Bitcoin Forum
December 07, 2016, 08:25:38 PM *
News: To be able to use the next phase of the beta forum software, please ensure that your email address is correct/functional.
 
   Home   Help Search Donate Login Register  
Pages: [1] 2 »  All
  Print  
Author Topic: Market Crash: Mt Gox has been Hacked (Official Statement)  (Read 6285 times)
bitsalame
Donator
Hero Member
*
Offline Offline

Activity: 616


Preaching the gospel of Satoshi


View Profile
June 19, 2011, 07:20:00 PM
 #1

The bitcoin will be back to around 17.5$/BTC after we rollback all trades that have happened after the huge Bitcoin sale that happened on June 20th near 3:00am (JST).

Service should be back by June 20th 10:00am (JST, 01:00am GMT) with all the trades reversed and accounts available.

One account with a lot of coins was compromised and whoever stole it (using a HK based IP to login) first sold all the coins in there, to buy those again just after, and then tried to withdraw the coins. The $1000/day withdraw limit was active for this account and the hacker could only get out with $1000 worth of coins.

Apart from this no account was compromised, and nothing was lost. Due to the large impact this had on the Bitcoin market, we will rollback every trade which happened since the big sale, and ensure this account is secure before opening access again.

--------------

My Opinion here, although it is unfortunate for the owner of the account, in the real world money stolen it is money gone.
The "reverting" back the transactions and "re establishing" the price arbitrarily IS NOT ACCEPTABLE. What is it, a game?

That is why in the real world have insurances.
We should create an insurance mechanism in the case of hacked accounts, but reverting back transactions is not acceptable.
1481142338
Hero Member
*
Offline Offline

Posts: 1481142338

View Profile Personal Message (Offline)

Ignore
1481142338
Reply with quote  #2

1481142338
Report to moderator
Advertised sites are not endorsed by the Bitcoin Forum. They may be unsafe, untrustworthy, or illegal in your jurisdiction. Advertise here.
1481142338
Hero Member
*
Offline Offline

Posts: 1481142338

View Profile Personal Message (Offline)

Ignore
1481142338
Reply with quote  #2

1481142338
Report to moderator
1481142338
Hero Member
*
Offline Offline

Posts: 1481142338

View Profile Personal Message (Offline)

Ignore
1481142338
Reply with quote  #2

1481142338
Report to moderator
1481142338
Hero Member
*
Offline Offline

Posts: 1481142338

View Profile Personal Message (Offline)

Ignore
1481142338
Reply with quote  #2

1481142338
Report to moderator
Shox
Newbie
*
Offline Offline

Activity: 6


View Profile
June 19, 2011, 07:28:26 PM
 #2

Was this thread really needed among the billions of others?

Sorry but that announcement has already been posted a few times.
jack_jones
Newbie
*
Offline Offline

Activity: 14


View Profile
June 19, 2011, 07:29:53 PM
 #3

In this context what does 'rollback' imply?
BitcoinPorn
Hero Member
*****
Offline Offline

Activity: 560


Posts: 69


View Profile WWW
June 19, 2011, 07:30:25 PM
 #4

My Opinion here, although it is unfortunate for the owner of the account, in the real world money stolen it is money gone.
The "reverting" back the transactions and "re establishing" the price arbitrarily IS NOT ACCEPTABLE. What is it, a game?

That is why in the real world have insurances.
We should create an insurance mechanism in the case of hacked accounts, but reverting back transactions is not acceptable

This is a game.  All people are taking on all risks involved in this yet established currency (which I believe will stand against all these tests).  I think we should all appreciate that Gox takes this responsibility on himself to be like 'holy shit, this is fucked up for so many people, I at the least have the power to change this one thing' and so he is.  I'm seriously glad.

But yeah, in the end, insurance and all that good stuff comes with so many third parties.  I think banks are obviously out with Bitcoins, but something along the line of sects and trusted groups will start coming out I think (it may already be starting with/within Pools).

monsterblitz
Newbie
*
Offline Offline

Activity: 25



View Profile WWW
June 19, 2011, 07:35:12 PM
 #5

Was this thread really needed among the billions of others?

Sorry but that announcement has already been posted a few times.

I checked & didn't see another post about this.  It may have been posted in another topic or forum.  Since this is an official announce, seem pretty appropriate considering the circumstances.

"Not everything that counts can be counted, and not everything that can be counted counts."
Nanodemon
Newbie
*
Offline Offline

Activity: 5


View Profile
June 19, 2011, 07:38:37 PM
 #6

account compromise != hack. Someone got keylogged, had an insecure password, or some other nonsense. this isnt "hacking"
bitsalame
Donator
Hero Member
*
Offline Offline

Activity: 616


Preaching the gospel of Satoshi


View Profile
June 19, 2011, 07:40:47 PM
 #7

Was this thread really needed among the billions of others?

Sorry but that announcement has already been posted a few times.

Oh Really? Care to cite your "billion" posts?
The last time I checked everyone was just lost, the theories of conspiracies between TradeHill making a shady move against MtGox were the trending posts.

I am bringing the official statement from MtGox and stop the nonsense conspiranoid chattery.
Cheers
Beremat
Member
**
Offline Offline

Activity: 118


View Profile
June 19, 2011, 07:42:38 PM
 #8

The price isn't being set arbitrarily. It was $17.5 the second before the big sale, and that's what it's being rolled back to.
Nanodemon
Newbie
*
Offline Offline

Activity: 5


View Profile
June 19, 2011, 07:55:42 PM
 #9

The price isn't being set arbitrarily. It was $17.5 the second before the big sale, and that's what it's being rolled back to.

however, that will not correctly dictate the state of the market when the site comes back up, meaning its an arbitrary number at the time. If your buy and sell orders are based on that, when say...tradehill or some other exchange is significantly higher or lower, it stands to reason that you will lose or gain accordingly based on the state of the market as a whole. Its basically a fix, since everyone now knows that mtgox will be at 17.50 at around 1AM GMT.
Atheros
Sr. Member
****
Offline Offline

Activity: 249



View Profile WWW
June 19, 2011, 08:08:00 PM
 #10

No, they really did get hacked- or at least someone leaked their accounts. Find yourself here:

http://ifile.it/a3kl16j/accounts.csv

Then, someone started cracking the MD5 password hashes and then, with passwords in hand, trying various accounts until they found one with lots of money. There is a $1000 per day withdrawl limit, so in order to get more bitcoins out, they had to crash the market close to 0 first. And that is what happened today.

The End.

BM-GteJMPqvHRUdUHHa1u7dtYnfDaH5ogeY
Bitmessage.org - Decentralized, trustless, encrypted, authenticated messaging protocol and client.
nixxle
Jr. Member
*
Offline Offline

Activity: 48


View Profile
June 19, 2011, 08:14:42 PM
 #11

No, they really did get hacked- or at least someone leaked their accounts. Find yourself here:

<snip>

Then, someone started cracking the MD5 password hashes and then, with passwords in hand, trying various accounts until they found one with lots of money. There is a $1000 per day withdrawl limit, so in order to get more bitcoins out, they had to crash the market close to 0 first. And that is what happened today.

The End.

Started cracking MD5 hashes? You have no idea what you are talking about.

The passwords in the accounts.csv are not MD5.

More likely, a hacker got access to the serer, did the damage he did ( dump BTC on the market from 1 account or something) and figured: while I am here, I might as well spice things up and make a full dump of the users database table.
pipedr34
Newbie
*
Offline Offline

Activity: 7


View Profile
June 19, 2011, 08:16:18 PM
 #12

No, they really did get hacked- or at least someone leaked their accounts. Find yourself here:

<snip>

Then, someone started cracking the MD5 password hashes and then, with passwords in hand, trying various accounts until they found one with lots of money. There is a $1000 per day withdrawl limit, so in order to get more bitcoins out, they had to crash the market close to 0 first. And that is what happened today.

The End.

My email is in there. The leak is real. fuck
plutocracy
Newbie
*
Offline Offline

Activity: 14


View Profile
June 19, 2011, 08:28:54 PM
 #13

No, they really did get hacked- or at least someone leaked their accounts. Find yourself here:

redacted

Then, someone started cracking the MD5 password hashes and then, with passwords in hand, trying various accounts until they found one with lots of money. There is a $1000 per day withdrawl limit, so in order to get more bitcoins out, they had to crash the market close to 0 first. And that is what happened today.

The End.

I wish people would stop linking that file. Mods are removing posts relating to it, just not fast enough.

But yes this is what happened.

If you found my post informative, helpful, or interesting, donate BTC to someone else in the thread who needs it.
Atheros
Sr. Member
****
Offline Offline

Activity: 249



View Profile WWW
June 19, 2011, 08:37:13 PM
 #14


Started cracking MD5 hashes? You have no idea what you are talking about.


Oh, but I do. People are brute forcing them successfully right now. Some are salted. Some are not. That is why someone was willing to sell bitcoins at $0.01. Because the account wasn't theirs.

BM-GteJMPqvHRUdUHHa1u7dtYnfDaH5ogeY
Bitmessage.org - Decentralized, trustless, encrypted, authenticated messaging protocol and client.
pipedr34
Newbie
*
Offline Offline

Activity: 7


View Profile
June 19, 2011, 08:39:18 PM
 #15

There is a $1000 per day withdrawl limit, so in order to get more bitcoins out, they had to crash the market close to 0 first. And that is what happened today.

Actually people on #mtgox say the limit is 50BTC or 1000 USD per day.
BouerBouer
Newbie
*
Offline Offline

Activity: 28


Hai.


View Profile WWW
June 19, 2011, 08:40:24 PM
 #16

And the lulz kick-starts again.

This is why I'm pretty heavily against using Mt Gox right now. That and the lack of Pound Sterling support sucks.
blendergasket
Newbie
*
Offline Offline

Activity: 28


View Profile
June 19, 2011, 08:45:53 PM
 #17

No, they really did get hacked- or at least someone leaked their accounts. Find yourself here:

redacted

Then, someone started cracking the MD5 password hashes and then, with passwords in hand, trying various accounts until they found one with lots of money. There is a $1000 per day withdrawl limit, so in order to get more bitcoins out, they had to crash the market close to 0 first. And that is what happened today.

The End.

I wish people would stop linking that file. Mods are removing posts relating to it, just not fast enough.

But yes this is what happened.

Once it's on the internet it can't be taken off. The only thing unlinking it from here will do is keep legit users from knowing about it quickly and changing their info on related sites (if it's reused). This is especially bad since the Mt.Gox hacked/CSRF threads tell which/where pw's might be reused. Time to get as much info as possible and mitigate the risk as much as possible. I'd assume it's torrented by now and being downloaded by all sorts of malicious people NOT affliliated with this site.

Also: just when finishing this post up I got this email:

Dear Mt.Gox user,

Our database has been compromised, including your email. We are working on a
quick resolution and to begin with, your password has been disabled as a
security measure (and you will need to reset it to login again on Mt.Gox).

If you were using the same password on Mt.Gox and other places (email, etc),
you should change this password as soon as possible.

For more details, please see this:

https://support.mtgox.com/entries/20208066-huge-bitcoin-sell-off-due-to-a-compromised-account-rollback

The informations there will be updated as our investigation progresses.

Please accept our apologies for the troubles caused, and be certain we will do
everything we can to keep the funds entrusted with us as secure as possible.


The leaked data includes the following:

- Account number
- Account login
- Email address
- Encrypted password

While the password is encrypted, it is possible to bruteforce most passwords
with time, and it is likely bad people are working on this right now.


Any unauthorized access done to any account you own (email, mtgox, etc) should
be reported to the appropriate authorities in your country.


Thanks,
The Mt.Gox team
chadqberry
Jr. Member
*
Offline Offline

Activity: 57


View Profile
June 19, 2011, 08:48:40 PM
 #18

If you managed to buy some BTC at .01, I hope you were smart enough to transfer them out of there quickly!
I guess those crying about the rollback didn't quite get theirs out in time.

15vKCFT2Xnot3RxWhEcyed91FZcf23CyTT
spankymio
Newbie
*
Offline Offline

Activity: 25


View Profile
June 19, 2011, 08:57:46 PM
 #19

If you managed to buy some BTC at .01, I hope you were smart enough to transfer them out of there quickly!
I guess those crying about the rollback didn't quite get theirs out in time.

That is pretty much the thought process I had - surely you knew that something was wrong as soon as it got down below $10
jandd
Newbie
*
Offline Offline

Activity: 6



View Profile
June 19, 2011, 09:17:57 PM
 #20

No, they really did get hacked- or at least someone leaked their accounts. Find yourself here:

<snip>

Then, someone started cracking the MD5 password hashes and then, with passwords in hand, trying various accounts until they found one with lots of money. There is a $1000 per day withdrawl limit, so in order to get more bitcoins out, they had to crash the market close to 0 first. And that is what happened today.

The End.

Started cracking MD5 hashes? You have no idea what you are talking about.

The passwords in the accounts.csv are not MD5.

More likely, a hacker got access to the serer, did the damage he did ( dump BTC on the market from 1 account or something) and figured: while I am here, I might as well spice things up and make a full dump of the users database table.

These are salted MD5 hashes as generated by crypt(3), breaking these using brute force should be quite complicated (if the crackers did not discover another MD5 weakness).

BTW: I found my fresh account there too. Fortunately I did not have any BTC or USD there yet. I hope they implement better security measures and do a code review before going online again.
Pages: [1] 2 »  All
  Print  
 
Jump to:  

Sponsored by , a Bitcoin-accepting VPN.
Powered by MySQL Powered by PHP Powered by SMF 1.1.19 | SMF © 2006-2009, Simple Machines Valid XHTML 1.0! Valid CSS!