bitfloor coin theft details

[shtylman]

This thread is the sister thread to the "bitfloor needs your help" thread here https://bitcointalk.org/index.php?topic=105818.0

It is meant for the tracking and discussion of the stolen coins from BitFloor.com

The attack came from the following IP:
178.176.218.157

And the coins were withdrawn with the following transactions:
83f3c30dc4fa25afe57b85651b9bbc372e8789d81b08d6966ea81f524e0a02be
d5d23a05858236c379d2aa30886b97600506933bc46c6f2aab2e05da85e61ad2
f9d55dc4b8af65e15f856496335a29e2be40f128a7374c75b75529e864579f93
42ea472060118ee5aee801cdedbc4a3403f3708a87340660f766e2669f0afeb0
358c873892016649ace8e9db4c59f98a6ca8165287ac80e80c52e621f5a26e46

Obviously it is high hopes to have the coins returned, but I do feel that the community can always benefit from more knowledge about high profile thefts and the aftermath.

[nimda]

That IP address is almost certainly one of multiple proxies, but it's in Russia. No help there.

[1nject0r]

This thread is the sister thread to the "bitfloor needs your help" thread here https://bitcointalk.org/index.php?topic=105818.0

It is meant for the tracking and discussion of the stolen coins from BitFloor.com

The attack came from the following IP:
178.176.218.157

And the coins were withdrawn with the following transactions:
83f3c30dc4fa25afe57b85651b9bbc372e8789d81b08d6966ea81f524e0a02be
d5d23a05858236c379d2aa30886b97600506933bc46c6f2aab2e05da85e61ad2
f9d55dc4b8af65e15f856496335a29e2be40f128a7374c75b75529e864579f93
42ea472060118ee5aee801cdedbc4a3403f3708a87340660f766e2669f0afeb0
358c873892016649ace8e9db4c59f98a6ca8165287ac80e80c52e621f5a26e46

Obviously it is high hopes to have the coins returned, but I do feel that the community can always benefit from more knowledge about high profile thefts and the aftermath.

wait letme trace

[1nject0r]

your server were not hacked i didnot see any defacing issue some account were compromised only but your server are not hacked those were not a russian hacker's they were some other countries hacker

[epetroel]

your server were not hacked i didnot see any defacing issue some account were compromised only but your server are not hacked those were not a russian hacker's they were some other countries hacker

This makes absolutely no sense...

[1nject0r]

your server were not hacked i didnot see any defacing issue some account were compromised only but your server are not hacked those were not a russian hacker's they were some other countries hacker

This makes absolutely no sense...

i have the proof that server were not hacked even no hacker did that maybe inside employ did this but

if u know how to check defacing site cache google it

no hackers record on zone-h.org

[coga]

i have the proof that server were not hacked even no hacker did that maybe inside employ did this but

if u know how to check defacing site cache google it

no hackers record on zone-h.org

dude, the situation is already irritating enough as-is. May we focus on something constructive here?

[Vladimir]

I somehow lack compassion today and for that I do apologize.

Having said the above I must say that you kids with all those fat wallet.dat's sitting on your laughable amateurish servers do deserve to be hacked and will continue to be hacked. Right until you come up with some money to pay pros to help you out with information security.

Once you have some money to spend on security conscious hosting and consulting do let me know. A few kBTC/year on proper hosting/security is by far better than 30k loss per year on top of all the reputational problems and likely biz failure.

[ribuck]

A few kBTC/year on proper hosting/security is by far better than 30k loss per year on top of all the reputational problems and likely biz failure.

What kind of security guarantee does one get for a few kBTC/year?

[vampire]

A few kBTC/year on proper hosting/security is by far better than 30k loss per year on top of all the reputational problems and likely biz failure.

What kind of security guarantee does one get for a few kBTC/year?

Zero

[Vladimir]

A few kBTC/year on proper hosting/security is by far better than 30k loss per year on top of all the reputational problems and likely biz failure.

What kind of security guarantee does one get for a few kBTC/year?

Zero

true

but most risks would be reduced dramatically.

Silensec Labs Ltd. (a joint venture of myself and Silensec http://silensec.com/ ) would be happy to discuss what a few kBTC can do for one's information security. But we are going offtopic here, 2 posts full of shameless plugs is too much already.

[iron77]

What would now happen with USD balances?

[DeathAndTaxes]

What would now happen with USD balances?

They should be returned as even if bitfloor opens it obviously will be at some point in the future.  Client funds should be escrowed from company funds.  Clients shouldn't be turned into unwilling "investors" simply because they had funds on the wrong site at the wrong time.

I am still confident that shtylman will do the right thing.

[shtylman]

What would now happen with USD balances?

I am still confident that shtylman will do the right thing.

I am working on that right now. I will post to the other thread (https://bitcointalk.org/index.php?topic=105818.0) in a few minutes.

[notme]

What would now happen with USD balances?

They should be returned as even if bitfloor opens it obviously will be at some point in the future.  Client funds should be escrowed from company funds.  Clients shouldn't be turned into unwilling "investors" simply because they had funds on the wrong site at the wrong time.

I am still confident that shtylman will do the right thing.

You mean like what is happening to those of us who had mostly bitcoin in their accounts?

[casascius]

With all due respect to the victims in this hacking, whoever they'll end up being, I am suspicious of hacking claims where the announcement of the hack includes a factual assertion of how the hack took place, e.g. "we used encryption but they found our forgotten unencrypted backup".  How does one come to know with certainty that this is actually what happened?  Seriously, I'd expect to see "we don't know how they got our funds, but clearly they did, we can think of n possible ways they did it so far, including this forgotten backup, and we'll let you know more when we find out".

When Bitcoinica announced "funds got stolen, they broke into our MtGox by getting our password from LastPass" I questioned this much the same way - this seems unknowable if you're not the hacker.  If I ever get hacked, I'll probably the first to say "I don't know how they got in, but I'm reformatting things as I speak!  (And your coin balances are safe, because I didn't forget anything anywhere that would put them at risk!)"

[shtylman]

With all due respect to the victims in this hacking, whoever they'll end up being, I am suspicious of hacking claims where the announcement of the hack includes a factual assertion of how the hack took place, e.g. "we used encryption but they found our forgotten unencrypted backup".  How does one come to know with certainty that this is actually what happened?  Seriously, I'd expect to see "we don't know how they got our funds, but clearly they did, we can think of n possible ways they did it so far, including this forgotten backup, and we'll let you know more when we find out".

This is the most information I have at the moment. There are only a number of places/files on the disk that would have provided the attacker the keys so narrowing this down to a few possibilities was not impractical.

[ErebusBat]

With all due respect to the victims in this hacking, whoever they'll end up being, I am suspicious of hacking claims where the announcement of the hack includes a factual assertion of how the hack took place, e.g. "we used encryption but they found our forgotten unencrypted backup".  How does one come to know with certainty that this is actually what happened?  Seriously, I'd expect to see "we don't know how they got our funds, but clearly they did, we can think of n possible ways they did it so far, including this forgotten backup, and we'll let you know more when we find out".

This is the most information I have at the moment. There are only a number of places/files on the disk that would have provided the attacker the keys so narrowing this down to a few possibilities was not impractical.

Not knowing your current security procedures how can you rule out a compromise of your personal PCs? 

[deus-ex-machina]

I'm going to try looking into the transaction details. I'll see what I can find. The sooner we get this solved, the better. Even if I find nothing, the least I can do is try to help everyone.

[foo]

Here are clickable links to the transactions, to save everyone a lot of cutting and pasting...

http://blockchain.info/tx/83f3c30dc4fa25afe57b85651b9bbc372e8789d81b08d6966ea81f524e0a02be - 16,120 BTC
http://blockchain.info/tx/d5d23a05858236c379d2aa30886b97600506933bc46c6f2aab2e05da85e61ad2 - 1,000 BTC
http://blockchain.info/tx/f9d55dc4b8af65e15f856496335a29e2be40f128a7374c75b75529e864579f93 - 6,400 BTC
http://blockchain.info/tx/42ea472060118ee5aee801cdedbc4a3403f3708a87340660f766e2669f0afeb0 - 60 BTC
http://blockchain.info/tx/358c873892016649ace8e9db4c59f98a6ca8165287ac80e80c52e621f5a26e46 - 498.39 BTC

EDIT: Added the amounts.