Bitcoin Forum
November 17, 2018, 01:18:57 AM *
News: Latest Bitcoin Core release: 0.17.0 [Torrent].
 
   Home   Help Search Login Register More  

Warning: Moderators do not remove likely scams. You must use your own brain: caveat emptor. Watch out for Ponzi schemes. Do not invest more than you can afford to lose.

Pages: [1]
  Print  
Author Topic: [Cross post] BitFunder.com has been hacked and IT IS BitFunder's fault  (Read 2776 times)
HorseRider
Donator
Legendary
*
Offline Offline

Activity: 1369
Merit: 1001


View Profile
July 06, 2013, 06:47:57 AM
 #1

This post is a cross post. 2 BITFUNER users was victims of a hacker named "htemp" at the same time, please see the story and discussion it here:


https://bitcointalk.org/index.php?topic=251051.0

16SvwJtQET7mkHZFFbJpgPaDA1Pxtmbm5P
1542417537
Hero Member
*
Offline Offline

Posts: 1542417537

View Profile Personal Message (Offline)

Ignore
1542417537
Reply with quote  #2

1542417537
Report to moderator
1542417537
Hero Member
*
Offline Offline

Posts: 1542417537

View Profile Personal Message (Offline)

Ignore
1542417537
Reply with quote  #2

1542417537
Report to moderator
Advertised sites are not endorsed by the Bitcoin Forum. They may be unsafe, untrustworthy, or illegal in your jurisdiction. Advertise here.
1542417537
Hero Member
*
Offline Offline

Posts: 1542417537

View Profile Personal Message (Offline)

Ignore
1542417537
Reply with quote  #2

1542417537
Report to moderator
1542417537
Hero Member
*
Offline Offline

Posts: 1542417537

View Profile Personal Message (Offline)

Ignore
1542417537
Reply with quote  #2

1542417537
Report to moderator
1542417537
Hero Member
*
Offline Offline

Posts: 1542417537

View Profile Personal Message (Offline)

Ignore
1542417537
Reply with quote  #2

1542417537
Report to moderator
Deprived
Hero Member
*****
Offline Offline

Activity: 532
Merit: 500


View Profile
July 06, 2013, 11:45:26 AM
 #2

The flaw in question didn't require the thief to obtain the login for the victims - it just required the victims to visit other websites whilst logged into Bitfunder.  Unless the 2 raised in that thread are actually old-style key-logged password etc that just happened to occur at the same time as the flaw in Bitfunder was being abused.

There were reports of many more than 2 people affected by it.  At the time there was no way to prevent it with 2FA (2FA only applied to logging in which didn't make any difference).  The way to prevent it was not to visit any unknown links whilst logged into Bitfunder (using a different browser for Bitfunder would also prevent the easiest route for attackers but isn't necessarily totally safe) and logging out of Bitfunder before doing anything else.

The problem WAS the result of bad decisions in respect of Bitfunder's design - it accepted POST requests without verifying they originated from a session connected to Bitfunder (so the attacker only had to send the request and it would work if you were logged in - without any need for them to obtain information about your session or even know who you were).  Transfers was just the easiest way to abuse it - not the only way.  The public assets list for Bitfunder was likely very useful to attackers as well - as it allows them to transfer 1 share then work out how many you have left to know how large a transfer to clear the rest, plus also allows them to see what else you hold they can steal.
nubbins
Legendary
*
Offline Offline

Activity: 1386
Merit: 1000



View Profile
July 06, 2013, 12:42:40 PM
 #3

Incredibly shocking. BitFunder gets an F for security.

IF you've got money in there, get it out NOW... if this is possible, who knows what other huge, gaping security holes there are.

No longer buying/selling Casascius coins. Beware scammers.
My OTC Web of Trust ratings / What's a PGP chain of custody?
TradeFortress
rollercoaster
VIP
Legendary
*
Offline Offline

Activity: 1050
Merit: 1023


View Profile
July 06, 2013, 12:43:05 PM
 #4

The same vulnerability still works, just in a slightly different format, FYI.

nubbins
Legendary
*
Offline Offline

Activity: 1386
Merit: 1000



View Profile
July 06, 2013, 12:50:25 PM
 #5

The same vulnerability still works, just in a slightly different format, FYI.

 Roll Eyes

You'd think that if you were creating an exchange, you'd hire someone who knows basic web security principles. This is a step above SQL injection... not very advanced stuff.

No longer buying/selling Casascius coins. Beware scammers.
My OTC Web of Trust ratings / What's a PGP chain of custody?
TradeFortress
rollercoaster
VIP
Legendary
*
Offline Offline

Activity: 1050
Merit: 1023


View Profile
July 06, 2013, 12:51:19 PM
 #6

The same vulnerability still works, just in a slightly different format, FYI.

 Roll Eyes

You'd think that if you were creating an exchange, you'd hire someone who knows basic web security principles. This is a step above SQL injection... not very advanced stuff.
Other exchanges were not better. I won't say more.

I was pretty much shocked at the amount of attention paid to security for bitcoin web services. Originally I thought MPEx were absolutely crazy, but now that's actually a pretty good method if you expect your users to jump through the hoops.

nubbins
Legendary
*
Offline Offline

Activity: 1386
Merit: 1000



View Profile
July 06, 2013, 01:24:06 PM
 #7

Other exchanges were are not better. I won't say more.

Uh, brb.

No longer buying/selling Casascius coins. Beware scammers.
My OTC Web of Trust ratings / What's a PGP chain of custody?
Ukyo
Sr. Member
****
Offline Offline

Activity: 448
Merit: 250



View Profile
July 06, 2013, 07:33:01 PM
 #8

The same vulnerability still works, just in a slightly different format, FYI.

 Roll Eyes

You'd think that if you were creating an exchange, you'd hire someone who knows basic web security principles. This is a step above SQL injection... not very advanced stuff.

This was why transfers require 2-factor as of weeks ago. A cross site post could not magically come up with a 2-factor code.

As well as putting some per-page protections in place, and doing some additional checks, you will soon see 2-factor as an option for most other requests.

As it stands, BitFunder itself is not "hacked".

Quote
it accepted POST requests without verifying they originated from a session connected to Bitfunder
The system does indeed check for sessions. The user must have had a recent and still active session.

-Ukyo
Lohoris
Hero Member
*****
Offline Offline

Activity: 616
Merit: 500


Bitgoblin


View Profile
July 06, 2013, 07:37:57 PM
 #9

Oh, god, this is so noobish I'll just delete my account... but there's no delete button. Nor any contact info.
Well, I've never used it anyway, I'll just delete the bookmark...

1LohorisJie8bGGG7X4dCS9MAVsTEbzrhu
DefaultTrust is very BAD.
Ukyo
Sr. Member
****
Offline Offline

Activity: 448
Merit: 250



View Profile
July 06, 2013, 08:48:21 PM
 #10

Quote
it accepted POST requests without verifying they originated from a session connected to Bitfunder
The system does indeed check for sessions. The user must have had a recent and still active session.

-Ukyo

Two different things.

It DID check that there was an active session (NOT what I said).
It did NOT check that the request originated from that session (what I DID say).

As long as the user is logged in, the session is active. Cross-browser or not, it IS being submitted by the active session as the session details are provided.
As you state, it made sure there was an Active session, and it does indeed verify that active session is the one making the POST. What it does not check is if it was a cross site script using that session that was left open by the user, a trojen that runs in the background with hidden browser being used load pages, get proper per-page security tokens, and make requests, etc.

Once the desktop is hacked there are limitations to what can be done. It is not hard to use a background trojan to intercept 2-factor keys either at setup times. This can effect any site.
I have seen many "bot" trojans for games etc that pretend to be the end user and will use active logged in sessions to browse, load pages, even play games for them.

Even banks (I use citibank) now even require you, once logged in, to submit additional security question answers to be able to do most things for this reason.
I am working to add a new level of security that while it may be a bit controversial, will be fully optional, but give one of the most secure methods of protection.

Keep in mind, generating a code per page might stop a cross-browser attack, effectively becoming a per-page 2-factor, but it wont stop infections from generating on and using it.

With this said, you will also see per-page key generation within a few days that all submits will be required to adhere to. Triple checking the functionality on all posts and making sure no other problems are created, and it works exactly as intended are the current main focus right now.

On a side note, I can say that many users (less than 25 users) who were hit with transfers, had one time no-bad-password logins from different ips, who did transfers. We have seen a large user/email/pass list attempt on both bitfunder and weexchange from a botnet which we put some protections in place from. Ultimately, all we can do is try to recognize and ban/block those ips, as well as slow them down, and inform any recognized accounts that they are in danger. We had seen thousands of login attempts that mostly did not work, for accounts that never existed on either site.

-Ukyo
Deprived
Hero Member
*****
Offline Offline

Activity: 532
Merit: 500


View Profile
July 06, 2013, 08:55:57 PM
 #11

Once the desktop is hacked there are limitations to what can be done. It is not hard to use a background trojan to intercept 2-factor keys either at setup times. This can effect any site.

I actually deleted my post before you replied to it - as I didn't want to get into arguing details of the difference between referring to an active session and being made by an active session.

On the quoted part, this is one reason I far prefer Yubikey to Google Authenticator.  There's nothing a trojan can log that allows them to duplicate output from a Yubikey - and no way to force one that's plugged in to generate a code even with full desktop control.  Other reason I prefer Yubikey is it's far faster just to touch it to generate a code than to take my smartphone out of standby (which needs a password as the memory is encrypted), lookup and then type a Google 2FA code.

Downside of Yubikey is you can't use it on smartphones - so users have to turn it off if they plan to access the site via mobile.
Ukyo
Sr. Member
****
Offline Offline

Activity: 448
Merit: 250



View Profile
July 06, 2013, 09:06:52 PM
 #12

Agreed. I do like Yubikey, and have been talking to them about mobile options as well! Smiley
furuknap
Sr. Member
****
Offline Offline

Activity: 294
Merit: 250

http://coin.furuknap.net/


View Profile WWW
July 07, 2013, 04:41:45 PM
 #13

Ukyo, are you starting to see my point yet?

I warned you about this over a month ago, yet you failed to get back to me. I posted my concerns then, and hate to pull the 'I told you so' card, but really, I told you so.

This incident combined with the other general concerns I've voiced have now firmly convinced me to never set foot in BitFunder. You need to rethink the entire exchange and get someone with the experience required to help you build the code. You need to kill off that wee exchange idea as it's just a silly distraction for both users and you, that adds about as much security as a paper wrapping on a gold bar.

.b

Pages: [1]
  Print  
 
Jump to:  

Sponsored by , a Bitcoin-accepting VPN.
Powered by MySQL Powered by PHP Powered by SMF 1.1.19 | SMF © 2006-2009, Simple Machines Valid XHTML 1.0! Valid CSS!