Bitcoin Forum

Hey !

I've been writing a security review for poloniex those last few days.
Sorry for my poor english  :-[
https://www.pdf-archive.com/2016/10/15/poloniex/poloniex.pdf

Post it in public, so POLONIEX could get hacked and almost $1 Billion dollar worth of ALTS/BTC get hacked.


GOOD JOB!!!

I didn't release any unfixed Poloniex vulnerability but I think that customers have to know Poloniex is unsecure and do not even reply to people reporting them vulnerability ;)

Yes, but I believe you could take this to busoni, OMK, MICKD, MOBY DICK or someother admin of POLO through their IRC chat

I'm waiting reply since 27 days.
I've been pushing my ticket via moderator more than 6+ times. They are literally having fun of me.
That's why I wanted to share this review to show the irresponsability of their team.

Do you have some proof regarding the above statement, If you can provide that we do need to be more cautions while using poloniex to trade. But how will such a famous site ignore their security vulnerability, Which might cause them to loose members.

Yep we had our lessons from mt gox bitfinex but we will never remember anything after the heat reduces, But as far as bitcoins and altcoins trading we have to rely on some trading platforms online.

I can provide screen, but we cannot really consider it a proof as the source code can be edited to modify data.
I have also some e-mail that I sent to Poloniex.

Well written FUD, none of those are actual vulnerabilities. They probably stopped responding to you because this is complete nonsense.

Could you please tell me where is the nonsense ? Where is the FUD ? Please quote me where I'm wrong in my review and arguments a little more ...

They paid you a bounty for the one bug you found, which wasn't much of a security risk really. The others are not bugs and they are not paying you a bounty for them. That said, what is your goal from making this information public? It's clearly an an attempt to FUD, probably in hopes that Polo will pay you for your "bugs" in the future for fear you will spread more FUD about them.

I would actually be very interested to know if Poloniex and other sites ever did actual security auditing.
They would be foolish not to pay for this type of service,
but nothing would surprise me with these exchanges.

I actually asked a question regarding security on these exchanges a week or two ago and got zero replies in the thread lol.
No one cares about security until millions of dollars in coins go missing.

You should really consult security pentester. They will all agree with my arguments.
As a matter of fact, I described a possible attack in my article, which, when I got the trollbox moderator privilege escalation (which wasn't mush of a security risk ? lol ?), I was able to spread clickable buying, selling, withdraw and lending links. Sorry, but I think it is a serious vulnerability don't you ?

Don't you think I deserved, not a bounty, but maybe something like a ... reply ? "Thanks, we've corrected this bug, rest assure you can trade on Poloniex safety" ? It is the strict minimum.

I do not expect any bounty from poloniex, your theory of the conspiracy sounds a little too much.

Proof of concept links, you wouldn't have had valid hashes.
"..what is your goal from making this information public?"

That's the major problem ! There is no csrf tokens or "valid hashes" that protect those links. You should really read my paper better, or maybe my english was wrong.
My goal is to ring the alarm at the Poloniex team and expect them to have a better protection of there customers funds. This isn't FUD, a simple 4 page PDF will not destroy a big company in 1 day.

I did read it. You fail to mention the need for valid hash to confirm any of those actions. Why? Because it would be less sensational, I guess.

That's the point ! There is no need of valid hash to confirme those actions ! Check yourself !
Here is a capture of the complete request !

https://i.gyazo.com/0afa447c3c27f5d5076d0d8f3264fc1d.png

The best you could hope for is that you post a link, someone click it, they have sufficient balance to make a transaction, all this before a mod catches it. The result is that the victim makes a shitty purchase. ...and that's the bug they acknowledged and paid you for. The others are nonsense.

Exactly, that's only a proof of concept. How much people could I get to click on my link ? If I have luck, I fall on someone with 100+ BTC balance, which is not that rare.
But I can also use Open URL Vulnerability, which will set the Referer as poloniex.com and redirect to the GET buying/selling request.
They never paid me neither replied to my ticket reporting this vulnerability.

Since source code is client side i suggest you read up on how a "buy transaction" is done.

virustotal scan? i've some fear of these bitcointalk random links...

It is safe :
https://www.virustotal.com/en/url/536e926f2ec715ca3287356073b275d762e96dabe50d274f4c2f224cc369125e/analysis/1476545937/

It's probably safe, but virustotal isn't infallible. This warning is stickied at the top of the altcoin section. It warns that virus scans is no longer sufficient to ensure safety. There are sophisticated attacks that are undetectable, you only find out you've been hacked after you realise you've been robbed.

dont worry guys there will always be vulnerabilities in centralized exchanges, but DEx's are starting to make there way into the crypto world.  Soon you will be able to trade without worrying about leaving your BTC in someone elses control, and will finally be free of this worry.
Imagine the order books of BTC and other projects when we wont have to live in fear of losing our wealth to exchanges when we leave buy orders/sell orders in place.

cant wait to see the true dawn of decentralized trading!!!

This thread isn't about marketing or advertising any other exchange. It is about Poloniex and only Poloniex.
Thanks.

ok...  but is there any exchanges that are proveably free of bugs, or even worse human error or manipulation...  Nope.
Its time for poloniex, and all centralized exchanges to move aside so  crypto can finally become what it was meant to be.

On Wall Street, Customers are protected with insurance funds and policies...
There is no way to make any exchange of any kind fully secure.

Based on crypto history...
Any rational trader must assume that Polo has roughly a 50% chance of suffering a total loss...
So if you are leaving > 10-20% of your BTC on Polo you are a hardcore gambler.

As for decentralized versus centralized exchanges...
There is some sort of fundamental law that prevents them from developing comparable liquidity...
But this is never addressed by people hyping all things decentralized.

I've read the .pdf and I support Xavier59. Keep it up :)

All arguments are valid, and while they might not be exploitable right now, they're proof of bad coding practices and should not be ignored.

could you please go into greater depth about the fundamental law?

When Poloniex did a code review of Vcash we performed a 3 month security audit including penetration tests and double spending tests against many assets. We personally discussed this with Tristan and made "minor" recommendations "at best". Why can we talk to Tristan yet you post this here? I can assert that the OP cannot exploit any vulnerability against Poloniex that involves loss of funds, in fact he should prove his loose and fast wording is not simply hand waving instead of Bantha fodder. 8)

Moderator privilege escalation doesn't worry you? That's a social engineering disaster waiting to happen.

He didn't have mod privileges, it just changed the way his posts appeared to others in the box. I think that's just his bad English and poor translation.
"Taking this username will grant me moderation client privilege which includes: having my name in blue and the ability to share clickable link."

As i said that's ripe to be exploited. Social engineering is one of the greatest threats. You could infect people with all sorts of malware, after that, loss of funds.

Do you also assert "OP cannot exploit any vulnerability against Poloniex that involves loss of funds"?

Because I'd say that's a straight up lie.

It is already starting coming out of the news sites in the cryptosphere.

https://www.cryptocoinsnews.com/cryptocurrency-exchange-poloniex-insecure-security-review-claims/

It would be good to choose the safer option of holding your coins in your wallet or maybe even convert back to bitcoins. If the security flaws are exploited by some other hacker that is smarter than the thread starter then panic selling of the altcoins listed in Poloniex might be possible. No one believed in the Cryptsy situation now look what happened with that exchange.

Do not believe the bad news entirely but we should also be careful.

There's no current danger.

It's just a huge question mark hanging over polo, and how seriously they take security?
OP has been upfront, notified polo a month ago, got a tiny bounty for one of the issues, and they won't respond about another vulnerability despite fixing that too

That pdf would sell on the darkweb for much more than 0.2 btc. I hope people here realise that.

Keen to hear Polo response.

Regardless, besides being a trader or getting good lending rates from polo (>80% p.a for me), anyone storing their coins on exchanges is asking for trouble.

Answer to Poloniex reddit post : https://www.reddit.com/r/CryptoCurrency/comments/57q9gf/poloniex_is_secure_were_good/


You're totally off the mark. Never said multithreadying is a vulnerability, as well as get request. It's the way you use them wich is a vulnerability. It becomes one when multiple thread can share the same ressources at the same time.


I wonder how you can say that after what I did write in my reports. I reported you every GET request you did was easily shared with the moderator clickable link. This wouldn't be possible using POST request. Same for Open URL Vulnerability. So YES, you're using GET request in the bad way, and if you can't see that, I feel only much worried.


As I wrote, I'm not a professionnal pentester. I feel the need to test my payloads before reporting them, because I'm never sure it will work. I have been posting exactly 3 messages using the moderator client-side privilege. I wonder where you see in my article that I did a falsefy report ! Quoting me : "Taking this username will grant me moderation client privilege which includes: having my name in blue and the ability to share clickable link."
This is exactly what it did, and I specified that it was moderation client privilege only.
If you think I wrote as moderator just to be spectacular, remember that I only posted 3 messages, and then directly reported the vulnerability as suggested by the moderators.


And this is your principal mistake. Because I didn't neither I do hide myself. Some research on any search engines could easily lead you to my identify. Moreover, I would like to remind you that I shared my personnal identy with the support.


I would be very interested knowing which company did a security audit of your website ?


Btw, I'm still waiting your answer, tickets #66023. Pending since 29 days now. Tic tac tic tac ...

Xavier59 has my full support along with a huge group of concerned people who will make polo wake up and hopefully (fingers crossed) hire a decent coder. This isn't the 1990's. Wake up and smell the payload. Polo is more so as was before now in the radar of malicious users looking to get rich from this.

And I won't spoil it for you, but there are many more vulnerabilities left wide open. Do your research and get educated. Xavier isn't spreading FUD, but all those who are trying to cover this up realize they will lose money over this if polo loses clientele or memberships.

Not sure why POLO BOSS BUSONI is so angry on XAVIER59..

Xavier59 tried to help, report vulnerablilites and move on with the support guys.

He had to post this public only because of the support team, keep pushing the tickets in a circle

But as usual, support guys behave like dicks even in emergencies like these and take 48hrs for each reply.

I guess both XAVIER59 and BUSONI can sign a peace treaty or something!!!

Umm... so polo has been hacked before, they raised security measures and repaid the users who lost funds. It has been over a year since then and the staff (both behind the scenes and in the TB) have grown significantly.

You would think that with their history and man power, they would have security pretty tight. The only vulnerabilities I see are "user-error" in which some dumb-ass (either mod or user) makes a mistake. Even if an attacker managed to send withdraw requests, the coins are (from what I remember) in cold storage and you need 2fa or email confirm to do a full withdraw.

FUD: https://www.reddit.com/r/CryptoCurrency/comments/57q9gf/poloniex_is_secure_were_good/

So you rely on a post posted by the website himself ? Sure, they will say Yes, we fucked up, withdraws your coins. That's just stupid.
Again, it isn't FUD, I like to believe after that, they will consider their customers and increase security.

Your security risk claim has been dealt with (if it was even a 'risk' to begin with...).

So was it a risk or not? That's the real question.

Polo admits that mod escalation happened, this is admitted on both reddit and btctalk by legitimate spokepeople
Their problem is that no one 'informed them first', and that is what needs to be proven.
So where's the proof.
Emails or gtfo

You think?

https://twitter.com/el33th4xor/status/787610289369784320

As far as it stands now.

Yes.

You do realize that Emin Gun Siner is Associate Professor at Cornell's Computer Science Dept.? And as I said - I don't think their answer is professional. They talked against Xavier for too much and I believe they have better things to do.

We are arguing man? I'm in complete agreeance.

I can't argue on the matter as I'm not a coder.

I think we've crossed streams here.

Polo has been decent in their response, and I think take it all seriously but OP raised proper points and has gotten his 0.2 btc bounty for pointing out a 200 btc problem.

As long as companies don't take these things seriously there'll always be incentive for good people to do the wrong thing.

For all the bad PR that's come up, polo should actually be grateful for this guy, he did good.

Nah, all is good.


I agree on everything, but the decent part (well, I may add the size of the bounty, giving the fact that Poloniex is operating with 10s of millions $). Notice part of their response:



I thought they are joking. Should that 'news source' name to be Kevin Mitnick in order to investigate the problem? It sounded like: "We are Poloniex and he is nobody".

Not cool.

Somebody exploit the vulnerabilities yet?

I need an exchange to collapse to get more cheap coins. ;D

Poloniex is safe according to their post on reddit.

They were unlucky that I didn't release all the vulnerability in one row.

Oups ! goo.gl/xcbG5G

This open url vulnerability just got patched. But well, it was just another proof that Polo wasn't safe, even after the reddit post.

Is this really true though?

First of all there is barely a difference between GET and POST. If there is a CSRF vulnerability, an attacker can abuse it. Although GET might make the attacks slightly more practical, one could still make a simple HTML form on another domain/site (auto-submit with JS) and just send the parameters through there.. equally vulnerable (can be all in hidden iframe on legitimate looking page too.) I always use the following code for proof of concepts:

This makes a POST request to another domain automatically upon loading that page, so pretty much the same as a GET CSRF.

The real fix is using CSRF tokens. However, I am getting the impression that they are still verifying the request by the header "X-Requested-With: XMLHttpRequest" (as seen in your screenshot (https://bitcointalk.org/index.php?topic=1649424.msg16572161#msg16572161) too.) This can only be made from an AJAX request on the same domain. Therefor it wouldn't be possible as clickable link on same domain, nor any link/form/etc on another domain. Did you try making a request without that request header?

The reason why CSRF tokens are superior is because there has been some browser/Flash vulnerabilities where they didn't fully respect CORS (and allowed to make request with those X- headers.) But still if they verify that "X-Requested-With" header properly, I don't think it's fair to call it a vulnerability.





Overall it seems like the PDF is a bit exaggerated IMO :P The 0.2 BTC bounty does seem very low though. I understand that an open-redirect vulnerability isn't very crucial, but for a site like Poloniex it does seem very important. The "toString" thing is a very nice trick, I never realized that :) so thanks for sharing that.

Your wrong, they aren't equally vulnerable. As a matter of fact, it wouldn't have been possible to do the attack I described if they were using POST.
They are not verifying the header X-Requested-With: XMLHttpRequest as you supposed. They check for the Referer header (poloniex.com), which only allow an attack via trollbox link (so again, it isn't possible with post)
Glad to see my reports learnt you some security things btw :p

Ah, I missed the "Referer" part. In that specific case GET is worse then yeh.

you need to take into consideration the volume of a year ago and the volume of today. its a huge difference.

add a #Cloakcoin coin we requested  a so many times

as long as trading in polo its good exchange
waiting for ICN go to there ;D

For informations : https://www.reddit.com/r/PoloniexForum/comments/6t4tvs/i_managed_to_bypass_2fa_and_email_verification_is/

That's a very concerning thread. The most interesting comment was the following:

https://www.reddit.com/r/PoloniexForum/comments/6t4tvs/i_managed_to_bypass_2fa_and_email_verification_is/dlits1b/


Don't re-use passwords, people. Make a new 14 character password for every site you use.

Also, the email exploit where the email was being confirmed without clicking was an Outlook email. If you use Outlook, change your email to something else.