Reports of MtGox being hacked ARE REAL (Fixed)

[jrmithdobbs]

I have independently confirmed that MtGox has a GIGANTIC CSRF vuln that lets me empty your account.

MagicalTux, you should know better than that. Honestly.

Also confirmed. This isn't acceptable.

[1715129149]

1715129149

[1715129149]

1715129149

[1715129149]

1715129149

[1715129149]

1715129149

[lemonginger]

So the exploit has been fixed?

[cunicula]

Seems to me they should take the market offline until this is fixed.

Pretty sure Mt. Gox would have legal responsibility for coins/funds lost due to the exploit.

Allowing users who haven't read this thread to lose funds is negligent.

[Digigami]

nvm..

[malditonuke]

So what this means...

If you go to another site with exploit code while you're logged into mtgox, this site can perform operations on your mtgox account.

To protect yourself, use a seperate browser for mtgox ONLY.

If you normally use firefox, install chrome and use that for mtgox.  If you use chrome, install firefox.

If you use both, install a seperate copy of firefox portable if you're on windows.

for chrome, you can open mtgox in incognito-mode and that will work too, right?

[tcatm]

Both bugs are fixed now. I have just verified it.

[Herodes]

I see some of you devs talking about releasing a script for the script kiddies that can be used to empty users mtGox accounts, only because you haven't been able to get hold of MagicalTux.

If you do a whois listing of mtgox.com you will find contact information, also a phone number.

Before you all go apeshit over this issue, be aware that mtGox is probably flooded with requests, so it can be difficult to get hold of them quickly.

But I agree this is not an acceptable situation, but deal with it as adults, and remember anyone who creates a tool that can be used for mischief can also be held responsible for this. It is better to try to get hold of MagicalTux or someone else at mtGox instead of trying to make the matter worse.

I feel sorry for anyone that have lost their funds, and hope everyone take proper security precations.

Edit: I see now it is claimed that the issues in question has been fixed. Good.

[jrmithdobbs]

Both bugs are fixed now. I have just verified it.

Seconded.

[jrmithdobbs]

But I agree this is not an acceptable situation, but deal with it as adults, and remember anyone who creates a tool that can be used for mischief can also be held responsible for this.

He's been trying to get ahold of him for a week.

[DamienBlack]

Now that we know the attack vector, can we search for bitcoin related websites that were taking advantage of it?

[Herodes]

Now that we know the attack vector, can we search for bitcoin related websites that were taking advantage of it?

Yess, you can start with the buttcoins website, it just advertised for a wallet stealing site.

[REF]

and today was my first time using mtgox.... good thing i didnt want i needed to and took everything out once i finished. I even hit log out which i almost never do. Seems like some admin has removed this from the news. Good no need to cause panic over something which has been fixed.

[jrmithdobbs]

Now that we know the attack vector, can we search for bitcoin related websites that were taking advantage of it?

Yess, you can start with the buttcoins website, it just advertised for a wallet stealing site.

walletinspector.info has once again been replaced by a static png image. They tried to re-implement it as a "funny" javascript-only form. Linode's abuse department didn't find my pointing this out humorous. The original site before ~00:00 CST did really steal wallets and the owner tried to play it off as a harmless prank to avoid service termination.

I'm still slightly disappointed that service was not outright canceled once it was discovered the authorized user of that VPS was in fact responsible for said site and that it wasn't due to a compromise.

At least it's not harmful, for now.

[bodhipraxis]

Both bugs are fixed now. I have just verified it.

until 5 minutes ago, the following banner appeared on bitcoincharts.com:
http://i1236.photobucket.com/albums/ff458/bodhiforest/bitcoin_security/MtGoxSecurityFlawWarning_june18_on_bitcoincharts.png

[done]

sounds like everything is safer then ever. excellent job guys.

[Serge]

So they are taking my cookies? NOZ!

Basically, when you visit their site they secretly load an iframe that contains mtgox.com. The URL of the iframe points to an XSS hole, which injects Javascript to send document.cookie (which stores your session info) to a site they own. They can then put the cookie data into their browser, and assume your session and log into mtgox.

I don't know this specific exploit but that is how it generally works.

Nope.avi.
CSRF != XSS.

XSS = put my javascript on your site

CSRF = put a form on my site that POSTs to your site, for added fun auto-submit it with JavaScript

how can this be dealt on a client side besides what's been mentioned above, is there a method to detect/disable both vulnerabilities without turning off cookies and js?

[Serge]

were there any other sites that been exploited with these things in the past?

in my understanding any web site is vulnerable to such attack? is this correct?

[theymos]

in my understanding any web site is vulnerable to such attack? is this correct?

Not correctly-designed ones.

(I don't blame MagicalTux, since he didn't write the code.)

[Serge]

were there any other sites that been exploited with these things in the past?

in my understanding any web site is vulnerable to such attack? is this correct?

Sorry for the OT post, but I couldn't help myself.

Watch how Bitcoin bring computer security to the masses. Just another undiscovered benefit.

+1, thought exactly the same thing.

[Serge]

in my understanding any web site is vulnerable to such attack? is this correct?

Not correctly-designed ones.

(I don't blame MagicalTux, since he didn't write the code.)

Could you or anyone please point me where one can read how it can be dealt with on a server side?