Hi everyone,
          A couple of days ago we noticed some suspicious transfers to CampBX, and reported those to our bank as well as Dwolla.  After talking to bank fraud investigators today, seems like there is a well orchestrated, large-scale bank fraud underway.  This includes very convincing fake passports and utility bills used to open bank accounts and Dwolla accounts, and transferring money to Bitcoin companies.  Bank customers who have been hacked are spread all over geographically: MA, CA, TN, NYC, and WI.

         The old-fashioned practice of processing bank+Dwolla transactions manually mostly saved CampBX: We have lost $2.6K and prevented a loss of $9.8K so far.  I don't have email IDs for newer exchanges so sending out this open heads-up on the forum.  I believe BitInstant does manual processing, so their damage may be limited, but exchanges like Mt.Gox that do automatic processing of Dwolla may be at higher risk.  (Unless the fraudsters are selling their coins on Mt.Gox - in that case they will make a nice profit).

Keyur

Hi all,
       The PCI security scan on CampBX identified a Linux/SSL-related vulnerability on our new server earlier this week.  This has caused us to lose the "PCI Compliant" status + logo temporarily.

After extensive testing our server administrators confirmed on Wednesday that this issue is a false positive.  The bug had been patched a long time ago but the version number was not updated, which caused the security scanner to throw a false positive.  Today McAfee's security team has verified and accepted our findings.  

It will take a couple of days to get the PCI certified status back, but we have been fully compliant and secure all along.

Thank you,
      Keyur

Hi everyone,
      BitcoinCharts.com and BitcoinWatch.com are not picking up CampBX data feed since our server migration this weekend.  Our IP address changed during the migration, so it may be root cause for this issue.

We have alerted BC guys about this and will work with them to get the issue resolved.  In the meantime, please refer to CampBX Market Charts for recent statistics.

https://campbx.com/mktexplorer.php

Thank you,
      Keyur

[Physical Security:]

Hi everyone,
      We received multiple requests for information around Camp BX security measures in the wake of Bitcoin7 incident.  So here is a high-level summary of precautions and processes in place at Camp BX: please feel free to ask questions and we will be happy to share additional information.

Physical Security:
- Professional, secure data center in Arizona
- Triple telecom backbone connectivity for redundancy
- Caterpillar diesel generators in case of power brown-out / black-out
- Restricted physical access to servers

Information security:
- Well defined chain of command for wallet and database ownership
- Nightly security scans by McAfee Secure
- Scheduled D-DoS attacks
- White-hat penetration tests
- 72-hour SLA commitment to address new vulnerabilities

Financial security:
- No fractional reserve: We hold 100% of user funds in reserve at all times
- All banking done on-shore in the USA
- We do not do business with companies that don't have a registered office in USA.  (Paxum, Liberty Reserve)

Thank you,
       Keyur

(Not shilling Camp BX this time, just sharing some personal thoughts)

Came across this article about a face-off between 7 next-gen currency start-ups / technologies vs. Citi group. 
http://www.finextra.com/news/fullstory.aspx?newsitemid=22993

The outcome according to FinExtra was:

And despite all the talk of peer to peer transfers, social networks and decentralized currencies, it was the age-old topic of regulation and money laundering that delivered the decisive blow.

This statement made me wonder: Should Banking Industry really be using money laundering to knock on Bitcoins?
Billions of dollars in drugs trade, funding for illegal weapons for warlords, and even funding for terrorist attacks have all gone through the international banking system successfully.  Banks have done a better job of harassing legitimate businesses rather than preventing these activities.

Bitcoin technology has the potential to do a little better.  Electronic bank balances can rarely be traced all the way back to printing presses, while every Bitcoin's lineage can be traced all the way back to genesis block.  And more importantly, bank balances do not have built-in scripting ability like Bitcoin does.

I am curious to hear the Bitcoin community's thoughts on this.

- Keyur

Hi everyone,
       If you are planning to sell your Bitcoins, we invite you to try out Camp BX.  We have a lot of new users looking to buy since the recent price drop, so we will be happy to set sellers up with a free month.  Simply sell 100 coins or more by end of the month, and message us to take us up on this promotion.

Thank you,
       Keyur

[new funding methods]

Hi everyone,
       We have rolled out many new features at Camp BX over the past week!  Here is a quick breakdown:

1) Three new funding methods are live!  You can use USPS Money Orders, Checks, or Wire Transfers to fund your account.

Did you know that USPS Money orders are:

•  Always valid — they never expire.
•  May be replaceable if damaged, lost, or stolen. Just hold on to your purchase receipt.
•  Cost $1.55 to transfer up to $1,000 ($0.30 if issued by military facilities)
•  Available at 31,000 locations

2) CBX Instant transfers allow you to send Bitcoins instantly to other users without paying miner fees.  
These transfers can be made using our website or API:

CBX Instant Trasnfers: https://campbx.com/faq.php#fund-transfers
API Call: https://campbx.com/api.php#transfers


3) We have added new API calls that allow you to use Camp BX as your Wallet or backend processor.  All of the calls have been heavily tested and optimized, and ready-to-use right away.  We also offer custom API calls for our affiliates.  If you have a business need, please contact us!


4) We also offer the most aggressive affiliate / volume discounts in the market, and best of all, we offer them retroactively if you have been trading at Camp BX.


Thank you,
      Keyur


Edit: Added more info.

[1) Negative account balances:]

Hi Everyone,
       Had two questions about the current implementation:


1) Negative account balances:

Quote
 - The check for sufficient funds is done before paying transaction fees (if any); if a
   transaction fee is needed, and there are sufficient funds in the wallet, then the
   transaction fee will be paid and debited from the account.  For example, if account
   'foo' contains 10 bitcoins, you sendfrom foo 15VjRaDX9zpbA8LVnbrCAFzrVzN7ixHNsC 10,
   and the transaction costs 0.01, 'foo's balance will be -0.01 bitcoins.
End Quote

What was the rational for implementing fee management this way?  In most of the business scenarios, negative balances can confuse improperly designed algorithms, and halt the properly designed ones.  A user account should be also responsible for fees on their transactions from a logical standpoint.

I haven't reviewed the fee-calculation code yet, but is it possible to calculate fees beforehand and incorporate them in the NSF check?


2) Static Addresses:
      There is a lot of demand for static addresses from Bitcoin users, but most of the current implementations simulate this through a very large key-pool value.  It may be better to offer this feature natively by adding a true/false flag to Berkeley DB storing the addresses.  

Two API calls can be added to offer this feature:
makestatic <address>
removestatic <address>
To set and unset these static flags for addresses.


Eager to hear your thoughts on these,
       Keyur

[1) Spend-X Trade:]

Hi everyone,
      Based on user discussions on this forum, we have added some new features on Camp BX for you to explore.  Please take a look, and share your thoughts!


1) Spend-X Trade:

This trade type does all the tedious number-crunching for you; simply tell it how much you are looking to spend, and it will figure our exact purchase quantity based on current orderbook prices.  You can purchase at limit price, or leave the price field blank to purchase at Market price.
https://campbx.com/faq.php#trading


2) Advanced Trade API:

Exposes all Camp BX advanced trading features and custom order execution options to your bot via a new API call.  
https://campbx.com/api.php#advanced


3) JSONP:

JSON-P has been enabled for Ticker and Depth Table API calls.


Thank you,
     Keyur

[Camp BX FAQ: https://www.CampBX.com/faq.php]

Hi everyone,

    Camp BX is a platform where you can buy and sell Bitcoins for US Dollars in real-time.  We are an Atlanta - USA based company, and we are starting this thread with an intent to make our entire team's knowledge-base available to the newbie community.  If you have questions about trading, security, or technology behind Bitcoins or Camp BX then ask us here!


A little about us:
    Camp BX platform was designed from the ground up with stability and security as top priorities, and we became the first Bitcoin website to obtain Payment Card Industry (PCI) certification and the McAfee Secure seal of confidence on June 28th, 2011.

   For new traders we provide a "Quick Buy" or "Quick Sell" option.  Any buy or sell order that you place is matched against a database of other orders, and if a perfect match is found, a Bitcoin-to-USD trade is executed instantly. If there are no matching orders at the price you specified, then your order can remain open for up to 31 days. To maintain fairness in trading, we have taken a purely-platform approach and Camp BX is never a counter-party to any trade.

    We are also the first Bitcoin platform to bring advanced features like Margin Trading and Short-selling, and have several more exciting and innovative features in pipeline.

    There are no fees required to open a Camp BX account, so we encourage you to sign-up and try us out!

Thank you,
     Keyur
     Camp BX FAQ:  https://www.CampBX.com/faq.php

[https://www.CampBX.com/api.php]

Good morning everyone,
       Camp BX API is live and available for all the Bots and day-trading gurus!  We have exposed all standard functionality of the UI through API, including:

• Full Market Data
• Account Data
• Quick Buy / Quick Sell Orders
• Bitcoin Send-To

API documentation is available at: https://www.CampBX.com/api.php

We are also pressing forward with some additional API calls that will expose functionality for Dwolla Transfers and AON/FOK/Market Price/Custom Expiry, so please stay tuned for those announcements!

Thank you,
      Keyur




Activating API Access

    API access can be activated for an account by submitting a ticket to the Helpdesk. Your ticket must include your email, username, and latest transaction date for security reasons.


Data Format

        Inputs: All input parameters for the API (with the exception of passwords) must be alpha-numeric. Repeated violations of this policy may result in an account ban.
        Outputs: The output of the API is in JSON format.

Making API Calls

    Use POST, not GET. Any API call that requires authentication must be made over SSL connection. Market data calls (which do not require authentication) can be also made over HTTP.

Standard Return Codes

    There are two generic responses common across all API calls to simplify error handling.
    ­

        Error:
        When a fatal error occurs that does not allow the API call to proceed, an Error is returned as the result. In a vast majority of the cases, error can be traced back to improper API calls or malformed parameters.
        Info:
        Info is returned when a non-fatal error occurs during the API call. For example, if an API calls to obtain a list of open orders has zero results, an Info code along with description "No open orders" will be returned by the API call.


Depth Table

    Full market depth is available through the depth table API call. The API call can be made at:
    http://CampBX.com/api/xdepth.php

    Result is a JSON object with two arrays: Asks and Bids. Each element in these two arrays has two members: first member is Price and second member is Quantity available at that price. Both numbers are rounded to two decimal points.

Market Ticker

    The API call to obtain market ticket can be made at:
    http://CampBX.com/api/xticker.php

    Result is a JSON object with three members: Last Trade Price, Best Bid Price, and Best Ask Price.


Account Balances

    An API call to obtain latest account balances can be made in following format:
    https://CampBX.com/api/myfunds.php POST: user=USERNAME pass=PASSWORD

    Result is a JSON object with six members.

        First two members show Total USD and BTC balances for a given account, provided the login credentials are correct.
        Next two members show Liquid USD and BTC balances not tied up in open orders on the order book.
        Last two members show Margin Account USD and BTC balances. When you open or close a margin position, Camp BX transparently moves funds in and out of the Margin Account; hence, no explicit funds-transfer is required.

Orders List

    An API call to obtain list open orders for an account can be made in following format:
    https://CampBX.com/api/myorders.php POST: user=USERNAME pass=PASSWORD

    Result is a JSON object with two arrays: Buy and Sell. Each array includes a sub-array of open Buy or Sell orders.

Margin Positions List

    An API call to obtain list open Margin positions for an account can be made in following format:
    https://CampBX.com/api/mymargins.php POST user=USERNAME pass=PASSWORD

    Result is a JSON object with an array of Margin positions including Margin Call Price, and current profit/loss on open positions.

Canceling an Open Order

    An API call to cancel an open order can be made in following format:
    ­
    https://CampBX.com/api/tradecancel.php POST: user=USERNAME pass=PASSWORD Type=Buy OrderID=NUMERIC_ID
    ­
    OR
    ­
    https://CampBX.com/api/tradecancel.php POST: user=USERNAME pass=PASSWORD Type=Sell OrderID=NUMERIC_ID

    Please note that the parameters for this call are case-sensitive. Type and OrderID parameters must match the exact information provided by myorders.php call outlined in the previous section.

    The "Type" parameter refers to the type of order; permitted values are Buy or Sell.
    "OrderID" must be a numeric value corresponding to the order that you are attempting to cancel.

Placing a New Order

    An API call to placing an order can be made in following format:
    ­
    https://CampBX.com/api/tradeenter.php POST: user=USERNAME pass=PASSWORD TradeMode=QuickBuy Quantity=DECIMAL Price=DECIMAL
    ­
    OR
    ­
    https://CampBX.com/api/tradeenter.php POST: user=USERNAME pass=PASSWORD TradeMode=QuickSell Quantity=DECIMAL Price=DECIMAL

    Please note that the parameters listed below are case-sensitive.

    The TradeMode parameter refers to the type of the order, and permitted values are QuickBuy or QuickSell.
    Quick orders are described in more detail on the FAQ page; essentially they are limit-price orders that stay open on Camp BX order book for up to 7 days.

    Quantity and Price are decimal values that must follow all rules / limits set by Camp BX. Minimum quantity to place an order is 0.5 Bitcoins.


Advanced Orders

    We are working on an API call to expose the Advanced Trading functionality afforded by the Camp BX platform. This call will allow the bots to request specific Fill-types like AON or FOK fill, Price types like Market or Limit price, and a custom Expiry date ranging from 1 hour to 31 days.

    This API call will be available on Friday July 22nd. In the meantime, we encourage you to explore and understand this functionality though the website interface prior to writing a bot around it.


Buy on Margin

    We are working on an API call to expose Margin trading functionality.

    This API call will be activated when market liquidity crosses 1,000 Bitcoins per day for a sustained period. In the meantime, we encourage you to explore and understand this functionality on testnet prior to writing a bot around it.

Short Sell

    We are working on an API call to expose Short Sell and Cover functionality.

    This API call will be activated when market liquidity crosses 1,000 Bitcoins per day for a sustained period. In the meantime, we encourage you to explore and understand this functionality on testnet prior to writing a bot around it.

[https://CampBX.com/main.php]

Hi everyone,
       Camp BX is gearing up to release an API on Wednesday for accessing market data and executing Quick Sell / Quick Buy orders.  

However those familiar with Camp BX website might have noticed additional options such as:  

• FOK Fill (Fill-Or-Kill)
• AON Fill (All-Or-Nothing)
• Market Price Orders
• Custom Expiry Dates
• Stoploss Orders

(https://CampBX.com/main.php)

These features are modeled after standard SEC guidelines, and try to emulate functionality you have come to expect from your broker as closely as possible.

We want to know if you would like to see this functionality exposed through API calls!  Please comment and share your thoughts.  We will use the feedback / suggestions from this thread to prioritize our development team's efforts.

Thank you,
      Keyur

[How does it work?]

Hi everyone,

    We are happy to announce that we have completed Camp BX integration with a SMS (text-message) gateway.  This allows our users to benefit from 2-factor authentication, and we have more features coming out soon including instant trade notifications on your phone.

     Text Message 2-factor authentication greatly increases your account security by authenticating your logins and Bitcoin transfers using two distinct channels: your Internet connection and your Cellular network.
    If your account credentials are compromised due to a malware or a hacker attack, your account is still protected as long as you have your cell-phone.

    How does it work? Once we activate this feature for your account, every attempt to login or transfer Bitcoins will send a text message to your phone containing a 5-letter case-sensitive code. This code must be entered correctly for a transaction to proceed.

    How to Activate 2-factor: You can opt in for the Text Message 2-factor authentication feature by submitting a ticket to the helpdesk containing your email, username, last transaction date, and your phone number at https://CampBX.com/contact.php  This feature is available only for phone numbers in the USA.

    Why can't I edit my own phone number? If you can edit your phone number, so can a hacker. That is why this field is managed by our helpdesk to ensure proper security.

    Our top customers will always have this feature available for free.  However for the first month, this feature is free for all Camp BX users!

Thank you,
     Keyur

PS: Final day of free trades!

Good afternoon everyone,
         Camp BX has commission free-trades for three more days, so make the best best use of this promotion while it is still active!  All commission accrued by Friday 5 PM will be refunded in full on Sunday.

Happy trading!
https://CampBX.com/main.php

Thank you,
    Keyur

PS: Stay tuned for one more news tomorrow! 
You can follow our news announcements via our Twitter or Facebook feeds:
Twitter: https://twitter.com/campbx
Facebook: https://www.facebook.com/pages/Camp-BX/243377035674755

[https://CampBX.com/faq.php]

Good evening everyone,
    We have received a lot of requests about affiliate program for friends and family.  Bowing to our user's request, we are happy to announce the CBX Affiliate Program!

    This program allows you to create a special incentive for your friends and family. Whenever someone signs up using your affiliate link, they get a 10% lifetime discount on Camp BX commissions and you get a 10% share of their commissions!

    To find out your affiliate link, please log in to your Camp BX account and click on "My Profile".

    Please note that the discounts will processed on 1st day of each calendar month, and will show up in your activity timeline as "Refund from CBX".

    When sharing this link, please use restraint and do not spam people. Any complaints of spamming or violation of Camp BX User Agreement will result in immediate disablement of your affiliate link.

Thank you and happy trading,
     Keyur

https://CampBX.com/faq.php


EDIT: If you were among the first people to sign up for Camp BX, you do not need to sign up again!  We will of course take care of our first 270 friends, and automatically set you up for a 10% lifetime discount.

[https://CampBX.com/]

Good morning everyone,
   We are happy to announce that Camp BX platform is live for trading!  As a welcome to early adopters and Bxlievers, we are offering free trades through July 15th.

https://CampBX.com/

   A big thank you again to all the testnet participants for trying out the Camp BX platform and sharing their excellent ideas and feedback. Without you, we wouldn't be here!

Three quick notes:
1) You will be charged commissions and we will issue a full refund on July 17th (Sunday).
2) Stop-loss and Margin Trading depend heavily on liquidity, so these features will be enabled when liquidity increases.
3) We have built a statistics-based compliance engine that monitors Dwolla flows and flags potential illegal activity.  We are training this engine and reviewing all USD deposits / withdrawals manually for a couple of days, so they make take a little longer to go through.

Thank you for giving us a chance and happy trading,
      - CBX Team

[This makes Camp BX is the first Bitcoin platform certified for compliance with 7 information and data security standards!]

Hi everyone,
      The results are in!  https://campbx.com/testnet/main.php

We were tested for >1,000 known vulnerabilities specific to our platform and services by McAfee Secure (formerly McAfee Hacker-Safe), who are ranked #1 in security industry for threat detection.  This is the same auditing service used by well-known brands like Costco, Petco, and Roush Racing for their e-commerce websites.


Here is an executive summary of our results:

OWASP top-10 web vulnerabilities:
    A1: Injection - Pass
    A2: Cross-Site Scripting (XSS) - Pass
    A3: Broken Authentication and Session Management - Pass
    A4: Insecure Direct Object References - Pass
    A5: Cross-Site Request Forgery (CSRF) - Pass
    A6: Security Misconfiguration - Pass
    A7: Insecure Cryptographic Storage - Pass
    A8: Failure to Restrict URL Access - Pass
    A9: Insufficient Transport Layer Protection - Pass
    A10: Unvalidated Redirects and Forwards - Pass

Distributed Denial-of-Service attack: Pass with no noticeable slowdown in response time

All vulnerabilities are classified on a scale of 1-to-5, with 5 being Urgent and 1 being informational.  Camp BX final scorecard is:
Sev 5: zero
Sev 4: zero
Sev 3: zero
Sev 2: zero
Sev 1: 29
(Sev 1 includes information like "DNS Server detected", "NTP Server detected", "SSL Certificate mismatch on Testnet.CampBX.com"...)


This makes Camp BX is  the first Bitcoin platform certified for compliance with 7 information and data security standards!  

We have also achieved all requirements for the McAfee Secure Trustmark, and on our livenet launch Camp BX platform will proudly wear this badge.  A HUGE thank you to Alex and Yuriy for burning the midnight oil to fix all issues identified, and ensuring that we are able to achieve this crucial certification prior to our launch.


Going forward Camp BX will be re-tested daily for all known vulnerabilities.  We realize that security is a process, and we have put together alerts and escalation procedures in place to ensure that anything higher than Sev 1 is fixed within 72 hours.


Thank you and good night,
      Keyur

[top-10 vulnerabilities]

Hi everyone,
      Camp BX team has been gearing up for a full security and compliance audit this weekend by securing our codebase and configuration.  The third-party independent audit will commence today so you may see some signs of stress when using http://testnet.CampBX.com/ for test-coin trading.


So what exactly are the auditors testing us for?

All of the top-10 vulnerabilities identified by OWASP project will be tested.  This OWASP awareness document is acknowledged and relied on by organizations worldwide, including the PCI, Dept of Defense, Federal Trade Commission, and countless others. Current top-10 are: https://www.owasp.org/index.php/Top_10_2010-A1
    A1: Injection
    A2: Cross-Site Scripting (XSS)
    A3: Broken Authentication and Session Management
    A4: Insecure Direct Object References
    A5: Cross-Site Request Forgery (CSRF)
    A6: Security Misconfiguration
    A7: Insecure Cryptographic Storage
    A8: Failure to Restrict URL Access
    A9: Insufficient Transport Layer Protection
    A10: Unvalidated Redirects and Forwards


Plus, hundreds of additional vulnerabilities will be tested that did not make the above top-10 list. 

We will also under go couple of D-DoS (Distributed Denial of Service) attacks from the auditor's clouds in USA and offshore.


And most importantly, we will be tested for security standards compliance with:
1) All U.S. Government requirements for remote vulnerability testing as set forth by the National Infrastructure Protection Center (NIPC).
2) The Payment Card Industry (PCI) Data Security Standard
2) Security scanning requirements of Visa USA's Cardholder Information Security Program (CISP)
3) Visa International's Account Information Security (AIS) program
4) MasterCard Internationals's Site Data Protection (SDP) program
5) American Express' CID security program
6) Discover Card Information Security and Compliance (DISC) program


We will make the findings available to you, so you can form your own informed opinion about security at Camp BX.

Stay tuned,
     Keyur

[http://testnet.CampBX.com/]

Hi everyone,

   We are opening up our new Bitcoin Trading Platform on testnet today.  You will get $10,000 Monopoly money upon opening an account, and you can use your spare testnet coins to try us out.  The trial is expected to last till July 5th.

If you are an advanced trader, you will appreciate the features like:

• Advanced Order Execution like FOK (Fill-or-Kill), (AON) All-or-Nothing orders, Stoploss
• Margin Trading (Fixed at 50% for now)
• And yes, Short Selling!  It was a complex beast to implement due to the identity-blind, credit-averse nature of the Bitcoin network.

Some additional facts about the platform:
We are running on a dedicated server with 8 Intel Xeon cores, and have a second server ready for deployment if necessary with a 6 hour SLA.  All this is designed to ensure a fluid user experience even on high-volatility days.
We have engaged a third-party security audit firm to test the site (This was already done before the Mt Gox hacking incident).  This security audit is going to commence on June 27th, and we will make the audit results publicly available before opening up Camp BX for trading on livenet.


About me:
I know I am not a hero-member on this board, but my background is in operating and optimizing IT platforms for multi-Billion dollar Financial and Telecom companies.  I have applied this experience to Camp BX, and also brought along some of my professional contacts to the table.


So here we go!

http://testnet.CampBX.com/


Things to note:
1) Stoploss feature is disabled till liquidity improves.
2) Visual design has some rough edges that we are working on.
3) We are also working on the Documentation, which is kind of sparse as of now.  We will build out the FAQ/Documentation section as we receive question via helpdesk or this thread.
4) THERE MAY BE BUGS!  If we find any, we will immediately start work on fixing them, but stay away if you really really love your testnet coins. 


Thank you,
      Keyur

[Bad Peers:]

Bad Peers:

I ran a few searches across the forum but could not find an answer to this: How does the Bitcoin client handle bad peers (Other than rejecting bad TX and Blocks)?

If this functionality is not already built into the client, I would like to suggest this simple approach that frees up connections with bad peers:

If PEER_IP sends more than REJECT_THRESHOLD malicious transactions or blocks within past 24 hours, Ban(PEER_IP) for 24 hours.



Net Neutrality:

Many countries around the world have poor record on net neutrality, with selective blocking and government-run snooping programs.  Recent case in point: Egypt.

I wholeheartedly throw my newbie support behind Madhatter's recommendations to:

• Use SSL connections
• Randomizing ports at start-up
• Populating SSL connect descriptors as "Apache" and "Firefox / Internet Explorer"

Thank you!