Bitcoin Forum

Dear Instawallet,

Yesterday I discovered a security flaw with your site, I spent nearly 6 hours working with David Francois Chief Technology Officer at Paymium

The security flaw impacted roughly 3000 people that use Instawallet and indirectly Paymimum, Paytunia, Instawire, and Bitcoin Central as all of these companies are yours.

After 6 hours of work, I can finally confirm that the security flaw is fixed. The security flaw was serious in my opinion, As all the URL’s of roughly 3000 people were publicly listed.

http://www.adaptiveglass.com/?p=656

Great to hear!

You should read the whole article... 

The day we institute a Bitcoin Citizen of the Month award, I nominate The Founder  :D

You can nominate me here:  1HByHZQ44LUCxxpnqtXDuJVmrSdrGK6Q2f

Seriously it's wrong what Instawallet did...  I spent a whole day fixing their crap.  they won't even say thanks or give me a Satoshi.

Agreed! Hat tip to you, sir.

Did you tell them up front that you'd be demanding payment?

LOL hat tip here:  1HByHZQ44LUCxxpnqtXDuJVmrSdrGK6Q2f

Seriously it would shove a thank you down their throat if people donated realizing I did what instawallet should have.

No I didn't care if it was payment or thank you (I would have liked payment more) but I got neither.

Well, maybe you should of told them first.  Would have probably saved you the time of posting this thread if you had.

My opinion : you should have tipped him generously while the topic was hot.
Now that it's cold and thefounder needs to publicly complain about your attitude you should thank him and pay him 6 hours of consulting time, that would be fair. Unless thefounder lies or exagerates the issue, which is hard to believe.
Just my opinion.

If the screenshots are true (likely) he just saved their business from total ruin. That flaw could have resulted in a 100% loss of Bitcoins for every single Instawallet user. It would have been the next Bitcoinica.

Moreover, that mistake is avoidable with a properly configured robots.txt, it sounds like a very basic mistake to me. That said, it's hard to cover your ass from all the possible mistakes. But that one... Quite a fail.

That's enough grandstanding, TheFounder. Kicking and screaming is going to push them to ignore you even more.

As for instawallet, they're probably embarrassed and considering how to respond. Give them time. What is it with this community and an inherent sense of entitlement?

We've heard that story many, many times already. "Due to a really basic mistake I accidentally all your bitcoins."

I would have been happy with a thank you,  if extorting them is wondering why I never got thanked then I take issue with your definition of extortion.


That's why I contacted them asap.

If that is true (I'm not saying it isn't) I think you diluted your message by including an address in you posts.

...or they found another issue and are scrambling to fix it. Or they want(ed) to give the OP a significant reward, but need approval from their investors/board/mom/whatever. Or their kid got sick. Who knows?

I'd have given it at least a week or two myself, and kept my mouth shut about the issue, in case there were more holes I didn't find let alone all the other possible reasons it's taken them more than a day to respond. Besides frankly I think a more appropriate thing to do is simply ask (privately) for credit for finding the issue rather than turning it into drama. Money is nice, but a good reputation is worth more in the long run.

Having said that... services should be rewarding people who find serious bugs, simply to encourage ethical reporting rather than exploitation.

Well, I've got nothing to do with Instawallet, nor do I use it.

But thank you anyway.

I want to know how Google found the wallets. Doesn't the fact the Google was even able to find them in the first place imply a deep security problem.
Unless Google found the wallets from data Chrome sent back...

Well, I don't know what the issue was with Instawallet, but even with Easywallet you can find a lot of wallets from Google. But they are not user wallets. Google robots can make as many wallets as they want but they won't contain anything.

If there was indeed a leak of user wallets, that is a serious issue to say the least.

There were coins in those wallets.   If someone less than honorable found that they could have easily yesterday cleared off $10,000 worth of bitcoins in a few minutes flat.

My understanding of the https protocol is that only the host name is visible to an attacker.  Once they are sure the site is locked down, I'd appreciate knowing what the specific vulnerability was.

I don't think it's a good idea to lay out how I fixed instawallet's problem,  but I am fairly certain that Google won't be spidering wallets unless my friends in France decide to do something they shouldn't.

The entire no-security concept of Instawallet seems broken by design.

Browsers and software in general seldom consider URLs to be secret. As a result, it is easy for many browser plugins or extensions to collect (listen to) every URL accessed by the browser, including https ones, and send them to some database. I also believe many cloud services may exchange bookmarks or such things without proper encryption.

Then, the result of the database can be crawled or indexed by any search engine, and spread across search engines. Legit ones follow the instructions of robots.txt, but non-legit ones could easily spy on Instawallet URLs.

As a software dev I just can't believe that instawallets are not secured by anything, their sole URLs can't be considered as securable, IMO.

That said, I can neither believe they didn't put the robots.txt from the very start, now they seem to have gone so far as to render their very homepage (https) unaccessible to Google!

As for the non-reward, it's also puzzling to say the least... like you bring back an opened safe that was "lost on the street" to a business owner and not getting anything in return, oh well... keep us posted.

i knew about this for for ages...

just google:  site:instawallet.org w

And you would get all the public urls...

Most urls were empty anyway.

One time in the early 90s my dad's car phone was stolen and he put up flyers saying "reward". He didn't reward the guy who brought it back.  So, there's that.

if that just happened maybe they were still investigating.   for instance, if a person knows how to get google to explicitly index an url, then maybe that person could make it look like a security vulnerability exists by creating and funding some wallets then asking instawallet for a reward for "discovering" it -- when no legitimate customer funds were at risk.

so you might be jumping to a conclusion.

Asking Google not to crawl sensitive pages is a basic foundation of privacy.

When I was halfway through reading your thread about it yesterday, and reading about "100 BTC maximum", Instawallet came to my mind, but the only thing I thought that could be exploitable was something like the form to send Bitcoins out of the wallet, or the API (which is very simple). It never occurred to me that it could be something so simple as Google indexing.
At the same time it makes me wonder; who would post loaded wallet URLs on a place Google could access (because search engines don't guess URLs)? Or should the question be the other way around: is Google getting URLs to scan from places other than web pages (e.g. Google Chat, Chrome...)?
Thanks for discovering googling the issue. It would be great if everyone followed your example.

That trick works on easywallet too. Hope you're as rich as I am.

That`s fun :) The mistake thing, not the situation it caused...nope, both are fun :)
According to what has been said, mistake was stupid, so I guess it was connected with referrer flaw - there was an external resource on page or link to some google service.

Wow, over 900 wallets exposed at easywallet using the same trick....!

I haven't used those online wallets before. Are they just supposed to be for quick, in-and-out kinds of transactions?

LOL!  :D

Robots.txt is not for security. It is for obscurity!

This attack will happen sooner or later, google or no google.  ::)

It is too easy if you just need a URL

I think you hit the nail on the head.  Your browser history/bookmarks are not considered "secret" and plugins may be able to access it.  Once a less than honorable plugin has your history data they can just scan it for "instawallet" and report back all your wallets.

I'm guessing these URLs were gathered from Google chrome data collection.

They really need to stick a password on wallets.

is instawallet really that bad?

here is my wallet :)

https://instawallet.org/w/youcanputanyrandomkeyandddosthemcool

they also say they have 3,465,851 wallets, now that is huge

This shit really happened?  :o

considering your good intentions in working with the team at instawallet to fix their problem, don't you think it would also be a good idea to proactively help others avoid making the same mistakes? i don't want to make any assumptions as to why they neglected to offer so much as a thank you, but this news is disturbing to myself and i'm sure others as to what google (bing, yahoo, etc) are doing behind the curtain that could be exposing this community to security risks.

i'd actually be much more interested in the cause than the fix anyway.

Users can't protect from that.
Google indexed 3k wallets. You could see them just by typing site:instawallet.org

No, I didn't steal anything and yes, Google removed the links.

I remember this exact same thing happening last year.
Already searched the forum and couldn't find anything.

This issue has already been discussed a few times here: https://coinad.com/?m=chat (https://coinad.com/?m=chat)

Also, Google doesn't magically get those links.
Someone must have posted them online somewhere.

The cause is honestly two fold ,  a lack of SEO experience on Instawallet's side,  and a lack of complete honesty from Google's side.

Google's Definition of Robots.Txt file isn't what you guys think it is.

1. You guys all believe it's not a "do not list these directories and pages"  
2. Google's definition is "do not spider these directories and pages"

They are NOT the same definition.  Not even close.

.htaccess is king when if comes to that.

that's pretty much how i understood it. what i don't get (and the million bitcoin question) is how did google manage to index 3000 random urls in the first place?

i can only assume that it was a related google service acting stealthily on the site (e.g. analytics, google+, etc). again, i'm not so concerned about how you fixed it, so much as to how it happened in the first place.

if this turns out to be an issue that could affect my own business, i'd be more than willing to donate to ur discovery.

Deal!  what's your business url and I will let you know via PM.  If it is client impacting and is helpful for you then send me some coins.  I dont' think they were random either..  I strongly suspect I know what did it and you're going down the right path asking questions if Anaylitics, Google+, Google Chat, Gmail, etc were to blame.


That is one way to fix it,  but it's not the only way ... .htaccess is sort of like a broad sword last ditch coverage attempt...  IE: plan C (if A and B fail) but definitely one of the right things to do because we're all human and we really can never catch everything.

well... i just discovered your other thread regarding this topic and i'm beginning to have my doubts
https://bitcointalk.org/index.php?topic=159025.msg1695310#msg1695310

honestly, until you convince me otherwise this appears to be a whole lot of FUD.

i'm fairly certain that i would have little to no exposure to a similar security risk, given the design of my site and the fact that i don't use ANY google services and have no intention of doing so (but, i'm still guessing as to the basis of your find).

my motivation here is to encourage others to "do the right thing" and report bugs, flaws, etc when they find them; instead of trying to exploit them for profit; and in turn be rewarded for their service. i believe a bug/flaw reward program is something that more companies should offer, especially in the high security, high value world that is Bitcoin.

our service, currently in development is:
https://www.btcvillage.nl
and until i have an opportunity to publish a formal reward program (certainly before we launch), i welcome you (and anyone else for that matter) to review our platform and report their findings. and i can assure that i WILL be grateful for ANY valid discoveries and show my appreciation with a reasonable amount of monetary compensation

Davouts profile says he won't be around until Mar 31, though I doubt he will give you a penny anyways. Read this for future disclosure of security holes to vendors, and why you shouldn't do anything because you'll just get fucked one way or another http://www.wired.com/opinion/2012/11/hacking-choice-and-disclosure/

Right now Instawallet doesn't refer anything from out of its domain, and even links to outgoing sites are protected behind a redirect wall to prevent the target websites from getting the wallet URL in the referrer. But don't forget that Instawallet had another owner and previously had a different design, and they may have at some point used Google Analytics or a G+ share button. It would be good to know what's the age of the wallets that were indexed by Google (so we could link them to a certain timespan). And some simple experiences are enough to find out if Google parses chat and emails for URLs and crawls them (create random address on your server, post it nowhere but on a email/chat and wait for a Googlebot hit).

good point. didn't notice that before.
raises the question, what exactly did the OP do? LOL

Google Webmaster Tools
Ban Directory from being listed (not indexed, listed)

I'm locking this thread.