BIPS Wallet security breach

[BrianM]

The whole thing is too suspicious, too suspicious.
Kris has spend his time running around and tolled the media that its is not his fault and the wallets security is the users responsibility.

The worse thing is that he is getting away this scam.
No action has been taking since 22 Nov.
We are talking about 1295 BTC!!!
Why is there no details published of any kind?

I say he is a liar and a crock!

[1714784289]

1714784289

[1714784289]

1714784289

[PenAndPaper]

Wth? Are there some kind of online wallet fanboys around? I mean i can understand fanboys of artists or athletes but bips fanboys? For real?

[nullfrog]

do you have personal vendetta with Kris or what?
If you were that close with Kris that you knew so much of Bips operational,
and you knew there was weakness with Bips security config as you mentioned,
why didn't you do something before?
or you could have place your btc somewhere else instead of keeping it there??

stop embarrassing yourself mate

This person must be either Kris or someone related to him. Awfully suspicious when there's new accounts exclusively defending BIPS in this thread.

When you build a business around keeping money safe, there's no room for error. The absolute worst way you could ever screw over your users is by compromising their wallets.

If you manage the lose a million dollars of someone else's money, you can't expect there would be no consequences. Of course people are going to be extremely upset.

It's becoming pretty obvious all the money is gone and BIPS is an absolutely awful company nobody should ever trust, but the only way Kris could safe his face is to step forward and address the situation.

If he decides to remain silent and act like nothing happened, people are going to make it personal. There's no way around it.

[allincoin]

As promised I'd update when I heard back from BIPS,  I recieved an email today from Kris.  I added a bitcoin address to my account as requested.

.... text removed per request...

Only thing I have heard from Kris was a PM asking me to remove info provided in a ticket sent to me..



Please be so kind as to remove the ticket text I wrote to you from public domain.

"Hi,

1) If ...........

There is a reason this is written below.

*************
This email is intended only for the person to whom it is addressed and may contain information that is privileged and exempt from disclosure. Please be aware that forwarding or distributing it is strictly prohibited.

[nahtnam]

Whats the difference between bips and coinbase?

[assortmentofsorts]

Kris was interviewed to a danish news site eailer today:
http://translate.google.com/translate?sl=da&tl=en&js=n&prev=_t&hl=en&ie=UTF-8&u=http%3A%2F%2Fwww.version2.dk%2Fartikel%2Fny-forklaring-om-det-store-danske-bitcoin-roeveri-ddos-angreb-var-kun-et-roegsloer-55179&act=url

A short summary:
- The DDoS not the actually attack. Just a way to remove the focus from the sys admins so they could get through another security hole.

Its BS. Kris was the only guy working on BIPS. Lemme share with you guys a bug I helped fix. The secret that you entered in your IPN page was generating wrong hashes for any word that was 8-16 characters in length (weird?). I had to literally beg Kris to understand that this is a serious bug and had to write various test cases to demonstrate it. When he realized that there was indeed a bug he chose to just publish a "Enter less than 8 characters and greater than 16 characters" or something like that instead of actually fixing it. When I questioned him, he told me that he wrote his own crypto lib functions. Which fool would try to rewrite crypto when there are so many well tested modules available? This kind of shit brings in all the security loop-holes.

- There was a bug with the way their algorithm works with hot and cold wallets. ALL bitcoins were in the hot wallet and because of this they were easier to access by hackes.

Tell the world the technical details of the bug. I bet Kris hasn't fixed it yet. If he couldn't find time to fix that buggy PHP hashing module I bet he is still using that same shitty hand written module (or many more like that) for everything inside BIPS.

- All funds are lost for the users. According to Kris he/BIPS are not responsible due to their TOS.

BS here as well. I can write whatever I like in my TOS. But when it comes to the courts the TOS is as good as shit. You need to make sure your TOS doesn't violate the law first. The very fact that he is saying that he isn't responsible for the funds lost is itself BS. I'll see you in court Kris... the deadline of 72 hours is ending soon.

- Kris advice people NOT to use hot wallets anymore - only with very low amounts of Bitcoins.

Thanks for the advice Saint Kris.

- Kris tells BIPS will continue as a payment provider - but have closed down there wallets for good.

I'll make sure you do not.

I think thats a pretty good summary of the article. Otherwise - try the above google translation

Thanks

do you have personal vendetta with Kris or what?
If you were that close with Kris that you knew so much of Bips operational,
and you knew there was weakness with Bips security config as you mentioned,
why didn't you do something before?
or you could have place your btc somewhere else instead of keeping it there??

stop embarrassing yourself mate

Stop using your shill accounts Kris. We know its you. Come out in the open about the hack and save yourself some embarrassment.

[assortmentofsorts]

The whole thing is too suspicious, too suspicious.
Kris has spend his time running around and tolled the media that its is not his fault and the wallets security is the users responsibility.

The worse thing is that he is getting away this scam.
No action has been taking since 22 Nov.
We are talking about 1295 BTC!!!
Why is there no details published of any kind?

I say he is a liar and a crock!

No he isn't getting away. I'm already in touch with my lawyer. I'm going to drag this fool to the court. We are mapping out a plan to tackle this as its outside of my country. Anyone else planning to sue him?

[niothor]

Whats the difference between bips and coinbase?

Coinbase hasn't been "hacked" yet.

[PenAndPaper]

Whats the difference between bips and coinbase?

Coinbase is not only an online wallet. You can link your bank account with them and buy and sell bitcoins also.
Although when the price is on an uptrend you may experience some surprises when trying to buy coins 

[dantes]

The whole thing is too suspicious, too suspicious.
Kris has spend his time running around and tolled the media that its is not his fault and the wallets security is the users responsibility.

The worse thing is that he is getting away this scam.
No action has been taking since 22 Nov.
We are talking about 1295 BTC!!!
Why is there no details published of any kind?

I say he is a liar and a crock!

No he isn't getting away. I'm already in touch with my lawyer. I'm going to drag this fool to the court. We are mapping out a plan to tackle this as its outside of my country. Anyone else planning to sue him?

I might join if I knew where to start - that is why I wanted Kris' physical address - so we could serve notice on him... on the face of it it appears that the coins were just outright nicked... I guess he saw the price rise and couldn't resist it

[dark_kn1ght]

do you have personal vendetta with Kris or what?
If you were that close with Kris that you knew so much of Bips operational,
and you knew there was weakness with Bips security config as you mentioned,
why didn't you do something before?
or you could have place your btc somewhere else instead of keeping it there??

stop embarrassing yourself mate

This person must be either Kris or someone related to him. Awfully suspicious when there's new accounts exclusively defending BIPS in this thread.

When you build a business around keeping money safe, there's no room for error. The absolute worst way you could ever screw over your users is by compromising their wallets.

If you manage the lose a million dollars of someone else's money, you can't expect there would be no consequences. Of course people are going to be extremely upset.

It's becoming pretty obvious all the money is gone and BIPS is an absolutely awful company nobody should ever trust, but the only way Kris could safe his face is to step forward and address the situation.

If he decides to remain silent and act like nothing happened, people are going to make it personal. There's no way around it.

me = kris?
nope

related to him?
well i knew him for a while, chat many times with him but those never last over 2 minutes (strictly business talk)

and you saying my posts here looks like "exclusively defending Bips"?
oh man, if i really intend to do so - none of you would stand a chance... please trust me on this

upset/ extremely upset/ mad - do whatever you feels right to do mate...
you have all the rights to express anything you like about Bips just as much as i do to express mine

[nahtnam]

Whats the difference between bips and coinbase?

Coinbase is not only an online wallet. You can link your bank account with them and buy and sell bitcoins also.
Although when the price is on an uptrend you may experience some surprises when trying to buy coins 

So why choose bips over coinbase? Coinbase even has insurance so "hacked" accounts will get all the btc their lost btc back.

[assortmentofsorts]

do you have personal vendetta with Kris or what?
If you were that close with Kris that you knew so much of Bips operational,
and you knew there was weakness with Bips security config as you mentioned,
why didn't you do something before?
or you could have place your btc somewhere else instead of keeping it there??

stop embarrassing yourself mate

This person must be either Kris or someone related to him. Awfully suspicious when there's new accounts exclusively defending BIPS in this thread.

When you build a business around keeping money safe, there's no room for error. The absolute worst way you could ever screw over your users is by compromising their wallets.

If you manage the lose a million dollars of someone else's money, you can't expect there would be no consequences. Of course people are going to be extremely upset.

It's becoming pretty obvious all the money is gone and BIPS is an absolutely awful company nobody should ever trust, but the only way Kris could safe his face is to step forward and address the situation.

If he decides to remain silent and act like nothing happened, people are going to make it personal. There's no way around it.

me = kris?
nope

related to him?
well i knew him for a while, chat many times with him but those never last over 2 minutes (strictly business talk)

and you saying my posts here looks like "exclusively defending Bips"?
oh man, if i really intend to do so - none of you would stand a chance... please trust me on this

upset/ extremely upset/ mad - do whatever you feels right to do mate...
you have all the rights to express anything you like about Bips just as much as i do to express mine

Ok Kris thanks for the lecture.

EDIT: Read between the lines.

[assortmentofsorts]

Just an alert. Kris Henriksen's account (https://bitcointalk.org/index.php?action=profile;u=11921) has not been active since December 1st 2013. So has he finally decided to run now that some of us are pursuing legal remedies? Anyone communicated with him last can share their details here if they wish. Many are contacting me with his personal details (including account numbers, addresses etc). So Kris if you are reading this through your shill accounts know that you can run but cannot hide.

[assortmentofsorts]

http://www.version2.dk/artikel/ny-forklaring-om-det-store-danske-bitcoin-roeveri-ddos-angreb-var-kun-et-roegsloer-55179

"It was wrong announced. After the first DDoS attacks were hackers inside and found a hole and then deleted the total and masked what they had done afterwards with the large DDoS attacks which struck the connection to the SAN and got the servers to crash , "says Kris Henriksen to Version2.

"The service was divided into 'cold wallet' where customers Bitcoins was locked down, and a 'hot wallet' where they were offloaded when there had to be moved around on them. But because of an error in the algorithm, the entire portfolio of Bitcoins ended up standing in 'hot wallet' department."


"With the success we've had with all the people have bought and sold, the algorithm moved it all over in hot wallet. It took hackers saw a hole that they could exploit, "said Kris Henriksen.

This version of the story was told only to Version2 and no press release that said that the previous press release by BIPS was the incorrect version.

Now BIPS has released a press release today: https://bips.me/press which still does not contain the version told to Version2.

Be careful when you get a mail or anything asking you to give consent by BIPS. According to my lawyer it might be a sly attempt at getting consent to "yes the coins have not been stolen by BIPS". Does anyone (from Denmark) have any contacts at Danish National IT Forensic Police department? Can someone check if a case is registered with them and whether they really are assisting BIPS?

EDIT: What kind of shitty code had Kris written that moved all coins from 'cold wallet' to the hot wallet? So that means people who paid for the cold storage were being fleeced extra bitcoins for something that wasn't even secure. Great!

[assortmentofsorts]

FROM KRIS:

I do not participate in dialogue on any forums at this time. However, I keep an eye on what people are writing and collecting this data for future review. And from what I can read, you are way over the line with accusations, and I would advise you to stop immediately. Not only are you making it harder for me to attend to the issues at hand, but more so you have engaged in slander, defamation and worse.

We have now closed your account at BIPS as per binding Legal Agreements.

--- Terms of Service
BIPS reserves the right to unilaterally terminate your use of the Service, either temporarily or permanently in the event of : unacceptable user behavior, attempted abuse of others 'accounts, attempts to gain access to others' data or any other reason BIPS deems necessary.
--

-- Privacy Policy
In cases of slander, defamation or fraud, BIPS may at its own discretion disclose general account information to affected parties.
--

Okay Kris, now you have made it hard on yourself. I'm going to go public with all your details, including the scams you are associated with today. This kind of attitude will eventually bring yours and BIPS downfall.

I have asked Kris numerous times to refund my coins without resorting to slander. Not once in his communications did he mention that he won't be refunding or even gave me any hope of a refund. All he did was employ usual tactics of delaying communicating the obvious truth with a hope that with time customers will forget about this theft and move on (like we have done for so many other previous hacks).

I'll also disclose all private messages, mails that we sent to each other back and forth and also anything that I find suspicious about your dealings with BIPS and its users publicly.

I'm already in touch with my lawyer (like I said in my previous posts) and be rest assured that I'll be dragging your ass to court. You have been given too much time by all the customers with absolutely zero information on your end about the hack (absolutely zero transparency). I don't give a damn about you closing my account as I'm not going to gun for those 3.3BTC anymore (the time for refunding has expired long ago). And whats the use of a account where I can neither deposit nor withdraw BTC? You closing my account is a joke and a futile attempt at replying to my accusations.

I'll make sure you land behind bars for betraying the trust your customers hold in you. And now that you have said publicly that you won't be refunding your customers (from your Press Release and Version2 interview) I appeal to all the BIPS customers to send me a PM with your BIPS username and the BTC amount you had stored with them. I'm going to make a list of all the people who have been scammed by BIPS and will be forwarding it to my lawyer. If you guys want to help me in fighting the case I would appreciate it if you can give me any details you can (including PM's between you and Kris, any emails exchanged etc or even getting information from concerned authorities in Denmark). I don't want help in any other way (including donations) as I'll fight this case with the money out of my own pocket. I hate it when people betray my trust and take me for granted.

Also this piece of information from BIPS press release is really interesting:

Please bear in mind that the wallet service was a free service and thus there has been 0 revenue generated from it. Hence BIPS is unable to reimburse bitcoins lost unless the stolen coins are retrieved.

ROFL! So that means anyone operating a free service with 0 revenue generated from it are not liable to loss/theft of customer data (in this case bitcoins). This is a new legal definition coined by BIPS. Similar to Trendon Shavers claiming "Bitcoin isn't real money"... for which SEC showed him the middle finger. I can't wait for Denmark courts to do the same to Kris Henriksen.

[dantes]

In case you haven't seen it.  It is better than radio silence at least. 

"Wallet Status Update

We sincerely apologise for the limited information that has been available up to now, but we have not had and are still short of facts to be able to make sufficient thorough official statements.

Most of what was recoverable from our servers and backups has now been restored and we are currently working on retrieving more information to get a better understanding of what exactly happened, and most of all what can be done to track down who did it.

1295 bitcoins in total were sent to an external wallet by the attackers.
https://blockchain.info/address/1LuG91tcSQxKj32BsCoRkX7yQLfj9LtkCs
Those bitcoins are not retrievable unless we can find the perpetrators and somehow make a demand they return the coins.
The Danish National IT Forensic Police department have agreed to assist us examining what data there is.

It appears that in order to file a police report for theft, we may need consent from all affected parties to lodge, as according to the police they can not classify this as a theft due to the current non regulation of bitcoin. We are currently looking in to details surrounding this further, awaiting a response from our lawyers and the police department.

Will there be any reimbursement available?
Please bear in mind that the wallet service was a free service and thus there has been 0 revenue generated from it. Hence BIPS is unable to reimburse bitcoins lost unless the stolen coins are retrieved.
We are discussing the possibility of a compensation plan with our legal advisors, but are unable to comment further on this for now.

Practical information:

There are a few account holders who have a small balance of bitcoins in their wallets after the attack. Some have also had payments sent to their BIPS wallet bitcoin addresses and we recovered these on November 19th sending them to an external wallet for safety reasons. These coins will naturally be available for withdrawal by the respective owners. Any bitcoins sent to old addresses after November 19th will also be available to withdraw by those they belong to.

Some merchants have accumulated sales that have been converted to Fiat over time, but not yet reached their minimum payouts. Their balances will also be available in their chosen currency with an option to have them paid out immediately or paid manually together with their new accumulated balance.

For all of the above instances, we are currently working on setting up a clone containing old wallet info and transactions, please grant us patience ..

Notice:

Our mailing system was wiped out during the attack and is still not restored. That means that if we send out mass emails, a large number of these will never reach their destination or end up in Spam folders (some email providers will even auto delete them).

Please check the news section of our helpdesk for more updates and information regularly in case you are amongst the ones who are not receiving our emails."

I suggested to Kris that we have a Skype conference call with him where we can find out what happened and discuss way forward.  This seems a way forward if BIPS wants to reach an agreed, amicable solution.

[philipma1957]

 Well I was in the newer we saved your coin status and was told   I may see my .39 btc.  Time will tell.


BTW 1200 plus coins were stolen at the 500 usd level so about 600,000 was stolen  it is now more like  1.3 million.

[sjoland]

I might join if I knew where to start - that is why I wanted Kris' physical address - so we could serve notice on him... on the face of it it appears that the coins were just outright nicked... I guess he saw the price rise and couldn't resist it

Yes, count me in too. The last days development gives me a gut feeling that Kris has some part in the scam, or is completely incompetent as a CEO. Either way his current operations should be shut down by legal or social means. BIPS lost it's reason to exist in the Bitcoin community by how this mess is handled.

BTW I live and run a brand consultancy firm in southern Sweden (only 10 min from Denmark), so I ofcourse can represent a legal case localy, but more important, I know very well how to kill a brand. Lets just say; storytelling works both ways...

[BrianM]

Hi is a crock  

And he bought himself enough time to getaway.