|
piramida
Legendary
Offline
Activity: 1176
Merit: 1010
Borsche
|
|
March 06, 2013, 12:12:35 PM |
|
12 000 dollars, really? my grandma gets regularly hacked for more money.
|
i am satoshi
|
|
|
Digikeys
Member
Offline
Activity: 115
Merit: 10
|
|
March 06, 2013, 12:46:37 PM |
|
12 000 dollars, really? my grandma gets regularly hacked for more money.
+2 for piramida.. I lol'd at this and the 'religion permits you from using google' Well played sir.
|
|
|
|
Herodes
|
|
March 06, 2013, 12:52:10 PM |
|
12K USD was an unfortunate loss, but I do think that this also showed that BitInstant had security measures in place, it could've been worse. This sounds like basically one of the worst things that can happen.
But now that this vector of attach has been revealed, it's time to learn and secure it even more.
|
|
|
|
proudhon
Legendary
Offline
Activity: 2198
Merit: 1311
|
|
March 06, 2013, 12:55:40 PM |
|
Hosting companies and the like have become fruitful attack vectors. A lot of them clearly don't take security seriously enough if you can call up or write in with a close enough looking email address and get elevated rights.
|
Bitcoin Fact: the price of bitcoin will not be greater than $70k for more than 25 consecutive days at any point in the rest of recorded human history.
|
|
|
Herodes
|
|
March 06, 2013, 01:02:09 PM |
|
Hosting companies and the like have become fruitful attack vectors. A lot of them clearly don't take security seriously enough if you can call up or write in with a close enough looking email address and get elevated rights.
Well - for the average customer - security is good enough - bitcoin businesses on the other hand has a lot higher demands for security.
|
|
|
|
bullioner
|
|
March 06, 2013, 01:07:01 PM |
|
The article doesn't explain the vector from getting access to domain registration administration via the domain registrar, to how the Bitcoins were stolen. It isn't obvious what this vector would be, and must depend on the specifics of Bitinstant's setup. Does anyone have more details on this? Was it actually that they got access to a virtual server? In which case, why are Bitinstant using virtual servers hosted by someone else?
|
|
|
|
Herodes
|
|
March 06, 2013, 02:47:11 PM |
|
In which case, why are Bitinstant using virtual servers hosted by someone else?
A good question - perhaps Bitinstant can answer it ?
|
|
|
|
Blazr
|
|
March 06, 2013, 02:55:55 PM Last edit: March 06, 2013, 05:30:48 PM by Blazr |
|
It wasn't the hosting company it was the domain registrar, they used Site5 to register the domain and the hacker convinced them to hand over control of the domain name to him/her. IMO it isn't such a good idea to use Site5 to register domains seeing as it isn't actually an accredited registrar but a reseller for eNom.
I've seen similar happen before, I don't know the exact details of this attack, but the problem of using a reseller like Site5 is that eNom, the actual registrar, don't have the customers details on file, and a hacker can contact eNom directly claiming to own the domain and they would have no idea if its true or not.
|
|
|
|
Morblias
|
|
March 06, 2013, 03:04:39 PM |
|
However, says the post, various security measures, such as multi-factor authentication and auto lockdowns prevented any more theft and no personal or transactional information from users has been leaked. +1 for BitInstant
|
Tips / Donations accepted: 1Morb18DsDHNEv6TeQXBdba872ZSpiK9fY
|
|
|
twolifeinexile
|
|
March 06, 2013, 03:54:55 PM |
|
However, says the post, various security measures, such as multi-factor authentication and auto lockdowns prevented any more theft and no personal or transactional information from users has been leaked. +1 for BitInstant unfornately to BitInstant, but it seems their security practice prevented a much bigger disaster.
|
|
|
|
|
creativex
|
|
March 08, 2013, 06:38:03 AM |
|
I've tried to use bitinstant several times in the last couple days, but there's always an error.
|
|
|
|
pinger (OP)
Legendary
Offline
Activity: 1512
Merit: 1001
Bitcoin - Resistance is futile
|
|
March 08, 2013, 07:48:28 AM |
|
We posted full details of the incident here: http://blog.bitinstant.com/blog/2013/3/4/events-of-friday-bitinstant-back-online.htmlNobody to date has managed to actually break into any of our systems, this was a vulnerability at our domain registrar and sadly there was not a lot we could have done other than choosing another registrar - which is something we will be doing as soon as possible, most likely within the next week we'll start moving. Thanks for the link Gareth
|
For rent
|
|
|
apetersson
|
|
March 08, 2013, 08:51:41 AM |
|
the description of the hack sounded like an awful lot of work and risk for only 333 BTC. Where i live, you earn that easily in three months of honest work as a developer.
|
|
|
|
pinger (OP)
Legendary
Offline
Activity: 1512
Merit: 1001
Bitcoin - Resistance is futile
|
|
March 08, 2013, 08:56:45 AM |
|
the description of the hack sounded like an awful lot of work and risk for only 333 BTC. Where i live, you earn that easily in three months of honest work as a developer.
Maybe it was just an attention touch.
|
For rent
|
|
|
piramida
Legendary
Offline
Activity: 1176
Merit: 1010
Borsche
|
|
March 08, 2013, 09:34:57 AM |
|
the description of the hack sounded like an awful lot of work and risk for only 333 BTC. Where i live, you earn that easily in three months of honest work as a developer.
Well if it originated in Russia it could be an annual salary; but nevertheless, obviously thiefs were aiming for more, but that's the most they managed to get out in that 12 hours or how long they owned the domain. The hack itself cost hundreds of dollars, so it definitely paid off anyway. There is a good lesson in all of this. Don't register your domains with cheap shops. Keep your security questions unguessable. No, you don't have to use your actual mother's maiden name.
|
i am satoshi
|
|
|
bullioner
|
|
March 08, 2013, 09:57:57 AM |
|
We posted full details of the incident here: http://blog.bitinstant.com/blog/2013/3/4/events-of-friday-bitinstant-back-online.htmlNobody to date has managed to actually break into any of our systems, this was a vulnerability at our domain registrar and sadly there was not a lot we could have done other than choosing another registrar - which is something we will be doing as soon as possible, most likely within the next week we'll start moving. Roll on the day when we can securely register names via some kind of global proof-of-work-based transaction log, providing a secure basis for every aspect of name registration.
|
|
|
|
Morblias
|
|
March 08, 2013, 02:51:43 PM |
|
We posted full details of the incident here: http://blog.bitinstant.com/blog/2013/3/4/events-of-friday-bitinstant-back-online.htmlNobody to date has managed to actually break into any of our systems, this was a vulnerability at our domain registrar and sadly there was not a lot we could have done other than choosing another registrar - which is something we will be doing as soon as possible, most likely within the next week we'll start moving. Just curious, since this was 100% the domain registrar's fault, do they compensate you for the loss?
|
Tips / Donations accepted: 1Morb18DsDHNEv6TeQXBdba872ZSpiK9fY
|
|
|
Gareth Nelson
|
|
March 08, 2013, 03:10:26 PM |
|
We posted full details of the incident here: http://blog.bitinstant.com/blog/2013/3/4/events-of-friday-bitinstant-back-online.htmlNobody to date has managed to actually break into any of our systems, this was a vulnerability at our domain registrar and sadly there was not a lot we could have done other than choosing another registrar - which is something we will be doing as soon as possible, most likely within the next week we'll start moving. Just curious, since this was 100% the domain registrar's fault, do they compensate you for the loss? In an ideal world they would, there's a possibility we could hold them liable but i'd not want to comment on that either way without taking legal advice first.
|
|
|
|
|