|
Title: I suspect GPUMax was compromised and passwords stolen Post by: Nefario on June 02, 2012, 11:45:30 AM In the last 24 hours there have been two GLBSE accounts (that I know of) that have been cleared out.
The common theme between them is that both users had GPUMax accounts, with passwords that were either the same (as the GLBSE accounts password) or similar. I emailed the GPUMax website yesterday (the email in their whois records as there isn't anything on the site) to inform them of this. Since I've not seen any notice regarding GPUMax I feel that it is my responsibility to bring this to public attention. If you have a GPUMax account it is highly likely that it's password has somehow been compromised. If you use the same or a similar password elsewhere (GLBSE, MtGox, Email whatever) please change them now. If you are a GLBSE user I would encourage you to use two-factor authentication, there have already been over 3 accounts which have been protected by this. Nefario. Title: Re: I suspect GPUMax was compromised and passwords stolen Post by: imsaguy on June 02, 2012, 12:30:16 PM In the last 24 hours there have been two GLBSE accounts (that I know of) that have been cleared out. The common theme between them is that both users had GPUMax accounts, with passwords that were either the same (as the GLBSE accounts password) or similar. I emailed the GPUMax website yesterday (the email in their whois records as there isn't anything on the site) to inform them of this. Since I've not seen any notice regarding GPUMax I feel that it is my responsibility to bring this to public attention. If you have a GPUMax account it is highly likely that it's password has somehow been compromised. If you use the same or a similar password elsewhere (GLBSE, MtGox, Email whatever) please change them now. If you are a GLBSE user I would encourage you to use two-factor authentication, there have already been over 3 accounts which have been protected by this. Nefario. If the people used the same or similar password on 2 sites, isn't it reasonable to expect that they used it on other sites as well? Title: Re: I suspect GPUMax was compromised and passwords stolen Post by: cunicula on June 02, 2012, 12:37:35 PM Perhaps nothing is compromised, but it is just the operator exploiting his password haul?
Title: Re: I suspect GPUMax was compromised and passwords stolen Post by: pirateat40 on June 02, 2012, 12:50:20 PM We have a lot of users and I guess since your users have a GPUMAX account with the "same" password it must have been us that leaked them. If users are using the same password on GLBSE and GPUMAX, you can be pretty sure they're using the same password for other sites as well.
Our users information is hashed and salted using the latest cryptography methods available. I can assure you, we didn't leak anything. On a side note, considering you know who runs GPUMAX, you could have easily sent me PM before spreading more FUD in the market. Edit: -pirate Title: Re: I suspect GPUMax was compromised and passwords stolen Post by: cunicula on June 02, 2012, 01:23:00 PM In the last 24 hours there have been two GLBSE accounts (that I know of) that have been cleared out. The common theme between them is that both users had GPUMax accounts, with passwords that were either the same (as the GLBSE accounts password) or similar. I emailed the GPUMax website yesterday (the email in their whois records as there isn't anything on the site) to inform them of this. Since I've not seen any notice regarding GPUMax I feel that it is my responsibility to bring this to public attention. If you have a GPUMax account it is highly likely that it's password has somehow been compromised. If you use the same or a similar password elsewhere (GLBSE, MtGox, Email whatever) please change them now. If you are a GLBSE user I would encourage you to use two-factor authentication, there have already been over 3 accounts which have been protected by this. Nefario. If the people used the same or similar password on 2 sites, isn't it reasonable to expect that they used it on other sites as well? The question should be what percentage of GBLSE users also use GPUmax? If this percentage is very low, then Nefario is probably right. Title: Re: I suspect GPUMax was compromised and passwords stolen Post by: Nefario on June 02, 2012, 01:31:01 PM We have a lot of users and I guess since your users have a GPUMAX account with the "same" password it must have been us that leaked them. If users are using the same password on GLBSE and GPUMAX, you can be pretty sure they're using the same password for other sites as well. Our users information is hashed and salted using the latest cryptography methods available. I can assure you, we didn't leak anything. On a side note, considering you know who runs GPUMAX, you could have easily sent me PM before spreading more FUD in the market. Edit: Our whois lists support@gpumax.com which shows nothing from you or anything related to security. -pirate Quote Message-ID: <4FC78BDE.7080708@gmail.com> Date: Thu, 31 May 2012 16:18:54 +0100 From: Doctor Nefario <doctor.nefario@gmail.com> User-Agent: Mozilla/5.0 (X11; Linux i686; rv:8.0) Gecko/20111124 Thunderbird/8.0 MIME-Version: 1.0 To: support@gpumax.com Subject: your site may have been compromised X-Enigmail-Version: 1.3.4 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit There is a high chance that gpumax.com, or the database with users passwords have been compromised. A GLBSE use has had their account logged into and cleared out, they were using the same login details they use for GPUMax. Thought you should know. Nefario I was not aware GPUMax was run by you, I've had no interest use or need of the service and still don't, I'm only reporting the information I have available. Title: Re: I suspect GPUMax was compromised and passwords stolen Post by: terrytibbs on June 02, 2012, 01:35:00 PM I'll give Dr. Nefario the win for this round.
Round two... fight! Title: Re: I suspect GPUMax was compromised and passwords stolen Post by: rjk on June 02, 2012, 01:35:13 PM What kind of anti-bot protections does GPUMAX have to prevent automated password retries, if any?
Title: Re: I suspect GPUMax was compromised and passwords stolen Post by: pirateat40 on June 02, 2012, 02:05:40 PM Confirmed, found your email in spam. Don't know how you got there but I'm sorry about jumping the gun.
Title: Re: I suspect GPUMax was compromised and passwords stolen Post by: Raoul Duke on June 02, 2012, 02:11:50 PM Confirmed, found your email in spam. Don't know how you got there but I'm sorry about jumping the gun. Spam filters have the terrible habit of sending to spam any email that mentions the word "password" in them And the subject line being "your site may have been compromised" also helped lol Title: Re: I suspect GPUMax was compromised and passwords stolen Post by: Nefario on June 02, 2012, 02:33:15 PM Also regarding hashing and salting passwords, the only secure method is to use BCrypt with a sufficient number of rounds.
MD5, SHA256 (or whatever) hashed hundreds of times simply isn't enough(all these hashing also's were meant to be fast), it also depends on what code you are using for this. Is it a tried and tested library you're using or did you write your own crypto code? If it's not BCrypt and a well used library you're using then it's certainly not secure, the latest crypto-methods are not the best, the ones that are tried and tested are(think AES, RSA, and in this case BCrypt). Title: Re: I suspect GPUMax was compromised and passwords stolen Post by: BTCurious on June 02, 2012, 02:57:25 PM For the record, did you suspend withdrawals or is it just the hot wallet that's empty? I did a withdrawal (legit, 2-factor'd) but it's not on the blockchain or in my history. It's deducted from my account though. I sent an email to support before I knew about the stolen password issue.
Title: Re: I suspect GPUMax was compromised and passwords stolen Post by: terrytibbs on June 02, 2012, 02:58:15 PM For the record, did you suspend withdrawals or is it just the hot wallet that's empty? I did a withdrawal (legit, 2-factor'd) but it's not on the blockchain or in my history. It's deducted from my account though. I sent an email to support before I knew about the stolen password issue. It usually takes a while.Title: Re: I suspect GPUMax was compromised and passwords stolen Post by: DeathAndTaxes on June 02, 2012, 03:03:21 PM Also regarding hashing and salting passwords, the only secure method is to use BCrypt with a sufficient number of rounds. Yeah I am getting tired of this never ending stream of Bitcoin sites claiming they stored passwords properly yet users should change their passwords because their password db was stolen. If you properly protect your password db and set realistic min password lengths then it shouldn't matter if you are compromised. The salted passwords are worthless. Title: Re: I suspect GPUMax was compromised and passwords stolen Post by: Endgameuser on June 02, 2012, 03:08:33 PM In the last 24 hours there have been two GLBSE accounts (that I know of) that have been cleared out. How do you know it wasn't the GLBSE database that was compromised? Or some third party website? No offence Nefario but you're really jumping to conclusions hereThe common theme between them is that both users had GPUMax accounts, with passwords that were either the same (as the GLBSE accounts password) or similar. I emailed the GPUMax website yesterday (the email in their whois records as there isn't anything on the site) to inform them of this. Since I've not seen any notice regarding GPUMax I feel that it is my responsibility to bring this to public attention. If you have a GPUMax account it is highly likely that it's password has somehow been compromised. If you use the same or a similar password elsewhere (GLBSE, MtGox, Email whatever) please change them now. If you are a GLBSE user I would encourage you to use two-factor authentication, there have already been over 3 accounts which have been protected by this. Nefario. Title: Re: I suspect GPUMax was compromised and passwords stolen Post by: DeathAndTaxes on June 02, 2012, 03:08:45 PM You really think bcrypt makes a difference when users use the same password all over the place? And no, bcrypt is not "the only secure method." There is no secure method. That kind of thinking leads to compromised applications and systems. Of course it does. If ever site properly protected their password list it would have no value. As far as bcrypt is not secure please explain to me how you would brute force an 8 digit bcrypt (work=12) password? Pretty simple to keep passwords secure. a) use bcrypt (period, unless you have a degree in cryptography anything scheme you can "think" of likely has a couple dozen flaws which are already solved by bcrypt)* b) require 8 digit password c) check passwords against "common password list" d) periodically update the worklevel of bcrypt to keep up with Moore's law * an alternative to bcrypt are PBKDF2 (Password-Based Key Derivation Function) and scrypt. Unless you have a pressing reason I would still recommend bcrypt. scrypt is relatively untested and PBKDF2 uses at its heart SHA-2 which we all know is masively parallelizable. Title: Re: I suspect GPUMax was compromised and passwords stolen Post by: rjk on June 02, 2012, 03:44:37 PM Question: when is someone going to invent a be-all, end-all service that is totally full of awesome and win, and then decide to force all users to use a proper 2-factor authentication system? It needs to happen, and the day it does happen is the day many people realize that it really isn't as hard as they thought, and increase their security awareness accordingly. People are stupid, so they need to be forced to make the right choices, and not conditioned to believe that what happens now is "good enough".
Title: Re: I suspect GPUMax was compromised and passwords stolen Post by: Sukrim on June 02, 2012, 04:42:37 PM The killer service that everyone wants and that highly recommends/nearly requires 2 factor auth is for example World of Warcraft + Diablo III.
Even my web banking account doesn't force me to do 2 factor auth... People are just too lazy/stupid for that. Facebook, Google - you name it, they offer 2FA! I have yet to actually see anyone reaching for their mobile phone though when going on FB or gmail. Back to topic: What leads to GPUMax just from a handful of GLBSE accounts being emptied? What about other potential big account pools like deepbit? Title: Re: I suspect GPUMax was compromised and passwords stolen Post by: Daily Anarchist on June 02, 2012, 05:36:59 PM I'd love to use two factor auth, but I don't even have a cell phone. Are there other ways to do two factor auth? And are there any plans to implement them soon? I hope so.
Title: Re: I suspect GPUMax was compromised and passwords stolen Post by: bitlane on June 02, 2012, 05:44:44 PM The common theme between them is that both users had GPUMax accounts, with passwords that were either the same (as the GLBSE accounts password) or similar. That is some fine deductive reasoning....completely obvious if you ask me, ALTHOUGH, before pointing your finger, couldn't you have put another 2 minutes of Detective work into formulating your conclusion for all of this ? Perhaps in common, they also had BTC-E accounts ? BitcoinTalk.org accounts ? Common Email providers ? .....used a wallet address as a password ? If you have a GPUMax account it is highly likely that it's password has somehow been compromised. Obviously....If you use the same or a similar password elsewhere (GLBSE, MtGox, Email whatever) please change them now. This smells too much like a weakness on YOUR end and an attempt to cover tracks by asking people to change passwords.If you are a GLBSE user I would encourage you to use two-factor authentication, there have already been over 3 accounts which have been protected by this. Over 3 ? .....as in, 4 accounts ?This entire thread is horse shit. Considering the growing pains that the GLBSE has gone through, you should be the last one to point fingers at anyone else. PS. WTF does this have to do with 'Project Development' ? Title: Re: I suspect GPUMax was compromised and passwords stolen Post by: molecular on June 02, 2012, 05:46:50 PM If you are a GLBSE user I would encourage you to use two-factor authentication, there have already been over 3 accounts which have been protected by this. nefario. this is great, so your effort already payed off. congrats! Title: Re: I suspect GPUMax was compromised and passwords stolen Post by: REF on June 02, 2012, 05:51:19 PM Im sure he also asked if they had other accounts besides GPUmax. From what I see he did nothing wrong. He even tried contacting pirate, when he got no response he gave a warning to the community.
I'd love to use two factor auth, but I don't even have a cell phone. Are there other ways to do two factor auth? And are there any plans to implement them soon? I hope so. I dont remember where I saw the link but recently nefario posted a link to google auth desktop version. Title: Re: I suspect GPUMax was compromised and passwords stolen Post by: bitlane on June 02, 2012, 05:58:54 PM Im sure he also asked if they had other accounts besides GPUmax. From what I see he did nothing wrong. He even tried contacting pirate, when he got no response he gave a warning to the community. I'd love to use two factor auth, but I don't even have a cell phone. Are there other ways to do two factor auth? And are there any plans to implement them soon? I hope so. I dont remember where I saw the link but recently nefario posted a link to google auth desktop version. No, the right thing would have been to tell people to check their passwords and not blindly tell them (as I quoted above) that GPUMAX was to blame for this. Title: Re: I suspect GPUMax was compromised and passwords stolen Post by: rjk on June 02, 2012, 06:12:21 PM I'd love to use two factor auth, but I don't even have a cell phone. Are there other ways to do two factor auth? And are there any plans to implement them soon? I hope so. Several ways. Yubikey is my personal favorite, but here is a bunch of links:http://yubico.com/ <-- The makers of the Yubikey http://www.symantec.com/verisign/vip-authentication-service <-- paid service that PayPal and many others use for authentication. Yubico makes a credential that is compatible with this service as well. http://onlinenoram.gemalto.com/ <-- TOTP token that AWS uses for authentication, made by Gemalto. This is a dedicated device that can do the same thing as Google Auth, without the phone. http://motp.sourceforge.net/#7 <-- links to lots of tokens and related software. https://lastpass.com/ <-- password storage software that works on almost any platform and almost any browser, and that can use 2-factor auth for logging in. Title: Re: I suspect GPUMax was compromised and passwords stolen Post by: imsaguy on June 02, 2012, 06:23:22 PM How many of those users had bitcoinica accounts?
Title: Re: I suspect GPUMax was compromised and passwords stolen Post by: bitlane on June 02, 2012, 06:48:08 PM How many of those users had bitcoinica accounts? Please stay on topic. This is clearly GPUMAX's fault (as stated in the first post). It couldn't possibly have anything to do with another service ::) ...I mean, just look at GPUMAX's (and Pirate's....in general) track record when it comes to security and loss. Please re-apply tunnel vision and/or add blinders to continue this conversation ;) Title: Re: I suspect GPUMax was compromised and passwords stolen Post by: Stephen Gornick on June 02, 2012, 07:14:49 PM Probably unrelated, but just wanted to bring it up in case it is relevant:
"My mtgox account got compromised, what can I do?" [June 1, 2012] - http://bitcointalk.org/index.php?topic=84585.0 Title: Re: I suspect GPUMax was compromised and passwords stolen Post by: FreeMoney on June 02, 2012, 07:44:58 PM How many of those users had bitcoinica accounts? Title: Re: I suspect GPUMax was compromised and passwords stolen Post by: TT on June 02, 2012, 07:51:12 PM I've been proposing the following:
Withdrawal to bitcoin address is the exchange function/API call that is most prone to theft. Other withdrawal methods have at least some level of traceability and/or reversibility. Therefore, I propose the following solution: 1) create a completely separate right for both the web and the API for withdrawal to bitcoin address, separate from all the other withdrawal methods. 2) allow the owner of the account to have a whitelist of bitcoin addresses to which it is allowed to withdraw from both the web AND the API. 3) require two-factor authentication for adding or removing addresses to and from the whitelist. This simple feature means that even in the event of an attacker gaining access to the user's web dashboard or the user's API keys, the attacker will not be able to withdraw bitcoins to addresses of his choice. Simple fix to a significant security risk. https://bitcointalk.org/index.php?topic=84585.msg937236#msg937236 Please, exchanges, implement this SOON. You cannot implement it soon enough. Title: Re: I suspect GPUMax was compromised and passwords stolen Post by: smickles on June 02, 2012, 10:09:18 PM http://yourlogicalfallacyis.com/false-cause (http://yourlogicalfallacyis.com/false-cause)
Title: Re: I suspect GPUMax was compromised and passwords stolen Post by: rjk on June 02, 2012, 10:14:08 PM http://yourlogicalfallacyis.com/false-cause (http://yourlogicalfallacyis.com/false-cause) "cum hoc ergo propter hoc"<3 latin Title: Re: I suspect GPUMax was compromised and passwords stolen Post by: Phinnaeus Gage on June 03, 2012, 01:35:02 AM http://yourlogicalfallacyis.com/false-cause (http://yourlogicalfallacyis.com/false-cause) They always blame the pirate, don't they? http://bp2.blogger.com/_88oeleTBYyo/Rr_Eqlyr3NI/AAAAAAAABIM/-UTzZvfIj_4/s400/Blog-Pirate-1_8-12-07.jpg Title: Re: I suspect GPUMax was compromised and passwords stolen Post by: Math Man on June 03, 2012, 01:54:43 AM I think this thread belongs in the "speculation" sub-category. Better yet, create a "wild speculation" sub-category. It would fit better there.
Title: Re: I suspect GPUMax was compromised and passwords stolen Post by: FreeMoney on June 03, 2012, 04:39:56 AM The title needs to be changed imo.
Title: Re: I suspect GPUMax was compromised and passwords stolen Post by: dave3 on June 03, 2012, 06:40:30 AM Several ways. Yubikey is my personal favorite, but here is a bunch of links: http://yubico.com/ <-- The makers of the Yubikey http://www.symantec.com/verisign/vip-authentication-service <-- paid service that PayPal and many others use for authentication. Yubico makes a credential that is compatible with this service as well. http://onlinenoram.gemalto.com/ <-- TOTP token that AWS uses for authentication, made by Gemalto. This is a dedicated device that can do the same thing as Google Auth, without the phone. http://motp.sourceforge.net/#7 <-- links to lots of tokens and related software. https://lastpass.com/ <-- password storage software that works on almost any platform and almost any browser, and that can use 2-factor auth for logging in. Do you know if you can use the same yubikey for several different services, or do you need to get a separate one for each account? Title: Re: I suspect GPUMax was compromised and passwords stolen Post by: Stephen Gornick on June 03, 2012, 06:44:55 AM Do you know if you can use the same yubikey for several different services, or do you need to get a separate one for each account? The Yubikey from Mt. Gox can only be used with Mt. Gox (and BlockChain.info wallet, apparently, which I'm guessing has permission to auth through Mt. Gox API or something) It doesn't work on other services where a Yubikey is used. The Yubikey from Yubico works Title: Re: I suspect GPUMax was compromised and passwords stolen Post by: rjk on June 03, 2012, 11:03:55 AM Do you know if you can use the same yubikey for several different services, or do you need to get a separate one for each account? The Yubikey from Mt. Gox can only be used with Mt. Gox (and BlockChain.info wallet, apparently, which I'm guessing has permission to auth through Mt. Gox API or something) It doesn't work on other services where a Yubikay is used. The Yubikey from Yubico works at Mt. Gox and elsewhere where Yubikeys are supported. However, any website that uses the free service provided by Yubico for authentication will support a generic device ordered from Yubico. Title: Re: I suspect GPUMax was compromised and passwords stolen Post by: molecular on June 03, 2012, 12:04:31 PM How many of those users had bitcoinica accounts? +3 funny, FreeMoney Title: Re: I suspect GPUMax was compromised and passwords stolen Post by: Aseras on June 03, 2012, 06:43:07 PM There is no perfect way. As soon as you make one someone else wind find a way to break it or work around it. If its accessible in any form. Someone can break in.
Title: Re: I suspect GPUMax was compromised and passwords stolen Post by: FreeMoney on June 03, 2012, 09:34:51 PM There is no perfect way. As soon as you make one someone else wind find a way to break it or work around it. If its accessible in any form. Someone can break in. Give up human! Title: Re: I suspect GPUMax was compromised and passwords stolen Post by: BlackBison on June 06, 2012, 09:01:23 AM I've been proposing the following: Withdrawal to bitcoin address is the exchange function/API call that is most prone to theft. Other withdrawal methods have at least some level of traceability and/or reversibility. Therefore, I propose the following solution: 1) create a completely separate right for both the web and the API for withdrawal to bitcoin address, separate from all the other withdrawal methods. 2) allow the owner of the account to have a whitelist of bitcoin addresses to which it is allowed to withdraw from both the web AND the API. 3) require two-factor authentication for adding or removing addresses to and from the whitelist. This simple feature means that even in the event of an attacker gaining access to the user's web dashboard or the user's API keys, the attacker will not be able to withdraw bitcoins to addresses of his choice. Simple fix to a significant security risk. https://bitcointalk.org/index.php?topic=84585.msg937236#msg937236 Please, exchanges, implement this SOON. You cannot implement it soon enough. +1. Nefario it would be great if you could get this put on glbse. Title: Re: I suspect GPUMax was compromised and passwords stolen Post by: molecular on June 06, 2012, 02:51:54 PM I've been proposing the following: Withdrawal to bitcoin address is the exchange function/API call that is most prone to theft. Other withdrawal methods have at least some level of traceability and/or reversibility. Therefore, I propose the following solution: 1) create a completely separate right for both the web and the API for withdrawal to bitcoin address, separate from all the other withdrawal methods. 2) allow the owner of the account to have a whitelist of bitcoin addresses to which it is allowed to withdraw from both the web AND the API. 3) require two-factor authentication for adding or removing addresses to and from the whitelist. This simple feature means that even in the event of an attacker gaining access to the user's web dashboard or the user's API keys, the attacker will not be able to withdraw bitcoins to addresses of his choice. Simple fix to a significant security risk. https://bitcointalk.org/index.php?topic=84585.msg937236#msg937236 Please, exchanges, implement this SOON. You cannot implement it soon enough. +1. Nefario it would be great if you could get this put on glbse. you can already activate 2-factor withdrawal on glbse... oh, via API, hmm, didn't check that. Is it possible to withdraw without 2-factor-auth using the api even if it's activated for withdrawals? Title: Re: I suspect GPUMax was compromised and passwords stolen Post by: Nefario on June 06, 2012, 10:04:12 PM You cannot withdraw using the API.
Title: Re: I suspect GPUMax was compromised and passwords stolen Post by: molecular on June 08, 2012, 12:58:40 PM You cannot withdraw using the API. thanks for clarifying. Title: Re: I suspect GPUMax was compromised and passwords stolen Post by: MPOE-PR on October 02, 2012, 01:08:09 PM Question: when is someone going to invent a be-all, end-all service that is totally full of awesome and win, and then decide to force all users to use a proper 2-factor authentication system? This has happened, except it forces users to use gpg not worthless 2fa. And the users complain about the ease-of-use, customer service, and personality of exchange manager. |
