Arghh, server died. I'm restarting now and will have a look at what happened...

Yeah, 10 seconds is much too slow. We'll have to work on that.


Hi amiryaqot. Thanks for helping out! Just sent you a link to the secret server.

Concerning the seed issue I forgot to add that once the page is loaded it's actually pretty fast. We've had people cranking out 8 bets per second :-)

Awesome panjul07, welcome to the team! If anyone else wants to join, please let me know (restricted to members & above atm).


Page load time is something we really need to work on. For me the site loads in about 6 sec which is much more than we want it to be. Please let me know if it takes much longer than that for you.


Hmm, I just realized that the way I send the link to people is a bit confusing, will resend the link to you by pm.


Thanks so much for helping out guys! Looking forward to seeing you in the chat :-)

Ok, we are finally starting to beta test the site after the hack :-)

If would like to join the bets testing team just let me know and I will give you access to our new server. For security reasons I can only allow bitcoin talk users of rank "member" and above at this point. We will reopen to the public in a few days.

Sure, mate, will do :-)

You are on that list already :-). Will email you when we are ready to start

Hey boopy265420, awesome, added you to the list. Beta testing has not started yet, but will let you know when we start...

Sure thing trafficolaa, will add you to the list of bets testers :-). If anyone else want's to join in just let me know here. For security reasons I will only be able to accept Bitcoin talk users of rank "member" and above as beta testers though.

Thanks mate :-) We will definitely be back for next weekend. We are trying really hard to make it at the beginning of this week actually.

The security issue is now fixed, but as a security precaution we are setting up a completely new server that is configured as securly as at all possible. Will then open to a few users to test and if that goes well we'll open to the public.

Thanks to everyone for being so understanding. We can't wait to get back ourselves, but don't want to rush it on the other hand...

Yup, we have been hacked. You can find a lot of info on that below. We'll be opening in the next few days. Feel free to contact me personally at henry@fastslots.co anytime.

Jup, I said we'll be back this weekend or beginning next week. Still think that this will happen.

Great point yoloer808. Will actually do that right now: I just signed our new hot wallet which currently holds 5.468 BTC.

Address: 1FCEXDW4Em8qVbfNbGcMttFxGmLty7amFG
Message: FastSlots Main Wallet - we will be back!
Signature: H0iDQlgfXCdtSvO8A8N3yim4/bl7gmxv4n5I/9ueC7ogQmC4B29GGPEGClW/E0j9WpLmed8PBY9BRBBoj6yJf4Y=

To verify just head over to https://brainwallet.github.io/#verify, click on Bitcoin-QT, and insert the above.

We run our own server. I just noticed that you run http://crypto-games.net. It's a great site! Would love to exchange thought on security with you. Will send you a pm in a bit.

Hi joter85, thanks for your input. In the case of this hack this was not the case though. We have detailed logs that show that the server secret was different on each bet. But it is also apparent that the attacker could predict the next server secret, most likely because he had access to the db.


Basically the problem was about the security of our server and not a problem with our application code. We are currently setting the server back up with all sorts of security measures in place. We will test things thoroughly and will be back most likely in a day or two, but worst case at the beginning of next week. I really do not want to rush this just to get hacked again.



Thanks mate :-)

Sorry for my late reply. Was unsure how to answer your second question (see below)

I think you should not be. I think consumers are pretty safe these days (at least they are much more than a few years ago).

What annoys me most about this incident is that hackers keep the barrier to entry into the gambling world high. Operators need to waste a lot of time and money on security instead of implementing games. This is one of the reasons why building an online casino is hard. If opening an online casino was as easy as writing and online game I'd bet that gambling would be way more awesome (and way more fair for that matter).

I have though about your question for a bit but have not come to a final conclusion as to how much info to share. I do not want to put too many details out there that might put us in jeopardy in the future. I can however point to resources that people setting up bitcoin casinos might find useful. They are all related to server security as that is what we are focussed on atm.

There is a great article on how to get a baseline level of security for a web server. Everybody who want's to get into the bitcoin game as an operator should follow these instructions from day one:
https://www.linode.com/docs/security/securing-your-server

The rest of your security will depend on your application and your level of paranoia. The best in depth resource on server security that I could find on the web is the "Securing Debian Howto".
https://www.debian.org/doc/manuals/securing-debian-howto/index.en.html

Will not share more info atm but might in the future. If anyone knows security related resources that will help us and other operators build more secure casinos, feel free to post them here.

Thanks mate appreciate your support.

Actually our system is pretty solid. We've had it tested by several talented hackers that could not break anything. However we did have a small vulnerability. With respect to security that's basically just as bad as having no security at all (at least it can cost the same amount of money...). Nonetheless this is a wakeup call for us to double down on security even more and to rethink all aspects of our system. Once we get this done, FastSlots will be even more secure.

It's still hard to estimate when exactly we will be back. I have the tendency to be too optimistic in my estimates, but I really hope it will not take more than a few days.

If anyone would like to withdraw just email me (henry@fastslots.co). My purchase of additional coins has now cleared so that I will be able to payout all deposits immediately.

Hi guys,

We finally know what happened during the hack and can now start fixing things. I cannot disclose many details, all I can say is that the attacker was able to predict server secrets which allowed him to rake in huge wins.

We have learned a lot from this incident and the result will be that FastSlots will be more secure than ever. We've worked with a group of trusted bitcointalk users to scrutinize FastSlots' security. The result is that we know much more precisely what our weak points are and are able to address these accordingly. We really like to think of FastSlots as an organism: every time we survive and attack that makes us stronger.

We will get back online in a few days. As mentioned previously, just send me an email (henry@fastslots.co) if you'd like to withdraw your balance. 

Henry

It's hard to say atm cause we are still working on a fix. The one thing that is for sure is that FastSlots will be more secure when this is over. We are working with a great group of smart people on this...

You do not need to worry about your deposit. If you like I can send it to an address of your liking. Just email me at henry@fastslots.co.

Hi guy! Please find my answers below.


Thanks somuchee. We have not fixed the problem yet. We will not rush this cause we need to make sure that we understand exactly what happened. Will keep you posted.


We use a bank account bc it's a hedge against the volatility of the bitcoin price. One of the lessons learned is that we will continue to have enough money in the bank so that we can payout all users in case of a hack.


The hacker took about 5btc. Luckily this was only a small part of our total bank roll.


Thanks for your support guys. We'll do our best to bring back FastSlots as soon as it's secure. If anyone wants to withdraw in the mean time, just send me an email (henry@fastslots.co)