genjix's box was hacked? Who told you that?  So, the simplest explanation is the one you gave and not that genjix himself leaked the source code?  Given his history, I think incompetence is more likely than malice, definitely in genjix's case. That patrick would walk away right now looks suspicious, if he were a smart thief he would come back and finish the claims so everyone gets their 66% (like myBitcoin). So in a counter-intuitive way, I think that he "walked away" in anger/frustration is actually a sign that it wasn't an inside job. Its very plausible and at least equally likely that there was another thief IMO (see below)... I agree with you on this one. If it was an inside job, and I'm not saying it is(I mean the thefts, not the source code leak), it was from someone else and not Patrick or Amir. They would have to be completely nuts to screw up on something that would tarnish their reputation in this manner. |
|
|
|
Thanks. So the leaker who accessed genjix's box packed it on his box as him. That's why it says genjix/genjix, genjix's box was hacked.
genjix's box was hacked? Who told you that? So, the simplest explanation is the one you gave and not that genjix himself leaked the source code? no one is giving an 'explanation'. We are jsut trying to trace this stuff back as close to 'source' as possible.. @BitcoinBull I assume by 'box' you mean his personal computer? I will not give much importance to bitcoinBull's assumptions as 20 minutes ago he was assuming I was looking at the file on the OP and not at the file I had downloaded from the link at the pastebin and decoded with the instructions posted at reddit... well, in your opinion, did it come from his gihub or his computer? And would it not be easy enough to edit that stuff to make it look like it came from a particular source? Anything is possible. I could create a VM and have a user with the name genjix and achieve the same result. That still doesn't give me a solution to be able to clone a private github repo, much less edit the HEAD file to include genjix name on it, for I would need to clone the repo first  |
|
|
|
Thanks. So the leaker who accessed genjix's box packed it on his box as him. That's why it says genjix/genjix, genjix's box was hacked.
genjix's box was hacked? Who told you that? So, the simplest explanation is the one you gave and not that genjix himself leaked the source code? no one is giving an 'explanation'. We are jsut trying to trace this stuff back as close to 'source' as possible.. @BitcoinBull I assume by 'box' you mean his personal computer? I will not give much importance to bitcoinBull's assumptions as 20 minutes ago he was assuming I was looking at the file on the OP and not at the file I had downloaded from the link at the pastebin and decoded with the instructions posted at reddit... |
|
|
|
How did the hacker also get access to genjix account on github ?
that is what I am wondering, with following that part of the thread.. It wasn't from genjix's github account. Genjix cloned the github repo to his own box <genjix@nite.(none)>. It was accessed from there. But how did you get this to claim that he packed it: drwxr-xr-x genjix/genjix 0 2012-07-07 20:18 bitcoinica_legacy/ You are implying that genjix intentionally leaked the code. I can't confirm that. This $ tar -jtvf bit.tar.bz2 | head -n1 gives this drwxr-xr-x genjix/genjix 0 2012-07-07 20:18 bitcoinica_legacy/ which means that the bitcoinica_legacy folder that was packed to the encrypted file had the owner genjix from group genjix and was last modified at 2012-07-07 20:18 I posted all you needed to do to. Not sure why you're asking lol Thanks. So the leaker who accessed genjix's box packed it on his box as him. That's why it says genjix/genjix, genjix's box was hacked. genjix's box was hacked? Who told you that? So, the simplest explanation is the one you gave and not that genjix himself leaked the source code? |
|
|
|
(the reason Tihan keeps repeating that his role was hands off is because he'd lose safe harbour protection from liability if he took part in the day to day running of the company).
He had the critical password, apparently. So while he might be able to wash his hands of responsibility for money-laundering going through his pipelines he remains a prime suspect in the theft. He could have insisted that password be changed had he wanted to wash his hands of that. -MarkM- I dont think he had it alone. He was provided with this password at best, Tihan isn't really an IT developer to go through the code base, pull mtgox key and set as a master key in last pass. ZT said he didn't do it He is competent enough to edit source code files and push commits to github at least. commit 0f075c054416ebba0f7c0a4809b8394d3a11cca6
Author: mode80 <github@tihan.com>
Date: Fri May 4 16:56:05 2012 -0700
Updates deposit page with the Core Credit wire transfer address.
commit 97bbfe51bafb0a99345fcb90000a1e2343a7ed83
Author: mode80 <github@tihan.com>
Date: Sat Apr 21 10:54:41 2012 -0700
Fix deposit page brokenness? (take 3)
commit d76c555941f4a7dce53a24cf03c36acf6af2b623
Author: mode80 <github@tihan.com>
Date: Sat Apr 21 10:41:18 2012 -0700
Fix deposit page brokenness? (take 2)
commit 47a50db07a01e6c42c858c3de138d616b51a40aa
Author: mode80 <github@tihan.com>
Date: Sat Apr 21 10:21:43 2012 -0700
Fixes deposit page brokenness?
commit fe493606b0bb03c212f703c9284a0d9d42416a41
Merge: 520894c 04a6fc4
Author: mode80 <github@tihan.com>
Date: Sat Apr 21 09:55:54 2012 -0700
Merge branch 'master' of github.com:bitcoinica/bitcoinica
And some more if you run a git log on the bitcoinica source code that genjix leaked |
|
|
|
But how did you get this to claim that he packed it: drwxr-xr-x genjix/genjix 0 2012-07-07 20:18 bitcoinica_legacy/ You are implying that genjix intentionally leaked the code. I can't confirm that. This $ tar -jtvf bit.tar.bz2 | head -n1 gives this drwxr-xr-x genjix/genjix 0 2012-07-07 20:18 bitcoinica_legacy/ which means that the bitcoinica_legacy folder that was packed to the encrypted file had the owner genjix from group genjix and was last modified at 2012-07-07 20:18 If I unpack the file to my system it will have owner "me" from group "me". If I pack it again and run the above command it will give me a similar line but with my name and the date on which the folder was created/modified on my system when I unpacked it. I posted all you needed to do to. Not sure why you're asking lol |
|
|
|
This thread is so  |
|
|
|
So, the encoded file has the exact same thing on the /bitcoinica_legacy/.git/logs/HEAD file 0000000000000000000000000000000000000000 939e877106a5bd479f350adc6d9e4170c62df8f3 genjix <genjix@nite.(none)> 1338505438 +0200 clone: from git@github.com:bitcoinica/bitcoinica_legacy.git Cloned by Genjix from the bitcoinica private github repo on May 31 2012... Interesting  And look at who packed it... surprise surprise drwxr-xr-x genjix/genjix 0 2012-07-07 20:18 bitcoinica_legacy/ That's not the encoded file. You're still looking at genjix's re-pack. Dude, I think I know what I did... I decoded the file... And yes, it has the exact same thing as the link genjix posted in the OP. Go look at yours if you wish. Here's what I did, just so you know and don't call me a liar. I downloaded bitcoinica.enc from http://depositfiles.com/files/u8e6gd032 to a dir named "b" on my home drive and I did the following $ cd b
$ split --bytes=3000000 bitcoinica.enc
$ mv xaa 2
$ cat xab xac > 1
$ cat 1 2 > bit.tar.bz2
$ tar -jtvf bit.tar.bz2 | head -n1
After, I opened the bit.tar.bz2 file with Ubuntu file manager and navigated to /bitcoinica_legacy/.git/logs/ and opened the HEAD file with gedit. Try it yourself. |
|
|
|
So, the encoded file has the exact same thing on the /bitcoinica_legacy/.git/log/HEAD file 0000000000000000000000000000000000000000 939e877106a5bd479f350adc6d9e4170c62df8f3 genjix <genjix@nite.(none)> 1338505438 +0200 clone: from git@github.com:bitcoinica/bitcoinica_legacy.git Cloned by Genjix from the bitcoinica private github repo on May 31 2012... Interesting And look at who packed it... surprise surprise drwxr-xr-x genjix/genjix 0 2012-07-07 20:18 bitcoinica_legacy/ And again, please genjix you explain this? Everything is falsifiable but ... He won't explain shit. If he wanted to explain he would've done it by now. |
|
|
|
So, the encoded file has the exact same thing on the /bitcoinica_legacy/.git/logs/HEAD file 0000000000000000000000000000000000000000 939e877106a5bd479f350adc6d9e4170c62df8f3 genjix <genjix@nite.(none)> 1338505438 +0200 clone: from git@github.com:bitcoinica/bitcoinica_legacy.git Cloned by Genjix from the bitcoinica private github repo on May 31 2012... Interesting And look at who packed it... surprise surprise drwxr-xr-x genjix/genjix 0 2012-07-07 20:18 bitcoinica_legacy/ |
|
|
|
We are experiencing some issues with our tor server at the moment. Its not responding to its public IP address. There has been some rough weather in the area and a power outage. We believe that the UPS on the server may have ran dead before the power came back. One of us has to physically drive out to where the server is located and check on/reset it. Please give us a couple hours to get this resolved. Do not worry about your funds, we will be back.
Probably not the best idea publishing time and cause of outage on a public forum. You just narrowed down the possible physical locations of your "hidden" server somewhat. +1. What I was thinking. Since the moment they posted publicly that they had started running an exit node on the server as disguise and that was why the server was slow so they stopped running the exit node the list of possible IP's was already narrowed down enough. This disclosure was just the last nail on the coffin. lol |
|
|
|
That still doesn't explain how the attacker knew that specific password should be tried at all.
We are talking about the password needed to convince LastPass to hand over your encrypted passwords right, not the passphrases needed to actually decrypt those passwords once having gotten a copy of them from LastPass?
-MarkM-
What's to say they "knew" at all? If the source was public and there were obviously duff security practices all round, wouldn't it be pretty straightforward to bruteforce LastPass with grepped strings from source and public e-mails? Doesn't explain why the passwords were the same though. I guess laziness and hubris. How can you brute-force a secure download protocol? If you fail to provide an initial response that proves you possess the correct decrypt password you don't get the file. Is all of this afterall a total comically silly fail on LastPass's part of delivering the crypted passwords to random anonymous hackers to have them brute-forced at leisure? -MarkM- That's right, you can't sync LastPass without the master password. I still can't find any evidence of the bitcoinica source code leak, all google results are pointing back to genjix's original post in this thread. Does anyone know where it was first leaked? Its a new hack?? the code was stolen from github, not from the cloned machines .... Maybe github user:info@bitcoinica.com/ passwd 123  How does one decrypt that file? Some research is due. |
|
|
|
Well, this is odd.
I guess I took the mantra 'read lots, write little' too closely to heart. I've typically read while not even logged in. However, a cursory glance at my profile will confirm that I have been registered here for over a year.
I have what some would consider significant holdings, some locally, some in various exchanges. I lived through the TradeHill<>Dwolla conflagration (kudos the the TH team for stepping up to prompt reimbursement), and dodged a number of the other fiascoes.
I interact with local superstar BurtW in person (e.g. in meatspace) several times a week, and have for about two years now. I'm sure he'll vouch to this fact. Our day gigs coincide, as do our geographies.
Basically, I ain't a n00b, though my post count might tend to lead to the adverse conclusion.
So whaddaya think - can I get a hall pass?
You can get an hall pass, yes. Ask BurtW to come to this thread and ask us to whitelist you and it will be done  |
|
|
|
|
You could lock it yourself.
|
|
|
|
Right... Date Registered: Today at 12:05:25 AM
Last Active: Today at 09:34:40 PM |
|
|
|
BTW, there’s a bit too much zhoutong dick sucking going on for my tastes. As far as I see, he is the only winner here, since he managed to sell off the company to a sucker before it went kaboom with profit, and now doing some PR stunt donating 5k of it to bribe the suckers here to view him as the hero.
Finally someone with a working brain. And what about that other PR stunt about the "I'm leaving Bitcoin" ? |
|
|
|
You should really keep the funds for when the intersango guys try to sue you:(
This is not your fault.
They can't sue him - he is a child. And how do you know it's not his fault? He had more inside knowledge than anyone and it would have been easy for him to hack in and steal the coins and destroy the database. The police were never called for some reason... <tinfoilhat> ZT did it all to take revenge on Patrick(phantomcircuit) because of his dirty mouth and actions http://bitcoinstats.com/irc/bitcoin-dev/logs/2011/09/12/4If so, I congratulate you, ZT. Well played, Sir. Brilliant execution. </tinfoilhat> |
|
|
|
And now the forum is absolutely crawling to a standstill. Are we being slashdotted or something? Or is some basement dwelling fuckup using a DDoS against an innocent messenger?
No, we're being HN'ed lol Check out the top of the front page http://news.ycombinator.com/news |
|
|
|
Look what I found when googling "Bitcoinica source code" to try and find the hacker leak. I don't like the one genjix leaked himself http://bitcoinstats.com/irc/bitcoin-dev/logs/2011/09/12/411:44 phantomcircuit who wants to see if i can hack them? 11:44 phantomcircuit should be fun ... 12:00 phantomcircuit so first im going to try and change my other users settings 12:00 phantomcircuit and then im going to try something hilarious 12:02 cande amusing 12:04 phantomcircuit rofl 12:04 phantomcircuit i can change arbitrary users emails 12:05 phantomcircuit yup 12:05 phantomcircuit i can change anybodies email 12:05 phantomcircuit and then reset their password 12:05 phantomcircuit now for the hilarious part! 12:06 zamgo you make bitcoinica go boom? 12:06 phantomcircuit yes 12:06 phantomcircuit AMATEUR HOUR ALL AROUND! 12:06 phantomcircuit it's like a bad fucking joke Look how happy he was hacking Bitcoinica and bragging about it. I wonder if he had that much fun when it was him the cause of the fuck up. See, kids, this is what happens when you have a dirty mouth... your enemy grabs you by the balls! |
|
|
|
|
Show Posts
