PicoStocks, bitcoin stock exchange

[kaerf]

I see that you recognize the trading fee is a bit high...as well as poor liquidity. Any reason for keeping the trading fee @ 1%?

[1713561009]

1713561009

[1713561009]

1713561009

[tytus]

I see that you recognize the trading fee is a bit high...as well as poor liquidity. Any reason for keeping the trading fee @ 1%?

We would like to encourage long term investments. We want to focus on small startups not on high trading volume assets like BTC/USD.

[tytus]

PicoStocks is down for 1 day. A hacker obtained the password of a big shareholder of Proteon and started executing trades that led to a drop of the price of this asset. The hacker was able to transfer around 1300 BTC from PicoStocks to this account: https://blockchain.info/address/1PoYfqyTnxKdCpv5ydzEGepW5GLsRRHgBb
We will fix the damage today and the trading should continue tomorrow. We will reset the status of Proteon shares to previous state. Other shares were not affected.

[kaerf]

wow. was there actually that much liquidity or did the victim have a lot of coin in his account?

it's somewhat disconcerting seeing coin from my deposit address being transfered out to the hacker's account. can you confirm that this was solely a user's password that was compromised and the server(s) itself were not compromised (there may be indications of attack in the logs).

[fently]

would appreciate 2FA

[ZoladkowaGorzka]

Strange?
Shareholder's password got compromised and you graciously refund the loss. Why is that?
Was the password compromised on your fault? That's great deal of money

[tytus]

Strange?
Shareholder's password got compromised and you graciously refund the loss. Why is that?
Was the password compromised on your fault? That's great deal of money

We will refund the loss because we are operating the account for some of our bigger customers that don't know much about bitcoins and we had the same password on few accounts which was just extremely stupid. This is clearly our fault. The system seems fine. This is clearly a human error.
We will now try to find out how the intruder discovered the passwords.

[tytus]

wow. was there actually that much liquidity or did the victim have a lot of coin in his account?

it's somewhat disconcerting seeing coin from my deposit address being transfered out to the hacker's account. can you confirm that this was solely a user's password that was compromised and the server(s) itself were not compromised (there may be indications of attack in the logs).

You deposit address is there because these are the funds that went to the hot wallet.

[mrb]

PicoStocks is down for 1 day. A hacker obtained the password of a big shareholder of Proteon and started executing trades that led to a drop of the price of this asset. The hacker was able to transfer around 1300 BTC from PicoStocks to this account: https://blockchain.info/address/1PoYfqyTnxKdCpv5ydzEGepW5GLsRRHgBb
We will fix the damage today and the trading should continue tomorrow. We will reset the status of Proteon shares to previous state. Other shares were not affected.

A PicoStocks account is supposed to be permanently tied to a specific Bitcoin address. How was the attacker able to withdraw to a seemingly arbitrary address?

[tytus]

PicoStocks is down for 1 day. A hacker obtained the password of a big shareholder of Proteon and started executing trades that led to a drop of the price of this asset. The hacker was able to transfer around 1300 BTC from PicoStocks to this account: https://blockchain.info/address/1PoYfqyTnxKdCpv5ydzEGepW5GLsRRHgBb
We will fix the damage today and the trading should continue tomorrow. We will reset the status of Proteon shares to previous state. Other shares were not affected.

A PicoStocks account is supposed to be permanently tied to a specific Bitcoin address. How was the attacker able to withdraw to a seemingly arbitrary address?

He/She obtained access to 2 accounts that had the same password. One had shares of proph and the other had funds. He bought shares of "proph" for nothing [sold from the firs stolen account] and sold it to the account that had BTC. The transfer was from his account.

[murfshake]

$145k heist with no repercussions.  Amazing and sad world we live in.

[MPOE-PR]

PicoStocks is down for 1 day. A hacker obtained the password of a big shareholder of Proteon and started executing trades that led to a drop of the price of this asset. The hacker was able to transfer around 1300 BTC from PicoStocks to this account: https://blockchain.info/address/1PoYfqyTnxKdCpv5ydzEGepW5GLsRRHgBb
We will fix the damage today and the trading should continue tomorrow. We will reset the status of Proteon shares to previous state. Other shares were not affected.

A PicoStocks account is supposed to be permanently tied to a specific Bitcoin address. How was the attacker able to withdraw to a seemingly arbitrary address?

The plot thickens.

Looking forward to seeing which will be the third completely imaginary, multi-million dollar mining "investment" this guy makes, after having lost that much on bASIC and seeing how BitFury isn't going to be delivering (or at least, not on the originally promised schedule).

[tytus]

We have identified and fixed the problem. CakePHP does not set the id of the record correctly when saving data (http://book.cakephp.org/1.2/en/The-Manual/Developing-with-CakePHP/Models.html):
... // Update: id is set to a numerical value
$this->Recipe->id = 2;
$this->Recipe->save($this->request->data);
...
this does not work properly as Recipe->id is overwritten by data;
The intruder was able to overwrite the passwords of other users (and no other fields in any of the tables).
The intruder used this page for the attack: https://mullvad.net/en/about.php ... we have notified the owners.

Tomorrow we will clean the damage and revert the state of the shares of the "proph" asset. Other assets were not affected.

[kaerf]

We have identified and fixed the problem. CakePHP does not set the id of the record correctly when saving data (http://book.cakephp.org/1.2/en/The-Manual/Developing-with-CakePHP/Models.html):
... // Update: id is set to a numerical value
$this->Recipe->id = 2;
$this->Recipe->save($this->request->data);
...
this does not work properly as Recipe->id is overwritten by data;
The intruder was able to overwrite the passwords of other users (and no other fields in any of the tables).
The intruder used this page for the attack: https://mullvad.net/en/about.php ... we have notified the owners.

Tomorrow we will clean the damage and revert the state of the shares of the "proph" asset. Other assets were not affected.

ugh, so a user/attacker that POSTs a request with an "id" parameter is able to overwrite another user's data?

this bit of code:
$this->Recipe->save($this->request->data);

looks awfully scary...if it happens in one place, it's likely to happen in other parts of the code. i'm not an expert with cake, but i do know it does a lot of automagical things, so passing a user controlled data structure (request->data) to a magical DB storage method just feels wrong.

[tytus]

ugh, so a user/attacker that POSTs a request with an "id" parameter is able to overwrite another user's data?

In this place only the password, but after that other things as well except the btc accounts.

this bit of code:
$this->Recipe->save($this->request->data);

looks awfully scary
...if it happens in one place, it's likely to happen in other parts of the code.

Yes

...if it happens in one place, it's likely to happen in other parts of the code.

We have reviewed the whole code. This was the only place where this construct was used.

i'm not an expert with cake, but i do know it does a lot of automagical things, so passing a user controlled data structure (request->data) to a magical DB storage method just feels wrong.

The code was like this:
$this->User->id=$this->Auth->user('id');
if ($this->User->save($this->data,array('fieldList'=>array('pass','pass2')))) ...
Only 2 elements should be saved, but apparently data[User][id] overwrites User->id.
We try to limit application of 3rd part software to a minimum.

We will add more security by notifying the user via email of any changes to the account, withdraw attempts and many other things that happen on the system.
Modifications will freeze the account for some period of time so that the user can react.
The admin will be also notified of strange trading orders.

[MPOE-PR]

wow. was there actually that much liquidity?

Nope, not even close. Tytus just likes to tell stories about imaginary bazillions.

[bitfitted]

We will add more security by notifying the user via email of any changes to the account, withdraw attempts and many other things that happen on the system.

Consider also sending confirmation links for doing these things via e-mail / SMS.

[tytus]

We will add more security by notifying the user via email of any changes to the account, withdraw attempts and many other things that happen on the system.

Consider also sending confirmation links for doing these things via e-mail / SMS.

Yes. We will add mandatory email confirmation and probably withdraw confirmations but confirming each trade by email is not convenient.
The page is up again. Proteon assets are restored.
I will continue adding security / notifications tomorrow.

Sorry for the inconvenience !!!

[kaerf]

i think there is a slight bug with the login. i've had to login twice the last few times i've accessed the site.

[tytus]

Yes, if You click on the login info before redirection something strange happens and the session is lost. I will look at this today or tomorrow. I am too busy with the 100th chips order to move forward with the server as fast as I wanted :-(