Bitcoin Forum
December 08, 2016, 02:38:38 PM *
News: To be able to use the next phase of the beta forum software, please ensure that your email address is correct/functional.
 
   Home   Help Search Donate Login Register  
Pages: « 1 2 [3] 4 5 6 7 »  All
  Print  
Author Topic: Bitcoin7 a new exchange  (Read 19561 times)
davout
Legendary
*
Offline Offline

Activity: 1358


1davout


View Profile WWW
June 16, 2011, 09:08:59 AM
 #41

Security is no joke indeed, thanks for reporting.
The glitch has been fixed. We review any single transaction manually at the moment anyway.
Our commitment is to ensure maximum stability, even if we have to restore damage.

Still easy to exploit.

Malicious page has an 1px * 1px iframe displaying the withdraw page, populates and posts form through javascript with the added bonus that it can parse the DOM to figure out your exact (well floating point exact XD) BTC balance before withdrawing it.
* davout heads to bitcoin-central.net to add a PIN code Smiley

1481207918
Hero Member
*
Offline Offline

Posts: 1481207918

View Profile Personal Message (Offline)

Ignore
1481207918
Reply with quote  #2

1481207918
Report to moderator
1481207918
Hero Member
*
Offline Offline

Posts: 1481207918

View Profile Personal Message (Offline)

Ignore
1481207918
Reply with quote  #2

1481207918
Report to moderator
1481207918
Hero Member
*
Offline Offline

Posts: 1481207918

View Profile Personal Message (Offline)

Ignore
1481207918
Reply with quote  #2

1481207918
Report to moderator
Advertised sites are not endorsed by the Bitcoin Forum. They may be unsafe, untrustworthy, or illegal in your jurisdiction. Advertise here.
cuddlefish
Full Member
***
Offline Offline

Activity: 126



View Profile
June 16, 2011, 09:11:12 AM
 #42

Security is no joke indeed, thanks for reporting.
The glitch has been fixed. We review any single transaction manually at the moment anyway.
Our commitment is to ensure maximum stability, even if we have to restore damage.

Still easy to exploit.

Malicious page has an 1px * 1px iframe displaying the withdraw page, populates and posts form through javascript with the added bonus that it can parse the DOM to figure out your exact (well floating point exact XD) BTC balance before withdrawing it.
* davout heads to bitcoin-central.net to add a PIN code Smiley

Yup. I'm adding a framebreaker to Ubitex.org (although since I don't handle money, not nearly as bad.)

rb2k
Member
**
Offline Offline

Activity: 109


View Profile
June 16, 2011, 09:22:11 AM
 #43

Ok, so:
  • Text was copied
  • Coins are stored as floats and apparently this won't change
  • Site is exploitable

Yeah... thanks but no thanks Smiley
cuddlefish
Full Member
***
Offline Offline

Activity: 126



View Profile
June 16, 2011, 09:27:32 AM
 #44

Ok, so:
  • Site is exploitable

Oh, not just exploitable. Exploitable as in Sony.

jav
Sr. Member
****
Offline Offline

Activity: 249


View Profile
June 16, 2011, 11:24:59 AM
 #45

Security is no joke indeed, thanks for reporting.
The glitch has been fixed. We review any single transaction manually at the moment anyway.
Our commitment is to ensure maximum stability, even if we have to restore damage.

Still easy to exploit.

Malicious page has an 1px * 1px iframe displaying the withdraw page, populates and posts form through javascript with the added bonus that it can parse the DOM to figure out your exact (well floating point exact XD) BTC balance before withdrawing it.
* davout heads to bitcoin-central.net to add a PIN code Smiley

This is not true - stuff like this is prevented by the same origin policy. (Think about it: if that was possible, you could also load Facebook.com in an iframe and then - provided the user is logged in - call all sorts of functions with javascript). You can only access the iframe from code, that comes from the same domain.

This might just get dangerous when combined with cross-site scripting: If you manage to feed the webserver some data that it will display back to you unescaped, you can then get your code to come from the same domain and can do these sort of things.

Hive, a beautiful wallet with an app platform for Mac OS X, Android and Mobile Web. Translators wanted! iOS and OS X devs see BitcoinKit. Tweets @hivewallet. Donations appreciated at 1HLRg9C1GsfEVH555hgcjzDeas14jen2Cn.
davout
Legendary
*
Offline Offline

Activity: 1358


1davout


View Profile WWW
June 16, 2011, 12:15:43 PM
 #46

This is not true - stuff like this is prevented by the same origin policy. (Think about it: if that was possible, you could also load Facebook.com in an iframe and then - provided the user is logged in - call all sorts of functions with javascript). You can only access the iframe from code, that comes from the same domain.
I stand corrected on this one

jakemates
Member
**
Offline Offline

Activity: 69


firstbits.com/1c3qpa


View Profile WWW
June 16, 2011, 01:45:42 PM
 #47

From this topic:

we don't store in floats. We keep the accuracy up to floats, but store numbers in a more "integer" way. I can't share more on the technical side of this matter

You should, because "we store numbers in a more integer way" is hardly reassuring.

bittersweet, digging further on this will help neither the users nor Bitcoin7.
darkwon
Jr. Member
*
Offline Offline

Activity: 56



View Profile
June 16, 2011, 02:12:39 PM
 #48

Wow, you guys are hyper-critical. Why so much hate in your reaction? I mean some posters on this forum outright said that just because they're from Bulgaria it must mean they are scammers.

I don't think bitcoin7 did a perfect start either and there's still obviously a lot to be done on their site, but at least they are very proactive about it, fixing things within minutes of reports coming in, communicating a lot in emails and on forum, trying to be helpful, etc..

They have a total of 400 Bitcoins traded as of now, this exchange just opened, but you all expect perfection right from the start?!

Yes they made some mistakes, like copying that text from Tradehill and having security holes, but they're also very quick in acknowledging and fixing mistakes; which shows, at least to me, that they're honestly trying their best to provide a good service to us.


Sign up for new Bitcoin Exchanges:

|| TradeHill || or || Bitcoin7 ||

(Using these links will give you a lifetime rebate on all fees)
davout
Legendary
*
Offline Offline

Activity: 1358


1davout


View Profile WWW
June 16, 2011, 02:29:37 PM
 #49

they're also very quick in acknowledging and fixing mistakes
Well, actually no, they could have said something like "hey yeah that's right, we should store amounts in decimal, not in floats", but instead, the answer was pretty much just marketing talk. please read the whole thread

darkwon
Jr. Member
*
Offline Offline

Activity: 56



View Profile
June 16, 2011, 02:39:30 PM
 #50

You are right, the floating point issue is the only one where they didn't immediately respond with "it's being fixed right now", for reasons i could only speculate about. Still, that doesn't change the other points i made in my posting. Please don't single out one issue like this, it's a bad habit in debating.

Sign up for new Bitcoin Exchanges:

|| TradeHill || or || Bitcoin7 ||

(Using these links will give you a lifetime rebate on all fees)
davout
Legendary
*
Offline Offline

Activity: 1358


1davout


View Profile WWW
June 16, 2011, 02:49:19 PM
 #51

It's not that they didn't fix it that's disturbing, it's the fact they don't even acknowledge it is an issue that is.

Bitcoin7 keep the records with extreme accuracy, there is really nothing to be fixed.

grondilu
Legendary
*
Offline Offline

Activity: 1134


View Profile
June 16, 2011, 03:08:54 PM
 #52


Registered today.  Transfered a few euros via SEPA.

I'll let you guys know if everything went smooth.
lemonginger
Full Member
***
Offline Offline

Activity: 210


firstbits: 121vnq


View Profile
June 16, 2011, 04:51:58 PM
 #53

Wow, you guys are hyper-critical. Why so much hate in your reaction? I mean some posters on this forum outright said that just because they're from Bulgaria it must mean they are scammers.

YOU CAN'T RUN A LIVE MONEY EXCHANGE SITE WITH LARGE SECURITY HOLES.

Seriously, "fixing on the fly" is not an okay way to run a site that is moving money. It doesn't matter whether they are scammers or very well-meaning but incompetent programmers trying to cash in off the lack of exchanges currently out there.

If you are making mistakes at the most basic levels, it is likely that your site is going to be riddled with possible security holes. No one wants to hear "Oh, sorry, we are fixing it now" after their money goes flying out the window. Not to mention any exchange handling any large amounts of money is going to be a target for thieves, hackers, governments, DDOS attacks, etc etc etc. If you are going to paint a target on your back with other people's money, you best be in a position to handle it.

For all I know these folks are the nicest people on earth and I'd be happy to have a beer with them. That doesn't mean they should be programming a currency exchange.
jkminkov
Hero Member
*****
Offline Offline

Activity: 534


View Profile
June 16, 2011, 04:58:49 PM
 #54

if there're holes, EXPLOIT THE GODDAMN THING, JUST FOR THE LULZ!

Bleutrade
600 dollars in one place talking - Dudes, hooray, Bitcoin against us just one, but we are growing in numbers!
davout
Legendary
*
Offline Offline

Activity: 1358


1davout


View Profile WWW
June 16, 2011, 05:10:13 PM
 #55

if there're holes, EXPLOIT THE GODDAMN THING, JUST FOR THE LULZ!
it's yours that i'm going to exploit for the lulz

joan
Jr. Member
*
Offline Offline

Activity: 56



View Profile
June 16, 2011, 05:15:31 PM
 #56

Wow, you guys are hyper-critical. Why so much hate in your reaction?
I agree the reaction has been harsh, but I think it's a good thing.
The influx of users have been overwhelming. Many people have seen quick dollars and business opportunities. We need to make sure these new businesses are sound and safe for the users.

If that means aggressively auditing every new project for security holes and taking a "scam until proven otherwise" stance, so be it. Better safe than sorry.
Every project handling people coins needs to have very high security standards. Lotteries need to be provably honest. Exchanges and escrows need to be transparent.
We need to raise the bar.
gene
Sr. Member
****
Offline Offline

Activity: 252


View Profile
June 16, 2011, 06:05:16 PM
 #57

Exchanges are crucial. If this exchange is shit (smells like it), it damages bitcoin.

So yes, it is time to get vicious.

*processing payment* *error 404 : funds not found*
Do you want to complain on the forum just to fall for another scam a few days later?
| YES       |        YES |
Bitcoin7.com
Newbie
*
Offline Offline

Activity: 29



View Profile WWW
June 16, 2011, 07:47:56 PM
 #58

Just to mention that we are monitoring the topic closely, without taking part of it as it seems whatever we write there will always be people like davout who will speculate and turn the exchange to be a fraud. Luckily there are more and more successful trades and people with positive reaction.
We had flaws, we still have, we were not ready for the start yesterday, but we are working 24/7 on all requests.

Again thanks for all who are trusting us and also starting to defend us -> it really helps and motivates us people!

http://www.Bitcoin7.com (http://www.Bitcoin7.com)  - Trade Bitcoins online! Buy/Sell BTC for USD, EUR, PLN, SAR, BGN - lowest commission on the Internet!
jakemates
Member
**
Offline Offline

Activity: 69


firstbits.com/1c3qpa


View Profile WWW
June 16, 2011, 07:51:31 PM
 #59

Just to mention that we are monitoring the topic closely, without taking part of it as it seems whatever we write there will always be people like davout who will speculate and turn the exchange to be a fraud. Luckily there are more and more successful trades and people with positive reaction.
We had flaws, we still have, we were not ready for the start yesterday, but we are working 24/7 on all requests.

Again thanks for all who are trusting us and also starting to defend us -> it really helps and motivates us people!

Do you still use floats to store values and are you still vulnerable to CSRF exploits?
finnthecelt
Full Member
***
Offline Offline

Activity: 140


View Profile
June 16, 2011, 08:16:19 PM
 #60

So for what it's worth.

I have successfully transferred BTC to B7.

I have sold some BTC.

I transferred it to my Dwolla account and it's showing up there....

Pages: « 1 2 [3] 4 5 6 7 »  All
  Print  
 
Jump to:  

Sponsored by , a Bitcoin-accepting VPN.
Powered by MySQL Powered by PHP Powered by SMF 1.1.19 | SMF © 2006-2009, Simple Machines Valid XHTML 1.0! Valid CSS!