|
Title: [ATTN] Clarification of Mt Gox Compromised Accounts and Major Bitcoin Sell-Off Post by: BitcoinPorn on June 30, 2011, 03:29:48 PM https://mtgox.com/press_release_20110630.html
Quote CLARIFICATION OF MT. GOX COMPROMISED ACCOUNTS AND MAJOR BITCOIN SELL-OFF Dear members of the press and Bitcoin community, I. Background March, 2011 – MtGox.com (Mt. Gox), now the world’s leading Bitcoin exchange, was purchased by Tibanne Co. Ltd. As part of the purchase agreement, for a period of time, Tibanne Co. Ltd was required to pay the previous owner a percentage of commissions. In order to audit and verify this percentage, the previous owner retained an admin level user account. This account was compromised. So far we have not been able to determine how this account’s credentials were obtained. II. Bitcoin Sell-Off On June 20th at approximately 3:00am JST (Japan Time), an unknown person logged in to the compromised admin account, and with the permissions of that account was able to arbitrarily assign himself a large number of Bitcoins, which he subsequently sold on the exchange, driving the price from $17.50 to $0.01 within the span of 30 minutes. With the price low, the thief was able to make a larger withdrawal (approximately 2000 BTC) before our security measures stopped further action. We would like to note that the Bitcoins sold were not taken from other users’ accounts—they were simply numbers with no wallet backing. For a brief period, the number of Bitcoins in the Mt. Gox exchange vastly outnumbered the Bitcoins in our wallet. Normally, this should be impossible. Unfortunately, the 2000 BTC withdrawn did have real wallet backing and they will be replaced at Mt. Gox’s expense. Again, apart from the compromised admin account, no individual user’s account was manipulated in any way. All BTC and cash balances remain intact. Given the relatively small amount of damage considering what was potentially possible, we have to question what the true motives of the attacker were. Perhaps the attack simply was not well-orchestrated but the possibility exists that the attacker was more interested in making a statement, hurting Mt. Gox’s reputation, or hurting the public image of Bitcoins in general than he was in any monetary gain. III. Database Breach Late last week we discovered a SQL injection vulnerability in the mtgox.com code that we suspect is responsible for allowing an attacker to gain read-only access to the Mt. Gox user database. The information retrieved from that database included plain text email addresses and usernames, unsalted MD5 passwords on accounts that had not logged in since prior to the Mt. Gox ownership transfer, and salted MD5 passwords on those accounts created or logged in to post-ownership transfer. We speculate that the credentials of the compromised admin account responsible for the market crash were obtained from this database. The password would have been hashed but it may not have been strong enough to prevent cracking. Regrettably, we can confirm that our list of emails, usernames and hashed passwords has been released on the Internet. Our users and the public should know that these hashed passwords can be cracked, and many of our users’ more simple passwords have been cracked. This event highlights the importance of having a strong password, which we will now be enforcing. We strongly encourage all our users to immediately change the passwords of any other accounts that now or previously shared a password with their Mt. Gox account, if they have not done so already. IV. Present Steps We have been working tirelessly with other service providers in order to mitigate the potential damage to our users caused by the security breach. We’ve been informing our users to be especially cautious of Bitcoin-related phishing attempts at the email addresses associated with their Mt. Gox accounts. Users should continue to be especially observant of indicators of account compromise with other services—especially email and financial services. We would like to give a special thanks to the Google team who were extremely proactive about flagging and temporarily locking customer accounts that appeared in our stolen user list. Their quick response no doubt significantly reduced unauthorized account access to Gmail addresses associated with Mt. Gox user accounts. We’ve been actively researching the origin of the attack that led to the compromise of Mt. Gox’s previous owner’s admin account; however, our priority has been getting the Mt. Gox service back online and getting people access to their funds. We were finally able to simultaneously relaunch the service and launch our new site, with greatly improved security and back end, on June 26th, 2011. V. Future Steps The new Mt. Gox site features SHA-512 multi-iteration, triple salted hashing and soon will have an option for users to enable a withdraw password that will be separate from their login passwords. Other security measures such as one-time password keys are planned for release very soon as well. The recent successful attacks on huge institutions like Sony and Citibank remind us that nobody is impenetrable. We are now operating under the presumption that another security breach will happen at some point in the future and we are implementing layers of fail-safe mechanisms to greatly limit the amount of damage possible. Of course, we’re doing our best to make sure those fail-safe mechanisms are never necessary. While we are making great strides with the advancement of our security, we should remind our users that they too play an important role in securing their accounts. Please use a long password—the standard is not whether a person could guess it but rather whether a computer could guess it—and computers can guess pretty fast. Please do not share passwords across services—where passwords are shared, a compromise at one service means a compromise at all services. Help us help you. VI. Apology The truth is that Mt. Gox was unprepared for Bitcoin’s explosive growth. Our dated system was built as a hobby when Bitcoins were worth pennies a piece. It was not built to be a Fort Knox capable of securely handling millions of dollars in transactions each day. We can attempt to blame the owner of the compromised account for the recent events but at the end of the day the responsibility to secure the site and protect our users rests with us. The admin account responsible had more permissions than necessary, and our security triggers were not as tight as they could have been. Since the change of ownership, we have actively been patching holes while at the same time building a new Bitcoin exchange from the ground up. Going forward, we are certain that the launch of the new site will exceed the rightful expectations our users have of the service. We only hope that we can once again earn the trust of the Bitcoin community. In the meantime, we sincerely appreciate the patience all our users have shown. We’ve got a backlog of emails we’re catching up on now but if you have any questions or comments about the recent security breaches and events, Mt. Gox in general, its founder or Bitcoin, please do not hesitate to contact us. We’re reading every message and we’ll get back to you as soon as we can. Mark Karpeles - CEO Tibanne Co. Ltd. https://mtgox.com/press_release_20110630.html Title: Re: [ATTN] Clarification of Mt Gox Compromised Accounts and Major Bitcoin Sell-Off Post by: rebuilder on June 30, 2011, 03:38:41 PM So the mystery auditor was Jed...
Title: Re: [ATTN] Clarification of Mt Gox Compromised Accounts and Major Bitcoin Sell-Off Post by: dacoinminster on June 30, 2011, 03:50:13 PM I'm glad they posted this. I trust them a lot more after seeing this. The only thing missing is the exact number of coins stolen and the address they were sent to. I can't imagine why they didn't make that public.
Title: Re: [ATTN] Clarification of Mt Gox Compromised Accounts and Major Bitcoin Sell-Off Post by: chihlidog on June 30, 2011, 03:52:29 PM THIS is what I've wanted to hear from them. Nutting up and taking responsibility is a big step. Good job, guys, and I can honestly say that I wish you well.
Title: Re: [ATTN] Clarification of Mt Gox Compromised Accounts and Major Bitcoin Sell-Off Post by: BubbleBoy on June 30, 2011, 04:07:38 PM What they really need is layered security:
- a distinct authentication machine that is accessible via a narrow API; no "select * from users" ! - a distinct trading machine that takes in trading requests, responsible for making the market and tracks the BTC/$ ownership of every user in the system; narrow API: enter buy and sell orders, receive callbacks when they are completed - distinct withdrawal machines that make actual bank and bitcoin transactions - a front-end machine that runs the PHP interface and is responsible for the user interface Each interface is logged and monitored, and does not allow someone who attacks the front-end machine to access the rest of the system. The backend machines are firewalled and not accessible by other means than the narrowly defined interface. As long as they are using a single system running a home-brewed PHP + Mysql application, parametrized queries will not prevent the next breakin. Title: Re: [ATTN] Clarification of Mt Gox Compromised Accounts and Major Bitcoin Sell-Off Post by: Glorious House of Barry on June 30, 2011, 04:11:34 PM This is more or less what I've figured all along (although it's interesting to hear that the admin account could just grant himself arbitrary bitcoins; I reckoned instead that somebody had used an admin account to collect bitcoins together from other accounts).
Many thanks to the person, obviously a native English speaker, that actually crafted the press release. Can we move on now please? Title: Re: [ATTN] Clarification of Mt Gox Compromised Accounts and Major Bitcoin Sell-Off Post by: Tasty Champa on June 30, 2011, 04:23:58 PM Now to get everything back in working order like it was before all this mess.
Title: Re: [ATTN] Clarification of Mt Gox Compromised Accounts and Major Bitcoin Sell-Off Post by: MeSarah on June 30, 2011, 04:37:25 PM Being forthcoming does help. I may be a little less critical of MtGox now but they still have a long way to go to regain my trust. But this is a step in the right direction. Thanks OP for posting the MtGox statement.
Title: Re: [ATTN] Clarification of Mt Gox Compromised Accounts and Major Bitcoin Sell-Off Post by: airdata on June 30, 2011, 04:42:53 PM Being forthcoming does help. I may be a little less critical of MtGox now but they still have a long way to go to regain my trust. But this is a step in the right direction. Thanks OP for posting the MtGox statement. Yep. Good stuff. Title: Re: [ATTN] Clarification of Mt Gox Compromised Accounts and Major Bitcoin Sell-Off Post by: Bunghole on June 30, 2011, 04:50:20 PM So what about Kevin?
Title: Re: [ATTN] Clarification of Mt Gox Compromised Accounts and Major Bitcoin Sell-Off Post by: DamienBlack on June 30, 2011, 04:59:42 PM Hmm.. interesting. I'm surprised to hear that they did have an SQL vulnerability. I thought that the "admin" account is what leaked the database.
And to everyone insisting on no rollback, I hope you can see now that it was necessary. I always assumed it was. Title: Re: [ATTN] Clarification of Mt Gox Compromised Accounts and Major Bitcoin Sell-Off Post by: ius on June 30, 2011, 05:59:18 PM Aha, the long-awaited clarification. Turns out the majority of speculations were correct after all.
Still, existence of the SQL injection vulnerability should've been disclosed two weeks ago(!), instead of dodging all speculations. Title: Re: [ATTN] Clarification of Mt Gox Compromised Accounts and Major Bitcoin Sell-Off Post by: RodeoX on June 30, 2011, 08:22:53 PM Some degree of withholding information to be expected when you are compromised. Gox may have been concerned that immediately releasing all they knew could aid the people who did this.
Title: Re: [ATTN] Clarification of Mt Gox Compromised Accounts and Major Bitcoin Sell-Off Post by: Maged on June 30, 2011, 08:31:41 PM Has anybody checked whether jed's password was one that's been publicly leaked yet? I'm interested in how strong it was...
Title: Re: [ATTN] Clarification of Mt Gox Compromised Accounts and Major Bitcoin Sell-Off Post by: Nescio on July 01, 2011, 12:01:15 AM This is more or less what I've figured all along (although it's interesting to hear that the admin account could just grant himself arbitrary bitcoins; I reckoned instead that somebody had used an admin account to collect bitcoins together from other accounts). Those are quite possibly the same thing. The blurb is, perhaps intentionally, unclear on the exact details. Where it says "was able to arbitrarily assign himself a large number of Bitcoins" it could be that that large number is the total number of Bitcoins in the system, which would effectively be a pooling of all user balances (not necessarily zeroing out user balances, just a sum/view). If there are no safeguards to limit admins to a balance that is actually backed, then an attacker could 'create' 50 million BTC and sell as long as there are buy orders. This would of course have to be rolled back. "We would like to note that the Bitcoins sold were not taken from other users’ accounts—they were simply numbers with no wallet backing." doesn't specify whether there are internal safeguards against going over the backed limit, but it makes it possible. BTW, saying the withdrawal was prevented by unspecified security measures could mean they had an on-line wallet that was used for small or expected day-to-day withdrawals and perhaps their off-line wallet was accessed once every 24 hours to move funds back and forth as necessary. But the full withdrawal could just as well have been prevented by panic sells and opportunistic buys quickly driving the price up (0.50 USD/BTC for a withdrawal of 2000 BTC with a $1000 limit). Title: Re: [ATTN] Clarification of Mt Gox Compromised Accounts and Major Bitcoin Sell-Off Post by: mewantsbitcoins on July 01, 2011, 12:41:46 AM All this "Clarification" BS is fine and dandy, but my account was compromised(or atleast Mt.gox would like me think so) and I can't figure out how. This I know from the logs provided by Mt.gox:
https://i.imgur.com/s6oQO.png That is not my IP. While my password was not the most secure, I don't believe it could have been cracked in the short amount of time attackers had. You are welcome to try to crack it: Code: 5987,mewantsbitcoins,mewantsbitcoins@gmail.com,$1$atDbQTre$lG10yR6hXfmGcdZAZTL.Z1 You may say that my computer might have been compromised and someone got my password from a keylogger. While I can't be 100% certain, I am fairly confident it wasn't. I work in IT and know few things about IT security. Plus, if that were true and my computer indeed got compromised, my other accounts would have been accessed too, which is not the case. Note: I don't reuse passwords, so it could not have been a password from another account. This is a one time password and I used it only on one computer. My OS is not Windows. In general, I have to say - things don't add up from where I stand. If someone gained admin level user account why would they go to the lengths of SQLi to get the database? I can think of two scenarios where such things would be possible and none of them are compatible with this "Clarification" story. On an unrelated note, I bought hosting from https://www.kalyhost.com/ which belongs to Mark Karpeles. The server has been down for more than two weeks now and I can't get a response from him despite sending several emails. To sum up, I've drawn my conclusions, but was highly surprised to see people going back to Mt.gox and trading like nothing has happened. This is EXTREMELY greedy and incompetent individual trying to manage huge amounts of money. It will end up in tears eventually and you'll have no one to blame but yourself. And before you ask for my tradehill reference code, I don't have one - I think they are shit too. My advice is to stay away from people who can't afford a dedicated server. Title: Re: [ATTN] Clarification of Mt Gox Compromised Accounts and Major Bitcoin Sell-Off Post by: PCRon on July 01, 2011, 01:01:10 AM Has anybody checked whether jed's password was one that's been publicly leaked yet? I'm interested in how strong it was... If it was not publicly leaked, that would be of interest. I would like to know where the BTC went, and what about Keven? Title: Re: [ATTN] Clarification of Mt Gox Compromised Accounts and Major Bitcoin Sell-Off Post by: jed on July 01, 2011, 01:04:39 AM mewantsbitcoins:
Your password was probably brute forced from the user dump like mine was. Mine wasn't super simple either. > If someone gained admin level user account why would they go to the lengths of SQLi to get the database? My account still had admin access. They were able to get my account password because of the SQLi I'm sure Mark is very busy with mtgox so has been neglecting Kalyhost. Mistakes were obviously made but I don't think Mark is being greedy or incompetent here. He needs to hire more people and he knows this. But which if you have ever tried to do you know takes time which he doesn't have much of these days. Title: Re: [ATTN] Clarification of Mt Gox Compromised Accounts and Major Bitcoin Sell-Off Post by: mewantsbitcoins on July 01, 2011, 02:02:05 AM Your password was probably brute forced from the user dump like mine was. Mine wasn't super simple either. I call this BS. My hash is up there - go and try to brute force it. I guess I'll see you in several years/decades.> If someone gained admin level user account why would they go to the lengths of SQLi to get the database? Mt.gox says My account still had admin access. They were able to get my account password because of the SQLi Quote from: Mt.gox In order to audit and verify this percentage, the previous owner retained an admin level user account. This account was compromised. So far we have not been able to determine how this account’s credentials were obtained. Mistakes were obviously made but I don't think Mark is being greedy or incompetent here. He needs to hire more people and he knows this. But which if you have ever tried to do you know takes time which he doesn't have much of these days. No, it doesn't if you offer adequate reward, hence greedy.Quote from: mewantsbitcoins The server has been down for more than two weeks now and I can't get a response from him despite sending several emails Hence, incompetent.A monkey can restart server and fire away an email. And for the conspiracy theorists: could it just be that mt.gox's and your bots Code: 413,Gox Bot,,$1$my2/Mvxi$kC7BKl1xKgYlbadc/GHSN1 Quote from: Mt.gox We would like to note that the Bitcoins sold were not taken from other users’ accounts—they were simply numbers with no wallet backing. For a brief period, the number of Bitcoins in the Mt. Gox exchange vastly outnumbered the Bitcoins in our wallet. to themselves for us to enjoy this remarkable growth period? It is fairly easy to make profit when you have access to all the data, isn't it?Just sayin Title: Re: [ATTN] Clarification of Mt Gox Compromised Accounts and Major Bitcoin Sell-Off Post by: ius on July 01, 2011, 02:03:38 AM mewantsbitcoins: Your password was probably brute forced from the user dump like mine was. Mine wasn't super simple either. > If someone gained admin level user account why would they go to the lengths of SQLi to get the database? My account still had admin access. They were able to get my account password because of the SQLi I'm sure Mark is very busy with mtgox so has been neglecting Kalyhost. Mistakes were obviously made but I don't think Mark is being greedy or incompetent here. He needs to hire more people and he knows this. But which if you have ever tried to do you know takes time which he doesn't have much of these days. Why did you still have an account with administrator privileges? Auditing? Why did it still grant additional privileges with respect to being able to modify account balances? Some degree of withholding information to be expected when you are compromised. Gox may have been concerned that immediately releasing all they knew could aid the people who did this. Absolute nonesense. If you discover a vulnerability it's your duty to inform your users, doesn't matter whether you are actually compromised or not - there's a risk and you should inform people about it. Title: Re: [ATTN] Clarification of Mt Gox Compromised Accounts and Major Bitcoin Sell-Off Post by: ius on July 01, 2011, 02:06:06 AM Your password was probably brute forced from the user dump like mine was. Mine wasn't super simple either. I call this BS. My hash is up there - go and try to brute force it. I guess I'll see you in several years/decades.Then please disclose your password - if it was anything but totally random & a-z/A-Z/0-9/special & >9 chars you were definately at risk. Title: Re: [ATTN] Clarification of Mt Gox Compromised Accounts and Major Bitcoin Sell-Off Post by: mewantsbitcoins on July 01, 2011, 02:21:50 AM Your password was probably brute forced from the user dump like mine was. Mine wasn't super simple either. I call this BS. My hash is up there - go and try to brute force it. I guess I'll see you in several years/decades.Then please disclose your password - if it was anything but totally random & a-z/A-Z/0-9/special & >9 chars you were definately at risk. You must be retarded. Why would I disclose my password and my thinking pattern? So it can be added to dictionaries and future attacks? No thank you. Like I said - hash is up there. If you think my password could have been cracked in couple of days - go ahead and try. If you're serious about it, I'll even add few of my 5870s to your hardware to prove it was good enough for this particular application Title: Re: [ATTN] Clarification of Mt Gox Compromised Accounts and Major Bitcoin Sell-Off Post by: ius on July 01, 2011, 02:26:58 AM - If you maintain proper password policies, you shouldn't have to worry about disclosing a password which you're not using anymore (you weren't reusing it anywhere, were you?)
- If it was actually 'random' and 'long' enough you should be able to determine the average time required to crack it - ie. the feasibility of a brute force attack (dictionary should be useless) given am average set of cracking hardware (GPUs). All that, without having to resort to calling me retarded. ;) Title: Re: [ATTN] Clarification of Mt Gox Compromised Accounts and Major Bitcoin Sell-Off Post by: makomk on July 01, 2011, 08:49:33 AM I'm glad they posted this. I trust them a lot more after seeing this. The only thing missing is the exact number of coins stolen and the address they were sent to. I can't imagine why they didn't make that public. Ah. One major thing that's bugging me is this - if the person doing this had so much access, why couldn't they change their limits and withdraw a large chunk of their freshly-created bitcoin balance? The original Mt Gox statement said that the withdrawal limits stopped them, but we now know that statement's stuffed full of BS. Whether they were just attempting to damage trust in bitcoins or were actually trying to make money, this would be a much more effective way of doing it.Still, at least Mt Gox eventually admitted what's been obvious for a while: they've been lying to us. It was fairly clear that the total amount of bitcoins they had was less than the amount they were claiming was in the "single large account" that got compromised, and they had to have known that all along too. Which in turn meant that their claims of "read-only" access to the database must've been wrong. Title: Re: [ATTN] Clarification of Mt Gox Compromised Accounts and Major Bitcoin Sell-Off Post by: bitsalame on July 01, 2011, 10:19:07 AM - If you maintain proper password policies, you shouldn't have to worry about disclosing a password which you're not using anymore (you weren't reusing it anywhere, were you?) - If it was actually 'random' and 'long' enough you should be able to determine the average time required to crack it - ie. the feasibility of a brute force attack (dictionary should be useless) given am average set of cracking hardware (GPUs). All that, without having to resort to calling me retarded. ;) Wrong ius. Even if the password is cryptographically strong, it doesn't mean that it can't actually allow you to predict his future passwords by the style of it. For example, I have a specific method to remember passwords without storing it anywhere. I know that my passwords would never be cracked within a millenium since it is base96+1 (alphanumeric+upper/lower case+symbols+foreign language characters) even in a Class F which is the highest level of cracking possible (1,000,000,000 Passwords/sec) normally possible with supercomputers and distributed cracking. I know that my passwords are not in dictionaries. But I am not a computer so I can't memorize random characters, therefore I use some heuristics and mnemonics to remember them. If you saw my password, you could deduce from my style the rules I set for myself for all the passwords I am using on every single site and the future ones I'll generate. You might not guess it right away, but you could tailor an attack for me, launching a statistical attack, or just making a password generating algorithm based on what type of rules I set up in my mind for new passwords. It would considerably narrow down the possible passwords and accelerating considerably the cracking speed with a extremely higher degree of success. Yes, it is security through obscurity, but this obscurity is in my brain, and as long as you don't have a mind reader the password will remain cryptographically secure. (for the record, my password wasn't cracked, and I am also cracking it myself to test it out. I got more than 2000+ passwords cracked mine is still holding up pretty well and it should remain that way) Therefore I totally agree with mewantsbitcoins, telling your password is stupid. It can be really secure and be impossible to crack with current means, but knowing his mindset it might reveal everything. Title: Re: [ATTN] Clarification of Mt Gox Compromised Accounts and Major Bitcoin Sell-Off Post by: Horkabork on July 01, 2011, 10:40:35 AM I'm glad to see this release, only I wish it was made a week ago. Hopefully it'll put to bed at least some of the conspiracy theories and accusations.
I'm wondering why they couldn't have be more forthright, however. Was there an NDA or gag order involved, or did they just want to be sure to have fully investigated and sealed the security holes before informing us? An NDA might make sense, as many website and software sales that involve residual payments also have a holding period during which the previous owner is somewhat liable for certain issues (Previous patent claims, undisclosed legal or security issues, etc). Revealing anything about the residuals and the former owner's involvement post-sale might have been in their contract, which would ostensibly include talking too much about the hacked account. (I'm not a lawyer. I only know some of this because my stepbrother just sold his software company) Title: Re: [ATTN] Clarification of Mt Gox Compromised Accounts and Major Bitcoin Sell-Off Post by: rebuilder on July 01, 2011, 03:56:35 PM This is more or less what I've figured all along (although it's interesting to hear that the admin account could just grant himself arbitrary bitcoins; I reckoned instead that somebody had used an admin account to collect bitcoins together from other accounts). Those are quite possibly the same thing. The blurb is, perhaps intentionally, unclear on the exact details. Where it says "was able to arbitrarily assign himself a large number of Bitcoins" it could be that that large number is the total number of Bitcoins in the system, which would effectively be a pooling of all user balances (not necessarily zeroing out user balances, just a sum/view). You quoted part of where they explained it, the full quote being: Quote We would like to note that the Bitcoins sold were not taken from other users’ accounts—they were simply numbers with no wallet backing. For a brief period, the number of Bitcoins in the Mt. Gox exchange vastly outnumbered the Bitcoins in our wallet. Which to me says pretty clearly the attacker assigned themselves coins out of thin air. Title: Re: [ATTN] Clarification of Mt Gox Compromised Accounts and Major Bitcoin Sell-Off Post by: makomk on July 01, 2011, 07:01:35 PM I'm glad to see this release, only I wish it was made a week ago. Hopefully it'll put to bed at least some of the conspiracy theories and accusations. Hah. It actually confirms several of them and leaves several more at least as plausible as they were before. In particular, it confirms the allegations that Mt Gox did actually have a SQL injection vulnerability and the theory that the attacker had somehow managed to gain write access to the database and created themselves a whole bunch of coins from thin air, both of which contradicted Mt Gox's previous statements.Title: Re: [ATTN] Clarification of Mt Gox Compromised Accounts and Major Bitcoin Sell-Off Post by: vectorvictor on July 02, 2011, 06:32:31 AM Has anybody checked whether jed's password was one that's been publicly leaked yet? I'm interested in how strong it was... There is some indication that the password file was stolen more than two weeks before the break-in. At least one person has said that their (cracked and exposed) password was in effect 17 days prior. The hacker(s) apparently had lots of time to break many passwords. I've found four sets of cracked passwords from the master list so far. Two of the files were made by some *serious* crackers, with each file having over 3000 cracked passwords. The user jed (user #1) was _not_ among the cracked passwords that I've seen so far. There were no users with a @mtgox.com email address among the cracked passwords so far. The user mewantsbitcoins was _not_ among the cracked passwords so far. All of those passwords must have been reasonably strong, at minimum. Many of the passwords that *have* been cracked look pretty damn strong. Like, 14 characters long with alpha/numeric/symbol and no obvious patterns or weaknesses. Scads of them are 12-characters long. It's pretty scary, actually. People: you really need to re-think what it means to have a strong password these days. A billion attempts per second really adds up. The cracking programs aren't just picking sequentially -- they are clever. For example, if you think Leet-speak (e.g. subbing @ for a, 3 for E, and so on) is smart, you're wrong -- the good cracking programs try all of those variations as alternate spellings of words or partial words. If you think an arcane non-word and keyboard pattern is smart, you're wrong -- trogdor321!!!~ was much easier than some of the other passwords that have been cracked... (it was strong-bad :) It's time to move over to strong *pass phrases* -- several unrelated words strung together. Go to a place like diceware.com and get some serious entropy on your side. Or use a password manager and generator like 1password, LastPass, KeePass, etc. Humans are humans, and it will always be the case that most passwords are way too weak. The question is whether you want to be part of the herd. Title: Re: [ATTN] Clarification of Mt Gox Compromised Accounts and Major Bitcoin Sell-Off Post by: cypherdoc on July 02, 2011, 02:39:42 PM I'm glad they posted this. I trust them a lot more after seeing this. The only thing missing is the exact number of coins stolen and the address they were sent to. I can't imagine why they didn't make that public. Ah. One major thing that's bugging me is this - if the person doing this had so much access, why couldn't they change their limits and withdraw a large chunk of their freshly-created bitcoin balance? precisely what i've been thinking. i truly think a major financial institution or gov't related entity hacked the system with its sole purpose to drive down the price of btc. stealing the btc outright which would have been the logical and easiest first move for an individual. why go to the trouble of creating a selloff lasting 30 min? stealing the btc for an institution or gov't would have been an international crime whereas a creating a selloff could just be considered "national security". stealing the DB would also be information gathering. Title: Re: [ATTN] Clarification of Mt Gox Compromised Accounts and Major Bitcoin Sell-Off Post by: Dynotor on July 02, 2011, 03:48:02 PM Thanks MagicalTux for this explanation. It really helps build back the trust, and it seems like you've got a good idea of how things should be secure. I 100% trust your intentions, and theoretical understanding of what should be done from a security standpoint. I don't have enough trust in your followthru or trust you'll have the bandwidth to provide excellent service, but you've got opportunities in the future to earn that too.
Even if the password is cryptographically strong, it doesn't mean that it can't actually allow you to predict his future passwords by the style of it. For example, I have a specific method to remember passwords without storing it anywhere. I know that my passwords would never be cracked within a millenium since it is base96+1 (alphanumeric+upper/lower case+symbols+foreign language characters) even in a Class F which is the highest level of cracking possible (1,000,000,000 Passwords/sec) normally possible with supercomputers and distributed cracking. I know that my passwords are not in dictionaries. But I am not a computer so I can't memorize random characters, therefore I use some heuristics and mnemonics to remember them. If you saw my password, you could deduce from my style the rules I set for myself for all the passwords I am using on every single site and the future ones I'll generate. You might not guess it right away, but you could tailor an attack for me, launching a statistical attack, or just making a password generating algorithm based on what type of rules I set up in my mind for new passwords. It would considerably narrow down the possible passwords and accelerating considerably the cracking speed with a extremely higher degree of success. Yes, it is security through obscurity, but this obscurity is in my brain, and as long as you don't have a mind reader the password will remain cryptographically secure. (for the record, my password wasn't cracked, and I am also cracking it myself to test it out. I got more than 2000+ passwords cracked mine is still holding up pretty well and it should remain that way) Therefore I totally agree with mewantsbitcoins, telling your password is stupid. It can be really secure and be impossible to crack with current means, but knowing his mindset it might reveal everything. There is a *BIG* flaw in your logic, bitsalame. If disclosing just one of your passwords can enable an attacker to tailor attacks against your other passwords, you have to trust *all* the sites that you use that style of passwords to not store plaintext passwords and intentionally be evil. That, in my opinion, is a really risky assumption. Also with your method it's more easily possible to truely forget a password. For these reasons, I think it is less risky to use a password manager to create truely random passwords. (There's risk there too... but I think less risk.) Title: Re: [ATTN] Clarification of Mt Gox Compromised Accounts and Major Bitcoin Sell-Off Post by: mrb on July 03, 2011, 02:20:07 AM You must be retarded. Why would I disclose my password and my thinking pattern? So it can be added to dictionaries and future attacks? No thank you. This statement indicates that your password was insecure. If all it takes to risk guessing your password is to know your password generation logic, then the breach of any of the dozens of websites on which you have a password-protected account, may have helped the attacker in guessing your password. What happens when a password hash leak occur is that attackers generate candidate passwords based on bruteforcing results from previous leaks (Gawker, phpbb, MySpace, etc). They read them, try to understand how users picked them, and they adjust the mangling rules in their bruteforcers. Also you would not be the first one to think your password was relatively secure when in fact it turned out to be complete crap (this guy (http://forum.bitcoin.org/index.php?topic=25389) claimed his password was secure, and even lied about its length, when it was in fact "rascal101"). Title: Re: [ATTN] Clarification of Mt Gox Compromised Accounts and Major Bitcoin Sell-Off Post by: mrb on July 03, 2011, 04:00:50 AM Many of the passwords that *have* been cracked look pretty damn strong. Like, 14 characters long with alpha/numeric/symbol and no obvious patterns or weaknesses. Scads of them are 12-characters long. It's pretty scary, actually. Indeed... Code: # Pairs of hash, password from http://www.nanaimogold.com/microlionsec.txt There is no way the passwords above have been bruteforced by conventional mechanisms. MD5-based crypt() can be theoretically attacked at 10 Mpw/s on an HD 6990 (the best public bruteforcer, oclHashcat, only achieves 5 Mpw/s on this card). Given a search space of length 10 and random printable ASCII chars (and the passwords above are even stronger), and a private tool doing 10 Mpw/s, it would take on average 948 years on a cluster of 100 HD 6990 to bruteforce only one of them! Therefore, there are only a few possible theories:
Title: Re: [ATTN] Clarification of Mt Gox Compromised Accounts and Major Bitcoin Sell-Off Post by: mewantsbitcoins on July 03, 2011, 12:44:47 PM You must be retarded. Why would I disclose my password and my thinking pattern? So it can be added to dictionaries and future attacks? No thank you. This statement indicates that your password was insecure. If all it takes to risk guessing your password is to know your password generation logic, then the breach of any of the dozens of websites on which you have a password-protected account, may have helped the attacker in guessing your password. What happens when a password hash leak occur is that attackers generate candidate passwords based on bruteforcing results from previous leaks (Gawker, phpbb, MySpace, etc). They read them, try to understand how users picked them, and they adjust the mangling rules in their bruteforcers. Also you would not be the first one to think your password was relatively secure when in fact it turned out to be complete crap (this guy (http://forum.bitcoin.org/index.php?topic=25389) claimed his password was secure, and even lied about its length, when it was in fact "rascal101"). That statement does not indicate shit. I don't have any account with your mentioned sites or sites that have been hacked. I am extremely paranoid and use one time identities and one time passwords for different sites/forums/communities. Even if some site was hacked that we don't know about, attackers would never be able to tie them to this one. Go ahead and try to find info about mewantsbitcoins or any other identifies tied to it. The reason why I don't post my password is because if someone really wanted to target me, this would give them advantage, however small. Anyone with half a brain and basic understanding of IT security would do the same. Anyway, I'm not here to argue about security practices. I don't think my password was secure - I know it was. I only came back here and posted what I thought because people seem to be mislead by this "clarification" bs. From what I've seen I can conclude with certainty that Mark is incompetent and greedy and it is just a matter of time before this will happen again. It is unfortunate that some people are too thick to realize they are going to lose their money. But I am not even very worried about them - they deserve everything they get. What I'm worried about is the image of bitcoin and articles in press. It is very difficult to bring in new, serious people, when our major exchange is a joke. Title: Re: [ATTN] Clarification of Mt Gox Compromised Accounts and Major Bitcoin Sell-Off Post by: hashman on July 03, 2011, 01:35:48 PM I'm glad they posted this. I trust them a lot more after seeing this. The only thing missing is the exact number of coins stolen and the address they were sent to. I can't imagine why they didn't make that public. Ah. One major thing that's bugging me is this - if the person doing this had so much access, why couldn't they change their limits and withdraw a large chunk of their freshly-created bitcoin balance? precisely what i've been thinking. i truly think a major financial institution or gov't related entity hacked the system with its sole purpose to drive down the price of btc. stealing the btc outright which would have been the logical and easiest first move for an individual. why go to the trouble of creating a selloff lasting 30 min? stealing the btc for an institution or gov't would have been an international crime whereas a creating a selloff could just be considered "national security". stealing the DB would also be information gathering. If you believe the individual was still subject to the withdrawl limits, the selloff makes sense and enabled him/her/them to escape with 2000BTC. It is conceivable that the limits were 'hard coded'. Why would a financial institution or gov't related entity want to drive down the price? AFAIK there are not many short sales in play at the moment. The statement from MtGox is helpful, however it doesn't address some of the anomalies identified in the transaction ledger. Why the sudden motion of 500k BTC immediately after the selloff? Why the sudden play of the very old accounts with 50BTC each? Title: Re: [ATTN] Clarification of Mt Gox Compromised Accounts and Major Bitcoin Sell-Off Post by: cypherdoc on July 03, 2011, 03:14:19 PM I'm glad they posted this. I trust them a lot more after seeing this. The only thing missing is the exact number of coins stolen and the address they were sent to. I can't imagine why they didn't make that public. Ah. One major thing that's bugging me is this - if the person doing this had so much access, why couldn't they change their limits and withdraw a large chunk of their freshly-created bitcoin balance? precisely what i've been thinking. i truly think a major financial institution or gov't related entity hacked the system with its sole purpose to drive down the price of btc. stealing the btc outright which would have been the logical and easiest first move for an individual. why go to the trouble of creating a selloff lasting 30 min? stealing the btc for an institution or gov't would have been an international crime whereas a creating a selloff could just be considered "national security". stealing the DB would also be information gathering. If you believe the individual was still subject to the withdrawl limits, the selloff makes sense and enabled him/her/them to escape with 2000BTC. It is conceivable that the limits were 'hard coded'. Why would a financial institution or gov't related entity want to drive down the price? AFAIK there are not many short sales in play at the moment. The statement from MtGox is helpful, however it doesn't address some of the anomalies identified in the transaction ledger. Why the sudden motion of 500k BTC immediately after the selloff? Why the sudden play of the very old accounts with 50BTC each? from the above comments, it seems this hacker was extremely talented or had access to significant processing power. to me changing the withdrawal limit and then stealing the btc would have been easiest and most logical first step. the limits are not hard coded. my own limits have been changed by Mark. Kevin Day also described a bug in the daily limit which allowed sequential withdrawals of $1000 from the same acct. if i have to explain why a financial inst or gov't would want to drive down the price of btc to you heaven help you. this was the financial market equivalent of naked short selling btc into oblivion. this is why i have argued against implementing short selling at this stage by mtgox. Title: Re: [ATTN] Clarification of Mt Gox Compromised Accounts and Major Bitcoin Sell-Off Post by: mrb on July 03, 2011, 03:34:44 PM That statement does not indicate shit. I don't have any account with your mentioned sites or sites that have been hacked. I am extremely paranoid and use one time identities and one time passwords for different sites/forums/communities. Even if some site was hacked that we don't know about, attackers would never be able to tie them to this one. Go ahead and try to find info about mewantsbitcoins or any other identifies tied to it. Attackers don't need to tie identities. Previously broken passwords are added to dictionary lists and are blindly tried against all newly leaked accounts. Anyway, I'm not here to argue about security practices. I don't think my password was secure - I know it was. This contradicts your first post which says "my password was not the most secure". So which is it? Don't be so negative with me. I am just trying to help you understand how your account was hacked. Multiple possibilities: 1) The majority of MtGox users who were hacked were knowingly using insecure passwords. Not your case. 2) A smaller but still considerable fraction of users had a misconception of what a secure password is. May be your case. 3) Finally, a minority were using perfectly secure passwords (see examples in my last post). These users either shared passwords with other sites that have been hacked, or were phished (eg. even experienced IT security professionals may fall for tabnabbing (http://www.azarask.in/blog/post/a-new-type-of-phishing-attack)!), or were the victim of targeted attacks on their personal computers (eg. malware installing a keylogger). May be your case. Title: Re: [ATTN] Clarification of Mt Gox Compromised Accounts and Major Bitcoin Sell-Off Post by: mewantsbitcoins on July 03, 2011, 04:33:23 PM Attackers don't need to tie identities. Previously broken passwords are added to dictionary lists and are blindly tried against all newly leaked accounts. Previously broken passwords - yes, but I'm not talking about reusing passwords. I'm talking about patterns that help to derive passwords and remember them. And while some analyze these and add to their attacks, this is the case only in highly targeted attacks. Which this wasn't!Adding such patterns to general password cracking is just a waste of time and resources. This contradicts your first post which says "my password was not the most secure". So which is it? No it doesn't. I said it wasn't the most secure because it was not a random >60characters password I normally use which would take thousands of years to crack. This was the kind of password which could be broken in several decades. Don't be so negative with me. I am just trying to help you understand how your account was hacked. Multiple possibilities: 1) The majority of MtGox users who were hacked were knowingly using insecure passwords. Not your case. 2) A smaller but still considerable fraction of users had a misconception of what a secure password is. May be your case. 3) Finally, a minority were using perfectly secure passwords (see examples in my last post). These users either shared passwords with other sites that have been hacked, or were phished (eg. even experienced IT security professionals may fall for tabnabbing (http://www.azarask.in/blog/post/a-new-type-of-phishing-attack)!), or were the victim of targeted attacks on their personal computers (eg. malware installing a keylogger). May be your case. 1) No 2) I know it was secure. Even if attacker got my hash the day I registered they would not had the time to crack it. 3) My home network is monitored by snort 24/7, firewalls on my router and computers are properly configured to allow just the traffic I require. There are no unnecessary services running - I even disabled dhcp. Most of the browsing is done in VMs which are then shutdown and destroyed. So please keep your security 101 to yourself. I am not negative - I'm just realist. If you read my previous posts, you'll find that I was advocating Mt.gox and dismissing people complaining on this board about stolen funds from Mt.gox. At the time I had blind faith in Mark, but I was wrong. Go listen to the interview after the hack, read his statements - he was blatantly lying. And I believe he is still lying. While a move to this inferior and buggy platform and testing on production server maybe considered normal by such incompetent individual I think it indicates that Mt.gox is desperate and still has no fucking clue how attacker got in. Hiding this is irresponsible and will lead to disaster. Time will show Title: Re: [ATTN] Clarification of Mt Gox Compromised Accounts and Major Bitcoin Sell-Off Post by: mrb on July 03, 2011, 05:17:14 PM As one of the few users with ~1k posts on this forum, therefore a likely valuable Bicoin-rich target, I think you should envisage the possibility that you have been the victim of a targeted attack (not necessarily via an MtGox flaw). You wouldn't be the first one --you remember allinvain and his 25k BTC stolen... Even Snort + fw + browsing in a VM would not have protected you against, say, a tabnabbing phishing attempt. (I mention this example again because of how deceptively efficient it is...)
On the other hand, I have no idea how security-proficient you really are. You know Snort and firewalls, but the fact you exaggerate (few sites/apps accept "random >60characters password") makes it difficult for me to evaluate you. You say your MtGox pw was shorter than usual; would you mind sharing its exact length? Title: Re: [ATTN] Clarification of Mt Gox Compromised Accounts and Major Bitcoin Sell-Off Post by: mewantsbitcoins on July 03, 2011, 05:24:45 PM As one of the few users with ~1k posts on this forum, therefore a likely valuable Bicoin-rich target, I think you should envisage the possibility that you have been the victim of a targeted attack (not necessarily via an MtGox flaw). You wouldn't be the first one --you remember allinvain and his 25k BTC stolen... Even Snort + fw + browsing in a VM would not have protected you against, say, a tabnabbing phishing attempt. (I mention this example again because of how deceptively efficient it is...) On the other hand, I have no idea how security-proficient you really are. You know Snort and firewalls, but the fact you exaggerate (few sites/apps accept "random >60characters password") makes it difficult for me to evaluate you. You say your MtGox pw was shorter than usual; would you mind sharing its exact length? 22 I am aware of most type of attacks and know how to protect myself. I keep up to date with current exploits and am Backtrack user familiar and proficient with most tools in that distro. Title: Re: [ATTN] Clarification of Mt Gox Compromised Accounts and Major Bitcoin Sell-Off Post by: mrb on July 03, 2011, 05:39:23 PM A few passwords of length 22 or more have been discovered (none of them are yours):
Code: $1$vl6fKApv$FM4X4hc4oJMB7D6UsEzxN1:digitalcurrencypassword The first 3 passwords are concatenations of simple words with simple mangling rules (digits/symbols appended, and a capitalization) which could have been bruteforced somewhat easily. If your password was similar, then it was weak. However, if your password was similar to the others more complex ones, then one of these 3 possible explanations is true: http://forum.bitcoin.org/index.php?topic=24727.msg317542#msg317542 Title: Re: [ATTN] Clarification of Mt Gox Compromised Accounts and Major Bitcoin Sell-Off Post by: mewantsbitcoins on July 03, 2011, 06:00:37 PM I can tell this:
Dictionary attack would have been useless against my hash and attackers would not have had enough time for pure brute force attack even if they obtained unsalted md5. This leads me to think that this db dump is just a tip of the iceberg and that "clarification" is full of shit Title: Re: [ATTN] Clarification of Mt Gox Compromised Accounts and Major Bitcoin Sell-Off Post by: cypherdoc on July 03, 2011, 06:27:07 PM someone elsewhere said that if they got into mtgox system and already had everyones hashed passwords they wouldn't need the exact password b/c the system just looks to match the hashes. is this correct?
Title: Re: [ATTN] Clarification of Mt Gox Compromised Accounts and Major Bitcoin Sell-Off Post by: mrb on July 03, 2011, 07:31:04 PM cypherdoc: Correct. But cracking the hashes is still valuable due their re-use on other sites (Paypal, MyBitcoin, etc).
Title: Re: [ATTN] Clarification of Mt Gox Compromised Accounts and Major Bitcoin Sell-Off Post by: SpaceLord on July 03, 2011, 07:38:22 PM Now how about fixing my account?
Title: Re: [ATTN] Clarification of Mt Gox Compromised Accounts and Major Bitcoin Sell-Off Post by: Gandlaf on July 03, 2011, 09:34:16 PM https://mtgox.com/press_release_20110630.html Quote CLARIFICATION OF MT. GOX COMPROMISED ACCOUNTS AND MAJOR BITCOIN SELL-OFF Dear members of the press and Bitcoin community, I. Background March, 2011 – MtGox.com (Mt. Gox), now the world’s leading Bitcoin exchange, was purchased by Tibanne Co. Ltd. As part of the purchase agreement, for a period of time, Tibanne Co. Ltd was required to pay the previous owner a percentage of commissions. In order to audit and verify this percentage, the previous owner retained an admin level user account. This account was compromised. So far we have not been able to determine how this account’s credentials were obtained. ... Mark Karpeles - CEO Tibanne Co. Ltd. https://mtgox.com/press_release_20110630.html ... I'm sure Mark is very busy with mtgox so has been neglecting Kalyhost. Mistakes were obviously made but I don't think Mark is being greedy or incompetent here. He needs to hire more people and he knows this. But which if you have ever tried to do you know takes time which he doesn't have much of these days. Jed, obviously mistakes were made but given that these haven´t exactly been the first ones in MtGox´s history, it would be very interesting to know what percentage of commission you are taking and for what period of time, furthermore what your additional(finanicial) interests in MtGox still are. You´re message when handing it over(paraphrasing): I´m bored and I just dont want to invest that much time ( http://forum.bitcoin.org/index.php?topic=4187.0 (http://forum.bitcoin.org/index.php?topic=4187.0) ), was less than honest, especially given the fact that you were facing legal action in connection with prior inconsistencies( http://forum.bitcoin.org/index.php?topic=3712.0 (http://forum.bitcoin.org/index.php?topic=3712.0) ). Are you willing to verifiably disclose what your current interests in MtGox still are(does Mark actually have the funds to compensate for losses?; are you skimming off all the profits?) or are you going to keep this cloud of uncertainty hanging over MtGox customers and therefore the wider Bitcoin community? Title: Re: [ATTN] Clarification of Mt Gox Compromised Accounts and Major Bitcoin Sell-Off Post by: vectorvictor on July 03, 2011, 11:29:36 PM Also you would not be the first one to think your password was relatively secure when in fact it turned out to be complete crap (this guy (http://forum.bitcoin.org/index.php?topic=25389) claimed his password was secure, and even lied about its length, when it was in fact "rascal101"). To be fair, the account I pointed out was "XPiRX0". He might have used that as a second account for small trades, and had a main account "XPiRX" that was never cracked. There's no grounds for calling him a liar. Title: Re: [ATTN] Clarification of Mt Gox Compromised Accounts and Major Bitcoin Sell-Off Post by: jed on July 04, 2011, 12:02:19 AM Gandlaf: I didn't say I was bored with mtgox. I said I didn't have enough time to do it correctly. Kind of the opposite of bored.
I've never faced legal action because of anything having to do with mtgox. Baron was clearly lying since we have never heard from his lawyers. I haven't gotten any money from mtgox since the sale so there is no danger of not being able to cover this loss. Title: Re: [ATTN] Clarification of Mt Gox Compromised Accounts and Major Bitcoin Sell-Off Post by: cypherdoc on July 04, 2011, 12:13:57 AM Gandlaf: I didn't say I was bored with mtgox. I said I didn't have enough time to do it correctly. this is consistent with what Jed has told me in the past. Kind of the opposite of bored. I've never faced legal action because of anything having to do with mtgox. Baron was clearly lying since we have never heard from his lawyers. well, i guess that puts that one to rest. Title: Re: [ATTN] Clarification of Mt Gox Compromised Accounts and Major Bitcoin Sell-Off Post by: Gandlaf on July 04, 2011, 12:28:09 AM Gandlaf: I didn't say I was bored with mtgox. I said I didn't have enough time to do it correctly. Kind of the opposite of bored. I've never faced legal action because of anything having to do with mtgox. Baron was clearly lying since we have never heard from his lawyers. I haven't gotten any money from mtgox since the sale so there is no danger of not being able to cover this loss. So which part exactly did I get wrong? Because Mark seems to state quite clearly, that you a) were the auditor in question(with admin powers) and b) actually did receive money ? Is Mark (MagicalTux) lying in his statement? https://mtgox.com/press_release_20110630.html Quote CLARIFICATION OF MT. GOX COMPROMISED ACCOUNTS AND MAJOR BITCOIN SELL-OFF Dear members of the press and Bitcoin community, I. Background March, 2011 – MtGox.com (Mt. Gox), now the world’s leading Bitcoin exchange, was purchased by Tibanne Co. Ltd. As part of the purchase agreement, for a period of time, Tibanne Co. Ltd was required to pay the previous owner a percentage of commissions.In order to audit and verify this percentage, the previous owner retained an admin level user account. This account was compromised. So far we have not been able to determine how this account’s credentials were obtained. ... Mark Karpeles - CEO Tibanne Co. Ltd. https://mtgox.com/press_release_20110630.html Title: Re: [ATTN] Clarification of Mt Gox Compromised Accounts and Major Bitcoin Sell-Off Post by: jed on July 04, 2011, 01:06:05 AM Gandlaf: yes required to pay but not yet paid.
Title: Re: [ATTN] Clarification of Mt Gox Compromised Accounts and Major Bitcoin Sell-Off Post by: Gandlaf on July 04, 2011, 01:35:27 AM Gandlaf: yes required to pay but not yet paid. So your statement is, that MtGox currently does not even have the spare cash to pay the price/license fee currently, which you asked for as a fair price(when handing over MtGox) at a time when commissions were running a lot lower compared to todays rates and volumes? Essentially what you are saying is that MtGox´s current liquidity is (not) in question, but that MtGox is in debt to you, it´s original founder. If I get you right, Mark does not even have the cash to pay you for selling him the idea and the original platform? Apparently cash is so tight, that you have not received any money to date? Gandlaf: [...] I haven't gotten any money from mtgox since the sale so there is no danger of not being able to cover this loss. Can you conceive of any reason why customers of MtGox might find this slightly worrying? Title: Re: [ATTN] Clarification of Mt Gox Compromised Accounts and Major Bitcoin Sell-Off Post by: jed on July 04, 2011, 02:05:38 AM Gandlaf: No that isn't my statement. You seem to really want to misconstrue what you read. My statement is this:
MtGox has enough funds to cover any losses from the recently stolen coins and has enough to cover what it owes me to date. MtGox will cover any debt to its customers before it pays me. The fact that I haven't been paid yet has nothing to do with mtgox's ability to pay. It only has to do with the fact that neither I nor Mark have made time to complete the payment. Title: Re: [ATTN] Clarification of Mt Gox Compromised Accounts and Major Bitcoin Sell-Off Post by: Gandlaf on July 04, 2011, 02:35:17 AM Gandlaf: No that isn't my statement. You seem to really want to add to what you read. My statement is this: MtGox has enough funds to cover any losses from the recently stolen coins and has enough to cover what it owes me to date. MtGox will cover any debt to its customers before it pays me. The fact that I haven't been paid yet has nothing to do with mtgox's ability to pay. It only has to do with the fact that neither I nor Mark have made time to complete the payment. In that case, I do want to apologize for ever having even harboured the slightest doubts! You Jed, are quite obviously a saint(or as close as one gets nowadays without divine intervention). Giving up a multimillion dollar business, signing a contract, not insistiting on payment, it sounds like a fairytale. You must be a truely wonderful and completely selfless individual to just wait for payment for your idea if/when it comes. The only question for me would be the following: Why keep an admin account to audit payments, if everything is dandy, if your first concern is the bitcoin community and you really don´t want to see a penny before everyone has been paid? Furthermore, I don´t really get your final point: "The fact that I haven't been paid yet has nothing to do with mtgox's ability to pay. It only has to do with the fact that neither I nor Mark have made time to complete the payment." A BTC transfer should be fairly easy(if you don´t know how to do it just ask in the forum), or is it that you aren´t really willing to invest in BTC? In that case I do get it, the MtGox $1000 limit can be a bit of a nuisance. Apart from the technicalities, let me get this right: You did not make time for/to complete a payment with 6 or 7 figures(by early June)??? I love fairytales, but this response is BS. You would be a truly unique individual to just let a multimillion $ business go. So why not cut the crap and just disclose in how far you are still involved with MtGox? Title: Re: [ATTN] Clarification of Mt Gox Compromised Accounts and Major Bitcoin Sell-Off Post by: cypherdoc on July 04, 2011, 05:51:15 AM Gandlaf: No that isn't my statement. You seem to really want to add to what you read. My statement is this: MtGox has enough funds to cover any losses from the recently stolen coins and has enough to cover what it owes me to date. MtGox will cover any debt to its customers before it pays me. The fact that I haven't been paid yet has nothing to do with mtgox's ability to pay. It only has to do with the fact that neither I nor Mark have made time to complete the payment. In that case, I do want to apologize for ever having even harboured the slightest doubts! You Jed, are quite obviously a saint(or as close as one gets nowadays without divine intervention). Giving up a multimillion dollar business, signing a contract, not insistiting on payment, it sounds like a fairytale. You must be a truely wonderful and completely selfless individual to just wait for payment for your idea if/when it comes. The only question for me would be the following: Why keep an admin account to audit payments, if everything is dandy, if your first concern is the bitcoin community and you really don´t want to see a penny before everyone has been paid? Furthermore, I don´t really get your final point: "The fact that I haven't been paid yet has nothing to do with mtgox's ability to pay. It only has to do with the fact that neither I nor Mark have made time to complete the payment." A BTC transfer should be fairly easy(if you don´t know how to do it just ask in the forum), or is it that you aren´t really willing to invest in BTC? In that case I do get it, the MtGox $1000 limit can be a bit of a nuisance. Apart from the technicalities, let me get this right: You did not make time for/to complete a payment with 6 or 7 figures(by early June)??? I love fairytales, but this response is BS. You would be a truly unique individual to just let a multimillion $ business go. So why not cut the crap and just disclose in how far you are still involved with MtGox? look, Jed told me many months ago when i asked him why he sold mtgox that he was afraid of the legal ramifications of running an exchange. this is understandable for a US citizen given what the US gov't does to people who go against it. he also told me he was afraid of the technical challenges confronting an exchange and that Mark would be more suited to dealing with security issues. time has proven Jed correct insofar as his fears went. too bad for us that Mark wasn't as good as Jed had hoped but that certainly isn't his fault. Jed also doesn't stand to make a multimillion profit on his sale i'm willing to bet. so he really is just doing us all a favor by not collecting right now. Title: Re: [ATTN] Clarification of Mt Gox Compromised Accounts and Major Bitcoin Sell-Off Post by: csshih on July 04, 2011, 09:17:08 AM So why not cut the crap and just disclose in how far you are still involved with MtGox? maybe... he's not? yeesh.... Title: Re: [ATTN] Clarification of Mt Gox Compromised Accounts and Major Bitcoin Sell-Off Post by: hashman on July 05, 2011, 12:20:27 PM if i have to explain why a financial inst or gov't would want to drive down the price of btc to you heaven help you. Well, heaven help me then. Perhaps you could be my angel and tell me what you mean. Do these individuals have a target price in mind? Or do you mean they just want to break it? Breaking the network is not the same as driving the price down. Some of the institutions you mention want to drive the value of the dollar down. Is that for the same reason? Would a lower rate of USD per BTC make it easier for the number of real BTC transactions to grow? Somehow I feel (guessing) you are referring to currency monopolists who don't want to see any competition, but a lower price per BTC probably wouldn't make much difference to them. Anyway, I don't think that's what happened to MtGox in this instance. Title: Re: [ATTN] Clarification of Mt Gox Compromised Accounts and Major Bitcoin Sell-Off Post by: cypherdoc on July 05, 2011, 01:26:55 PM if i have to explain why a financial inst or gov't would want to drive down the price of btc to you heaven help you. Well, heaven help me then. Perhaps you could be my angel and tell me what you mean. Do these individuals have a target price in mind? Or do you mean they just want to break it? Breaking the network is not the same as driving the price down. Some of the institutions you mention want to drive the value of the dollar down. Is that for the same reason? Would a lower rate of USD per BTC make it easier for the number of real BTC transactions to grow? Somehow I feel (guessing) you are referring to currency monopolists who don't want to see any competition, but a lower price per BTC probably wouldn't make much difference to them. Anyway, I don't think that's what happened to MtGox in this instance. i apologize for being so dramatic. i am referring to fiat currency monopolists whose franchise would be threatened if not taken down by btc. i think they understand that a continually rising price of btc would attract significant attention (as it did on the way to 30) and encourages more bullish behavior and growth of a btc economy. yes its a conspiratorial theory but many ppl here on this forum can easily relate. again, i ask the same question, why wouldn't the hacker just have changed the withdrawal limit to unlimited and just stolen all the wallet keys asap? he instead ignored the wallet, and manipulated the DB to sell the price down to 0 over a 30 min time period risking potential intervention by Mark. i think Kevin Day and others who were able to take money out are just red herrings. Title: Re: [ATTN] Clarification of Mt Gox Compromised Accounts and Major Bitcoin Sell-Off Post by: makomk on July 05, 2011, 10:15:45 PM again, i ask the same question, why wouldn't the hacker just have changed the withdrawal limit to unlimited and just stolen all the wallet keys asap? he instead ignored the wallet, and manipulated the DB to sell the price down to 0 over a 30 min time period risking potential intervention by Mark. i think Kevin Day and others who were able to take money out are just red herrings. Why wouldn't a government or financial industry attacker have changed the withdrawal limit to unlimited and stolen all available bitcoins ASAP? Crashing the price to zero was spectacular, but in the longer term leaving Mt Gox without enough bitcoins to back its liabilities would be much more damaging...Title: Re: [ATTN] Clarification of Mt Gox Compromised Accounts and Major Bitcoin Sell-Off Post by: cypherdoc on July 05, 2011, 10:21:05 PM again, i ask the same question, why wouldn't the hacker just have changed the withdrawal limit to unlimited and just stolen all the wallet keys asap? he instead ignored the wallet, and manipulated the DB to sell the price down to 0 over a 30 min time period risking potential intervention by Mark. i think Kevin Day and others who were able to take money out are just red herrings. Why wouldn't a government or financial industry attacker have changed the withdrawal limit to unlimited and stolen all available bitcoins ASAP? Crashing the price to zero was spectacular, but in the longer term leaving Mt Gox without enough bitcoins to back its liabilities would be much more damaging...b/c that would be an international crime and as bad as they might be, i don't think they can afford to get caught stealing to accomplish their objectives. OTOH, if they were caught manipulating prices they could just write it off as "national security". Title: Re: [ATTN] Clarification of Mt Gox Compromised Accounts and Major Bitcoin Sell-Off Post by: makomk on July 05, 2011, 10:47:18 PM b/c that would be an international crime and as bad as they might be, i don't think they can afford to get caught stealing to accomplish their objectives. OTOH, if they were caught manipulating prices they could just write it off as "national security". Except whoever did this did steal enough money to get themselves in serious legal hot water already... not to mention all the money they attempted to steal and give away at knock-down prices.Title: Re: [ATTN] Clarification of Mt Gox Compromised Accounts and Major Bitcoin Sell-Off Post by: cypherdoc on July 05, 2011, 10:53:18 PM b/c that would be an international crime and as bad as they might be, i don't think they can afford to get caught stealing to accomplish their objectives. OTOH, if they were caught manipulating prices they could just write it off as "national security". Except whoever did this did steal enough money to get themselves in serious legal hot water already... not to mention all the money they attempted to steal and give away at knock-down prices.or the 2000 btc could be a concession to Kevin Day? Title: Re: [ATTN] Clarification of Mt Gox Compromised Accounts and Major Bitcoin Sell-Off Post by: phillipsjk on July 08, 2011, 03:06:32 AM Even Snort + fw + browsing in a VM would not have protected you against, say, a tabnabbing phishing attempt. (I mention this example again because of how deceptively efficient it is...) Just when I start to think I am being too paranoid leaving JavaScript disabled, I read this. I temporarily enabled JavaScript for complaining about that bitcoin trademark :/ Title: Re: [ATTN] Clarification of Mt Gox Compromised Accounts and Major Bitcoin Sell-Off Post by: DATA COMMANDER on July 08, 2011, 11:56:11 PM FWIW, MtGox claims that I never completed registration at their site, even though I not only completed registration but also bought 6 BTC under the handle datacommander.
Title: Re: [ATTN] Clarification of Mt Gox Compromised Accounts and Major Bitcoin Sell-Off Post by: mewantsbitcoins on July 09, 2011, 05:05:48 PM For fuck's sake - it's been more than three weeks and the server is still down. That's what I get for supporting someone in bitcoin business.
Stay away from Mt.gox and Kalyhost. They are scammers and incompetent beyond belief! Title: Re: [ATTN] Clarification of Mt Gox Compromised Accounts and Major Bitcoin Sell-Off Post by: cypherdoc on July 09, 2011, 05:50:53 PM For fuck's sake - it's been more than three weeks and the server is still down. That's what I get for supporting someone in bitcoin business. Stay away from Mt.gox and Kalyhost. They are scammers and incompetent beyond belief! i don't get it. i moved USD into mtgox on 7/1 and did a bunch of successful trades thru to 7/4. whats wrong with the server? Title: Re: [ATTN] Clarification of Mt Gox Compromised Accounts and Major Bitcoin Sell-Off Post by: bytemaster on July 11, 2011, 01:48:45 AM I have not been given access to my account and get no response from Mt. Gox.
Please, I encourage everyone to boycott MtGox who has effectively stolen thousands of dollars from many of their customers. Title: Re: [ATTN] Clarification of Mt Gox Compromised Accounts and Major Bitcoin Sell-Off Post by: jed on July 12, 2011, 12:14:45 PM bytemaster: go to freenode on irc #mtgox and ask for MagicalTux. He is there right now and will fix your problem.
Title: Re: [ATTN] Clarification of Mt Gox Compromised Accounts and Major Bitcoin Sell-Off Post by: bytemaster on July 14, 2011, 11:41:57 PM I have gotten access back, withdrew my money.
Title: Re: [ATTN] Clarification of Mt Gox Compromised Accounts and Major Bitcoin Sell-Off Post by: pointbiz on July 17, 2011, 06:53:07 PM A consistent message from Mark about this whole event was that it was Jed's fault.
Further clarification: Compromised Admin Level User Account = Jed's user account to access Mt.Gox public website as a trader. UserID of 1 from the leaked table of users. Point to consider: There were at least two admin level user accounts in the leaked table of users: UserID 1, Username: jed UserID 634, Username: MagicalTux My assumptions from mtgox's clarification: 1) There were administrative web pages as part of Mt gox's front-end PHP website code. 2) To access these administrative web pages Mark/Jed use the same user/password as their trader account and login from the public login form. 3) BTC balances in the mtgox system are not tied to balances of public keys in the block chain (therefore unbacked by BTC which leads to the temptation of a fractional reserve exchange). 4) These administrative pages allowed unlimited deposits of BTC to an admin's trader account. 5) These administrative pages did NOT allow the configuration of withdrawal limits. 6) The withdrawal limits for the system were hard coded in the PHP withdrawal pages. $1000 per withdrawal (not per 24 hours) as the infamous Kevin has informed us. Therefore, SQL injection in combination with an admin trader account would not allow access to modify PHP files. 7) The attacker did not have access to modify PHP files. 8 ) SQL injection attack occurred on the Login page because no other tables from the database were leaked. The login form would be reading from the users table. Why Jed is not at fault and Mark is 100% at fault: 1) Upon taking ownership of mtgox Mark recognized the database table with user and admin accounts had UNsalted MD5 passwords (read plaintext under 12 characters). 2) Mark should have removed admin accounts from the user table and created a separate table with admin level accounts. He should have created a separate login area for admin users. When a SQL injection attack is occurring the attacker is poking in the dark and is getting information little by little. Since only 1 table was leaked to the public, we can assume the attacker only knew about the users table. If admin accounts were stored in a different table their password hashes would not have been leaked. 3) Mark should have moved the administrative web pages to a separate server, the more isolation the better. He should not allow admins to login through the regular user login form. 4) Mark added user specific salts but did not add a secondary global salt that was hard coded in the PHP. If this salt existed the leaked users table would be useless!! 5) Mark did not audit the code for SQL injection vulnerabilities. Which were probably obvious from the use of embedded SQL and non-parameterized queries (red flags that you have a SQL injection door). 6) Mark did not close these vulnerabilities, probably less than 1 weeks work if not 2 days. If the attack occurred in April I'd have sympathy for Mark. 7) It's possible an earlier version of the leaked users table exists (unpublished) with the UNsalted MD5 passwords (before Mark took ownership, since we presume the same SQL injection door was open). However, Mark did not prompt users to CHANGE their passwords. Salting of already compromised passwords is pointless. 8 ) Mark did nothing to protect us from Jed (I'm not making any accusation of Jed here) 9) Upon taking ownership, Mark did not ask for a site wide password change with minimum password strength. 10) Mark could have implemented the salted SHA-512 (with user salt and global hard coded salt) then instructed Jed to change his password. Mark has been very deceptive and this clarification is somewhat different then the story Mark presented to Bruce Wagner in their interview. Mark is trying to let our imaginations run wild by saying he questions the motives of the hacker. And that the hacker could have stolen more. The reason the hacker couldn't withdraw more money was the same reason the infamous Kevin could not withdraw more. There were active normal traders on the site who saw the price at 0.01 USD and were willing to pay 0.50 USD per BTC. The window to withdraw was very limited. Finally, with no evidence from Mark, why should we assume it was Jed's account that was compromised and not Mark's ? Title: Re: [ATTN] Clarification of Mt Gox Compromised Accounts and Major Bitcoin Sell-Off Post by: cypherdoc on July 17, 2011, 07:22:29 PM because Jed has told me it was his acct that got hacked after the SQL injection.
still doesn't absolve Mark. Title: Re: [ATTN] Clarification of Mt Gox Compromised Accounts and Major Bitcoin Sell-Off Post by: John (John K.) on July 31, 2011, 02:21:16 PM Here we go again.. :-\
Title: Re: [ATTN] Clarification of Mt Gox Compromised Accounts and Major Bitcoin Sell-Off Post by: Aquent on April 30, 2014, 03:27:52 PM Interesting all this lack of information from both Jed and Mark all the way back.
Did Jed ever get paid? If so how much? How much was mtgox sold for exactly? Was the blockchain address of this account which withdrew 2k ever published? Title: Re: [ATTN] Clarification of Mt Gox Compromised Accounts and Major Bitcoin Sell-Off Post by: Bitcoinpro on April 30, 2014, 03:46:17 PM He is going to be know as the dude that was trying to play a game of Pacman with a disgruntled customer as he was trying to enter his office building,
the pacman pellets where the bitcoins, he had them firmly stashed in usb sticks contained in that black case he was carrying on his shoulder. The disgruntled customer should have grabbed that case of his shoulder for sure !!! |
