mjoz (OP)
Member
![*](https://bitcointalk.org/Themes/custom1/images/star.gif)
Offline
Activity: 61
Merit: 10
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
June 19, 2011, 11:49:21 PM |
|
Rumor mill says it was an SQL injection attack that allowed the hacker to steal the user database. Protecting against an SQL injection attack on a website is fairly trivial which makes me doubt the ability and "security sense" of whomever developed that site.
To my knowledge they have not said if the database compromise lead to the hacked account. It seems very likely though, with access to the password hash weak passwords can be easily dictionary/bruteforced. Why anyone with 500k bitcoins would have a weak password leaves me guessing though. This is a lesson everyone can learn from though, if your password is not long, random, and mixed with letters, symbols and numbers you're at risk.
What is even more scary is it appears that the e-mail accounts on the list are now being attacked. If someone compromises your e-mail box your generally screwed as they can then reset passwords other websites with lax security like MTGOX.
|
|
|
|
hiipii
Newbie
Offline
Activity: 9
Merit: 0
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
June 20, 2011, 12:17:35 AM |
|
It really is aggrivating seeing such a security sensitive sight being comprimised with an sql injection. This stuff was covered when I took an introductory web class.
|
|
|
|
fascistmuffin
Newbie
Offline
Activity: 56
Merit: 0
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
June 20, 2011, 12:21:54 AM |
|
"' RIGHT JOIN TABLE USERS; --
Dammit, didn't work.
|
|
|
|
Bittie
Newbie
Offline
Activity: 4
Merit: 0
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
June 20, 2011, 12:55:53 AM |
|
I used a windows install to see what infections I could pick up. Registered with bit faucet. 1/2hr later attacks from various IP's mainly 91.213.175.240 + 8.15.246.44
|
|
|
|
mmavipc
Member
![*](https://bitcointalk.org/Themes/custom1/images/star.gif)
Offline
Activity: 98
Merit: 10
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
June 20, 2011, 01:07:06 AM |
|
I used a windows install to see what infections I could pick up. Registered with bit faucet. 1/2hr later attacks from various IP's mainly 91.213.175.240 + 8.15.246.44
are you talking about this http://freebitcoins.appspot.com/recent_sends ?
|
|
|
|
agedet
Newbie
Offline
Activity: 2
Merit: 0
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
June 20, 2011, 01:08:58 AM |
|
MtGox sucks, gonna see if Tradehill is any better. Used code TH-R15720 when signing up to get reduced fees.
|
|
|
|
Bittie
Newbie
Offline
Activity: 4
Merit: 0
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
June 20, 2011, 01:16:14 AM |
|
I used a windows install to see what infections I could pick up. Registered with bit faucet. 1/2hr later attacks from various IP's mainly 91.213.175.240 + 8.15.246.44
are you talking about this http://freebitcoins.appspot.com/recent_sends ? Yes.. See how they list all the IP's? Perfect for port attacks + sniffing as you know the IP will have a coin client + wallet.. ![Shocked](https://bitcointalk.org/Smileys/default/shocked.gif)
|
|
|
|
rcsheets
Newbie
Offline
Activity: 9
Merit: 0
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
June 20, 2011, 02:37:48 AM |
|
In their defense, they didn't start up with a million dollar budget and man years of development time. It was a hobby project that got out of hand quickly. You don't need a million dollars to store passwords properly. See http://codahale.com/how-to-safely-store-a-password/ for example. The software libraries for doing this correctly are free.
|
|
|
|
|
TerraHertz
Newbie
Offline
Activity: 16
Merit: 0
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
June 21, 2011, 11:03:08 AM |
|
Bitcoin. Bringing hackers, naive users and serious money together, since 2011
What could possibly go wrong?
|
|
|
|
Sannyasi
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
June 21, 2011, 11:14:36 AM |
|
ignorance......
yay i have another post to get out of the newb section.... then i can waste my time on topics that i give a shit about
LET THE TROLLS FEED ON EACH OTHER!
|
|
|
|
|