Bitcoin Forum

Let's start by this topic:

http://forum.bitcoin.org/index.php?topic=18858.0

Then this:

http://securityforthemasses.blogspot.com/2011/06/mt-gox-db-purportedly-for-sale.html

then we've this:

Here's a lie of M'Tux, the pwds aren't salted as we now know.

by 14th someone was already attacking:


Strangely M'Tux refers "two months ago", "two months ago" was exactly when BTC started to spike there. This may mean the value of BTC went up not by real trade but because the hacker by finding USD on someone's wallet he would need to convert them to BTC in order to cash out.

The whole story stinks a bit...  >:(

got proof that it's not salted?

You've the db there...

Yes you solved the mystery, the only reason btc went up or is valued anything is because of this sundays trading gone wrong.

No seriously these conspiracies are turning out to be more spastic than usefull by the minute.

ok
4856,gruez,free.133ch@gmail.com,$1$ZyEFTEke$cWSfcMkc7pjPmHLzMt7dv0

prove or disprove: password is salted.

Yes they were salted, no that's not gonna protect you if using a ridiculous insecure "pa$$w0rd". I fail to see how a hacker with access to the DB could have created the price bubble.

AFAIR most are salted, some are not, which is those that were not accessed for some months and thus were deemed inactive. See current mtgox front page. Didn't check myself, though.

Well, after got access to an account with USD in it and to cash out he had to buy BTC, that would bring the prices up, then the market does the rest, by seeing it trending up they follow.

You my friend are oblivious to reason.

Salt there is: $1$ZyEFTEke$ (MD5)
PHP Function used: crypt("yourpassword",'$1$ZyEFTEke$');

When people want to believe on something or someone, then no matter what others may tell them, they will stick to the ones their trust. You trust MtGox... nothing I can do about it.
Now, where do you see lack of reasoning there btw?

Where did I say I explicitly trust mtgox? I am simply pointing out how braindead the argument is that you are making this thread to be.

Lets look again, you state that because an account got hacked the value of bitcoin could have been bumped up to where it was by sunday? You honestly think that the trading with stolen coins that occured on sunday have anything to do with the rise of BTC value?

That is why I say, you my friend are oblivious to reason.

No, my friend, if you think like that then I guess you totally lost my point.

MagicalTux, who runs MtGox, said "2 months ago there were far less complaints about stolen accounts".
This wasn't "one compromised account", this were hundreds or thousands of them for "God knows how long". We can say now that at least by 14th they were already accessing accounts, if the complaints started to raise at MtGox 2 months ago, this could mean the breach is 2 month old and had resulting in this price bubble.

This last attack was just "the finale" or "the heist".

They are salted. Except for a few that have been "inactive" for two months.

+1
It's hard to find people on this forum that are stating facts instead of randomly blabbering, these days.

Are you referring to this?


Because that's not the same thing.

Maybe he said this elsewhere and I didn't see it.

Only if you accept the following rule:

"what mtgox says = fact"

I'm not sure I'm willing to give them that at this point...

Ok, the new ones are crypt MD5 salted hashes. But 2 months ago they were all plain MD5 unsalted.

Let me try to go more descriptive here, to see if you understand my line of deduction:

Notice there the evolution in the prices 2 months ago:

http://3.bp.blogspot.com/-WilU8m3RIWg/TfDGIfRYHsI/AAAAAAAAJRo/syF6yZ6eOdg/s320/Bitcoin+Graph+1.jpg

My theory goes around that by such time MtGox's db was already compromised.
At this point the hacker would start to get pwds and entering some accounts to check its users' activity. Allowing him to sort some dormant accounts with credit. Those with BTC on it were probably just wiped out, those with USD the hacker used it to buy BTC (bringing the price up this way) and later cashed out the BTC resulting from those trades.
Some of those users started to complaint to M'Tux who decided to implement his crypt(pass,salt) function. Up to this point, and up to yesterday M'Tux was most likely believing it was about users' giving away their passwords not his site fault.

Lately the thief tripped some wires or the legit owners checked their accounts making a load of requests to MtGox who came forward and put that thread on the forum. Seeing this, the robber decides to go on his final blow... and here we are.

What I find amusing tho regarding hacked accounts/exploits etc.

I have been pretty much 24/7 logged in during the whole fiasco, from the first reports of hacked(?) accounts, CSRF exploits and now the database release that all occured during a 7days period and I havnt lost a single dime of my BTC or $ in my mtgox wallet.

I would have been prime candidate if it were all up to the site integrity but I wasnt because it seems to have hit only the absolute dumbstruck retards with passwords such as PAssWORd or a password similar to their username.

I'm not trusting mt gox, I have the database. My password is salted. The salt is included in the file. I can use the salt, and my password to get the hash. No trust needed. MD5 is a certain length. All the password are not that length, because they include a salt. All except for about 300 of them, which are unsalted. A rainbow attack on those passwords shows that some of them were insecure. Almost all of them are salted, except for a few. I think this corroborates mt gox's story.

I'm not _sure_ that the handful of unsalted ones are "inactive". But it sounds believable to me. The rest I am sure of. A majority of the passwords are salted. If you have your password on there you can check yourself.

ASSUMPTIONS ARE THE MOTHER OF ALL FUCKUPS, just had to quote that.

So you just deduced without any facts or actual reasoning that thousands of $ and BTC were spend across multiple mtgox accounts from as far back as 2months yet the owners of these accounts would not have realised it? Are you on crack or just fear mongering now?

I believe users could have been compromised from the USERS side and not from MTGOX side at anytime since mtgox launched because that is possible with any user/pass from any site if the user is a total imbecile.

Yes the robber went on his final blow to steal a GRAND TOTAL of $1000, what a brilliant plan he worked on for 2 months and got away with absolute squat.

This whole heist looked alot more like something that was planned and executed within a 2day span(perhaps even same day) and not thoroughly thought out at all unlike your conspiracy of a 2month heist in progress with jacking up prices then crashing it.

In order for this to be true, there would have to have been a fortune in dormant cash laying around on MtGox servers, being spent unoticed by the actual account owner.

If you had half a million bucks in MtGox and noticed the price going up, would you check or just shrug your shoulders and move along. I think, like I was, you would be watching in awe as your money dissapeared as the price went up. This forum would have been alight with indignation.

I think your theory is both flawed and slightly paranoid.

@Clipse

Being active 24/7 was mostly your protection (and not a super-duper password), if my theory checks and the robber was smart to carry on with his scheme for all this long.



This is plain bullshit, and this is the point that made me believe more how untrustworthy mtgox is, by staging he just lost 100 or 200 btc, whereas the blockchain and people lucky enough to buy those cent bitcoins and withdraw them claiming here to have withdraw it with success. Losses are certainly way above the 1K USD. If it was for 1K, mtgox would be open by now.

You and everybody else. The state of the forum is sad, but I think this thread is a new low.

OK, I see no point on speculate more.
Be happy, cheers...

In order to withdraw them they would have had to be active during the 20 minutes after it happened (all of those orders were there before the sell off, no one could get in orders during the sell off) and during that time mt gox's website was moving at a crawl. On top of that, there is a $1000 withdraw limit. I know, from experience, that this withdraw limit is based on the 24 day weighted average. At the end of the sell off that average was about $4, or about 250 bitcoins.

So if 50 people got to withdraw the full 250 bitcoins that they didn't have in there account before the crash, then mt gox will have to cover 12,500, or about $150,000. The daily volume lately has been around $400,000. Mt gox gets about 1.3% of that $400,000, or $5,200 a day. That means that this incident cut in a little bit to this months profit.

We know mt gox has over 400,000 bitcoins on hand (it is right there in the block explorer), so even if they don't have money to cover it, and go on a sort of "fractional-reserve", the fraction would be almost 1. (400,000-12500)/400,000 = 0.96. That just isn't a worrisome fraction. And even if they take a 70% hit in volume, they will be able to make up that fraction in a month or two.

EDIT Where are the people claiming to withdraw with success? I know they didn't withdraw anything huge like the 260,000 that went for a penny, because I would see that in the block explorer.

BCemporium said exactly how he handles his facts, by _speculation_

He isnt interested in sensible analysis that you provided above however hyped up propaganda conspiracies is the order of his day.

the $1000 limit withdrawal applied to BTC so why would they convert USD to BTC only to be limited from cashing out? 

your theory is crazy.  stealing either USD or BTC from mtgox would have resulted in a FALL in the price of BTC as liquidity was being stolen out of mtgox, not the other way around.

The 1k limit applies to both, USD and BTC. It's 1k USD or BTC equivalent. Besides to withdraw USD you would need to do it to LR or Dwolla, leaving a trail. BTC just "uploads to network".
The lost of liquidity would take a while to kick him if you use dormant accounts, from long-mid term investors.

@DamienBlack

Look at the blockchain. Even 5 blocks were solved in a row right after the incident. It's hard to tell if the robber had 1 or 1000 accounts and how much was the damage. MtGox's covered in secrecy.

http://s1.postimage.org/mp62y6g4c/mtgox_crash_19_06_2011.jpg

Bottom line: You're all assuming that the hacker was dumb, just grab the db and wrecked the place. I'm putting to THEORY he could run this for a while until see himself cornered and wrecked it up.

Ok, I will play into your conspiracy game for the heck of it.

Once mtgox goes live and the price wasnt meant to be around 17.50 at this time, I am sure the price will suddenly just go down to about $1-$2 where it hanged about 2months ago.

If this doesnt happen, I will give you atleast a freeroll of 7days, then can we atleast agree you are full of shit and a conspiracy hog?

Actually, by the previous trend I would believe it's price to be around 5 by now.
Still, if I'm right, not even by creating a "fractional-reserve" MtGox will be able to stand up again.

So, yes or no?

Your stance is Mt.Gox fails, and the price stays at 5.00 BTC/USD?

Really, go on, we want this on the record before they re-open.

I'm not betting, this is an apocalyptic hypothesis, but still sustainable by the available data.
And no, I'll NOT be happy if I'm right. Being a pessimistic I'm used to be happy when I'm wrong.

Just by looking at the monitor, I can count 10 blocks solved (maybe more, they're hiding under the trade dots) during the attack. This means the blockchain was on fire with so many transactions going on. And the blockchain doesn't move because there was a trade at MtGox, it moves because someone was inputing a huge load of transactions to it.

Okay, so tell us what your stance is. (Before Mt.Gox opens.)

Looking at that piece from the blockchain my best guess would be it to be depleted or nearly depleted and replacing bitcoins with phoony coins to run in fractional-reserve-like for a while in an attempt to restore the lost income.
Due to the confidence lost this is most likely to fail. Time will tell...

Sorry if this doesn't cheer you up guys, keep in mind this is ONLY a theory. And if nothing else helps, maybe they sell Prozac at SR.

Okay, this is like nailing jello to a wall trying to get an answer out of you, but here's one more try.

Do you think Mt.Gox will fail:

A) Yes

B) No

Do you think the BTC/USD rate will be at 5 or lower 24 hours after Mt.Gox re-opens?

A) Yes

B) No

Time is ticking away, let us know...

Block production does not go up because there are more transactions pending.  Unless you think the hash rate of the network suddenly shot up at the exact moment of the heist?

It's just chance that five were made close to each other.  If one miner accepted all of the transactions that happened around the disaster, then they were all in the first block, the following four were completely redundant.

Q1: Most likely
Q2: Probably not, MtGox was just one exchange, the others will hold its value for a while. My best guess would be a meeting point around 6~7, depends on how long they can stand the inflated btc value.

There's a limit of transactions a block can contain I know you can solve empty blocks, but the spike on demand created a spike on supply.
This is actually an unforeseen event, would be interesting, when the dust settles, to study this behavior and its influence in the blocks generated on. I would believe in "chance" if it was 2 or 3, but I count there 10 blocks during the attack and then the 2 following solved blocks appears to be what it does regularly.

I'm sorry to say you're confused about how the bitcoin block system works.  Yes, there is a size limit (entirely arbitrarily set), but once that limit is reached it doesn't somehow make solving a block magically easier.  The excess transactions just have to wait.

Think about it: if it were possible to artificially increase the rate of block production in any way then the entire proof-of-work system that bitcoin relies on for its security would be broken.

The transactions are not conceptually part of the blocks; the block stores one hash that represents any number of transactions.  One number.  That's it.

It's better to think of the transactions as a block of random binary bytes that the block system timestamps.

Solving the blocks that way may had been a way to use an eventual surplus on computing power from the bitcoin network.

If you notice the two to the left, they look like at the normal block solving heartbeat.
During the attack you've 2 blocks being generated simultaneously, than 3 (at least, the amount of trades cover it up) and in the end 5.
At the same time it looks like party time in the transactions entering the blockchain. This denotes a co-relationship between demand and supply.

May things happened in that time frame worthing a look at, being obviously the most urgent MtGox's issue.

I salute you.  Most people can't pack this many errors into such a small post.

Good point, kjj. I have never seen anyone use generation variance as 'proof' of a hack attempt.

Guess it is like a kid shoving a sandwich into a DVD player, just because we wouldn't consider it - doesn't mean they won't try :)

Proof of hack attempt?!  :o

You guys need to chill out, this isn't hacking allover the place.
Just a strange variance, that's it, and it happened during a heavy load of transactions... but, hey, maybe they connected K to the btc network to go on a test run...  ::)

I think we are all communicating with a different subset of English because you STARTED this thread with your conspiracy that the hacked accounts influenced the market movement up to this date. You even used a timespan of 2months ago.

Now you revert and excluding mentioning hacking? quote: "You guys need to chill out, this isn't hacking allover the place."

I give up trying to communicate with you from this point onwards, atleast until you decide to communicate in universal english.

You're taking things out of context. That reply wasn't for you, but to TraderTimm who seams to believe my previous statement about the oddity of 10 blocks to be solved in a row was some hack attempt.

Also I found amusing your attempts to degenerate all my arguments to your wishful thinking based on a single spot I might get wrong. Yet what proves coins leaving MtGox is the outstanding enormous amount of transactions at that time entering the blockchain.