something on the order of 60Ghash and only a few thousand comps.......
which would probably be considered a small botnet. to back you up, the problem is not that each computer is only offering a small amount of computing power, the real problem is when they are aggregated together. 10/100s of thousands of small machines could potentially make up a large percentage of a pool. when you consider the fact that who ever is running the botnet is pulling in btc while not paying for any of resources (except software costs) for those machines and requiring only a small amount of manually effort, its looks like a very lucrative venture to point those machines at a mining pool. i have no doubts that they will get better and better about masking themselves: load balancing pools, randomly disconnecting to look like a normal user, multiple withdrawal addresses, etc. Or just flat out running their own pool -- not much could stop them.It's ironic that the users who are supposed to guarantee for the security of the network are the ones who care the least about it as long as it makes them a couple of legacy bucks.
who is designated responsibility for the security of the network? is that not up to the users to secure themselves? via securing their wallets and taking personal responsibility for third parties that they trust (pools, exchanges, etc)?Re: Someone Random Trademarked "bitcoin" : Now we can't use the term?
Keep sending those protests and this will not be granted.
^^^
When I used bnet to crack some rar password, after few days of work I noticed about 20% drop in quantity that never really recovered. And it was not worth the efforts, since the rar file contained basically crap.
Bandwidth, some bursts of activity - ok, this is not noticed by most losers. 100% CPU load might make machines too unresponsive to alert some seek for help. And if the loser is joining other networks as well, the computer in most cases is like Pentium 2 struggling with Windows Vista.
sure thing. im still pretty sure that you dont know how a botnet works.Bandwidth, some bursts of activity - ok, this is not noticed by most losers. 100% CPU load might make machines too unresponsive to alert some seek for help. And if the loser is joining other networks as well, the computer in most cases is like Pentium 2 struggling with Windows Vista.
Re: Someone Random Trademarked "bitcoin" : Now we can't use the term?
If he's trying to be a trademark troll, he'll fail hard. The moment he tries to extort money from one of us, let us know. It's easy to build a legal defense fund when we can send money near-instantaneously and anonymously. 
hahahassuming you are referring to btc as payment, there is very little about bitcoin that is near-instantaneous or anonymous.
and good luck finding a (good) lawyer that will accept only bitcoins as payment.
Botnets in my opinion is not effective miners. They mostly is CPU based and the 100% load might alert few compromised losers to reinstall computers. All other is true.
thats not how it works. they mostly rely on the fact that the user will not notice any changes (increased load, saturated bandwidth) to their computer -- typically because of user ignorance. if the first thought was to reinstall, botnets would not be in as big of use as they are today.Re: Someone Random Trademarked "bitcoin" : Now we can't use the term?
I'm surprised you guys are bothered by this. The registrant isn't going to be able to enforce the trademark, so why not save your energy and ignore him?
You really don't think that if one were established as the trademark holder on Bitcoin they couldn't cause greif for a domesticly run business that was buying, selling or trading Bitcoin?
Spending time and energy worrying about this is pointless.
Re: Someone Random Trademarked "bitcoin" : Now we can't use the term?
Is the familiar Bitcoin image properly copyrighted or trademarked?
No ... and considering someone just trademarked "bitcoin" how long before they trademark the coin image?
the end result is we're going to have stupid legal issues now rather than focusing on growing the economy.... look I found that shit and posted it here so everyone can see it... it's up to you guys to take action... all of us...
So what's the plan?
http://www.copyright.gov/help/faq/faq-general.html#mywork
Re: Someone Random Trademarked "bitcoin" : Now we can't use the term?
It has already been mentioned that the term bitcoin has been in use in the public domain long before the Trademark was filled. I don't think the TM has a leg to stand on. Also, anyone with bitcoin in a domain name should not have to worry about this TM if their name was registered and in use before the TM was created. The person with the TM should not be able to get those names that is known as "reverse domain hijacking".
It would seem that prior use is irrelevant in regards to trademark law. Everybody should reread this post: http://forum.bitcoin.org/index.php?topic=26527.msg333383#msg333383The users need to plead a case based on the term being generic and also that the bitcoin community represents a "substantial majority of the public." That is what will slow this down.
In fact the point is to create a new wallet on a secure system, then shutdown the bitcoin client, make an encrypted backup of the wallet.dat file and delete the whole thing again (the live OS, I mean)
Then regulary move funds from your 'normal' wallet to the secure one (make a payment to one of those addresses). The balance of a wallet is kept on the network, and it is not needed to keep the savings account "live".
i think this is probably the best solution and also the beauty of bitcoin. going this route, a user could leave their savings account wallet offline for X number of years. the only reason ever to load the wallet would be to make withdrawls. actually, combine this with jrwr's offline paper storage and you have a pretty secure system. it might be a lot of hoops to jump through, but it would be difficult to crack.Then regulary move funds from your 'normal' wallet to the secure one (make a payment to one of those addresses). The balance of a wallet is kept on the network, and it is not needed to keep the savings account "live".
In a couple of years, with so many coins lost this way, not sure many will be left, since bitcoins are limited to 21 million and losing coins by sending them to wrong address's will keep on happening. Anyone can make a simple mistake copying the address, even though it's easy.
Yes, it's like with cash and washing machines. So much gets destroyed, they even need to print new notes all the time!
21million will be plenty - even with lost coins. if and when bitcoin actually takes off, 1btc will be a pretty large amount. i wouldnt be surprised if day to day transactions would be <1 btc... loaf of bread: .00001 btc, pack of smokes: .0002 btc, etc. there is plenty of room to divide a single bitcoin that lost bitcoins wont really matter.
It would be nice if bitcoin would auto encrypt wallet file based on a password, which you enter every time you open bitcoin client.
but thats the problem. its not "bitcoin"'s responsibility to encrypt wallets. bitcoin is only a network for moving btc between two accounts. its the users that need to be secure about their usage. it might be nice if the apps that connect to bitcoin start to offer certain protections, but the users are the first line of defense: unique passwords everywhere, encrypted and backedup wallets and smarter, safer browsing
Re: Cracking the passwords: Don't blame the MtGox, USERS ARE STUPID
There is the fundamental economical factor in security: the more security the higher the cost for the attacker/criminal.
The fundamental question is: Is all the time and effort really worth it?
By keep adding layers of security we are elevating the costs of obtaining their reward, and once the costs are higher than the reward, the interest dissipates.
As soon as it is perceived that "it isn't worth it", the attention of the attackers will drift towards less secured sites with similar rewards (other exchanges, maybe) with lower costs (Vulnerable sites)
The potential rewards from a bitcoin exchange makes it really worth the attempt of hacking it.
But a dedicated attacker will always find a way to penetrate it if the costs are disregarded (ie. if the challenge itself is their reward/have a personal vendetta against the site/etc...)
This happens with all kind of security: both real world (locks, safes, buildings) and digital (websites, servers, networks).
As financial institution/organizations where the moolas are flowing security should be the number one priority.
You wouldn't expect a bank transporting money on bicycles, right? Or a bank depositing money in baskets instead of a safe.
It is evident that the investment on security measures are of the utmost importance in a financial institution.
That's why it is unforgivable the gross negligence of MtGox. They were focused on doing business, amassing millions of dollars and their security was a joke. They were too focused on the functionality of the site: Websockets? Great, we all appreciate it. Dwolla? Great, that is awesome. API?, bravo, excellent job. But they ignored the most vital thing: security.
What "Bitter Ender" suggests is actually pretty much standard in everywhere.
Although bruteforcing through HTTP is not really common these days, it is a very basic feature that has to be taken care of, because if you don't do it, some asshole will certainly try it. And a percentage of those assholes might succeed at it.
Using captcha to filter out simple automation is a must these days, even if there are sophisticated OCR bots out there.
Temporally suspending accounts/notifying repeated incorrect login trials, are also a very basic standard protocol in most financial sites.
Requesting a PIN number (even if you are logged in) to confirm transactions are also a standard procedure.
These measures are not really that hard to implement.
MtGox can't say that this attack wasn't preventable, it was fully preventable.
I don't bitch about their negligence, shit happens and rapid growth is hard to manage. I get that.
But to keep lying to us, making STUPID and PATHETIC excuses (Force Majeure? SRSLY?) IS UNACCEPTABLE.
A new spokesperson won't fix it, as someone suggested before.
With this move we can see their moral integrity: they are willing to keep lying to save face instead of being upfront and honest.
How can they ever expect us to trust them?
I couldnt agree more! The entire mtgox fiasco is getting ridiculous, and I really feel sorry for the users stuck in the middle The fundamental question is: Is all the time and effort really worth it?
By keep adding layers of security we are elevating the costs of obtaining their reward, and once the costs are higher than the reward, the interest dissipates.
As soon as it is perceived that "it isn't worth it", the attention of the attackers will drift towards less secured sites with similar rewards (other exchanges, maybe) with lower costs (Vulnerable sites)
The potential rewards from a bitcoin exchange makes it really worth the attempt of hacking it.
But a dedicated attacker will always find a way to penetrate it if the costs are disregarded (ie. if the challenge itself is their reward/have a personal vendetta against the site/etc...)
This happens with all kind of security: both real world (locks, safes, buildings) and digital (websites, servers, networks).
As financial institution/organizations where the moolas are flowing security should be the number one priority.
You wouldn't expect a bank transporting money on bicycles, right? Or a bank depositing money in baskets instead of a safe.
It is evident that the investment on security measures are of the utmost importance in a financial institution.
That's why it is unforgivable the gross negligence of MtGox. They were focused on doing business, amassing millions of dollars and their security was a joke. They were too focused on the functionality of the site: Websockets? Great, we all appreciate it. Dwolla? Great, that is awesome. API?, bravo, excellent job. But they ignored the most vital thing: security.
What "Bitter Ender" suggests is actually pretty much standard in everywhere.
Although bruteforcing through HTTP is not really common these days, it is a very basic feature that has to be taken care of, because if you don't do it, some asshole will certainly try it. And a percentage of those assholes might succeed at it.
Using captcha to filter out simple automation is a must these days, even if there are sophisticated OCR bots out there.
Temporally suspending accounts/notifying repeated incorrect login trials, are also a very basic standard protocol in most financial sites.
Requesting a PIN number (even if you are logged in) to confirm transactions are also a standard procedure.
These measures are not really that hard to implement.
MtGox can't say that this attack wasn't preventable, it was fully preventable.
I don't bitch about their negligence, shit happens and rapid growth is hard to manage. I get that.
But to keep lying to us, making STUPID and PATHETIC excuses (Force Majeure? SRSLY?) IS UNACCEPTABLE.
A new spokesperson won't fix it, as someone suggested before.
With this move we can see their moral integrity: they are willing to keep lying to save face instead of being upfront and honest.
How can they ever expect us to trust them?
Unfortunately, Im still a "newbie" so I cant join the discussion in the proper thread, but I thought I was going a bit crazy when I read this.
We had no intention of getting this to happen, and we have followed every industry standard to make this secure. Despite this it happened. We have learnt new things (especially that lots of people want Bitcoin to disappear).
I seriously find it hard to believe that MagicalTux was running his operation by following every industry standard. First, industry standard under whos jurisdiction? As far as I have been able to tell for the past 6 months, bitcoin is not operating under anybody's jurisidiction and mtgox certainly is not either. Second, I guarantee this kind of leak of data would not have occurred under any "industry standard" exchange. I actually really appreciate that an audit was occurring. It provides confidence to the users and bitcoin as a whole, but why was it occurring against live data? And if live data, why was access to personal user data left available. This could have been restricted without impacting a software audit. Third, no "industry standard" exchange would ever hire a security company that cannot secure itself. What background check did MagicalTux perform on this company? I would have a hard time believing this was a fluke, a first time occurrance for this "security" company. Has this company been named public? Hopefully so! I hope none of my software gets anywhere near them. Fourth, how was trading even still occurring if there were known SQL injections that were possible on the site even before the "hack" happened? How could MagicalTux allow a trusted exchange to continue running with this kind of information? Fifth, excusing a potential injection vulnerability and and trusting an "industry standard" seal of approval, how did this massive selloff continue for so long? 30mins+? Why were big flashing alarms not going off? Why was there no automated mechanism to automatically halt trading?Im not calling for a witchhunt or that there is some massive conspiracy, but MagicalTux needs to stop saying things like "no funds were stolen" and "followed every industry standard." These things are clearly not the case based on what everybody saw happen. I also think the community deserves actual, definitive answers and somebody needs to own up to it. If MagicalTux did everything in his power to secure mtgox, to insure that mtgox was secure and provided without a doubt an industry standard platofrm for the users, roll it back(!!), but if MagicalTux allowed trading to continue (which is what happened) because of negligence, all of those transactions should stick. It doesnt matter that a single person bought so much at such a low price. Every user before 'Kevin' was in on the same exact ride. $20..15..2..1...0101. If the platform allowed the trades, they should be valid. It was the negligence of the owner, maybe even the firm performing the audit, that allowed every bit of this to happen. Im not 100% clear on the timeline of the exploits and leak; were databases leaked before the audit firm? But one of two parties are responsible. I hope for MagicalTux's sake that it was the audit firm so that he can sue the pants off of them, but if this enormous account was listed in an earlier leak, I think MagicalTux is the only party responsible and has to accept because there was plenty of talk prior to the crash occurring.
if you download the source, and if your any kind of programmer. decode.cpp seems simple to work with print that thing in plain text
id suggest adding this to your howto just in case. this is an interesting idea for a sort of alternative bitcoin savings account.id like to be whitelisted too. ive lurked for several months and finally joined to jump in on the discussion about the exchanges. id like to think should qualify -- i live, sleep and work on forums everyday. a mod can pm for some verification
This about this, you print your wallet.dat and store it, and print the method of reading it
30 years down the line (BTC is still around) your kids find it, and wish to decode it,
Paper last longer then most digital medium at the moment
this is probably how i would utilize it, but i suggest also storing a copy of the program somewhere to reread it. it would be a total bummer if 30 yrs in the future the software is long gone. 30 years down the line (BTC is still around) your kids find it, and wish to decode it,
Paper last longer then most digital medium at the moment
For sure, all sections will be free, and Itll offer more sections.
as a developer who works for a company that owns tons of forums, i wish you luck! not going to lie, but you have a serious uphill battle ahead of you since this forum already has a strong user base and tons of content.your skin looks a bit depressing. I would suggest some color to brighten the mood a bit.
also, keep your number of subforums to a minimum at the start. the more you have, the more segmented your community will become. users will get bored.
edit: if it does take off, i would seriously looking into picking up the .com