Bitcoin Forum
December 05, 2016, 02:47:50 AM *
News: Latest stable version of Bitcoin Core: 0.13.1  [Torrent].
 
   Home   Help Search Donate Login Register  
Pages: « 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 [34] 35 36 37 38 39 40 41 »
  Print  
Author Topic: Bitcoinica MtGox account compromised  (Read 145723 times)
kiba
Legendary
*
Offline Offline

Activity: 980


View Profile
July 23, 2012, 11:10:29 PM
 #661

Or it would be a perfect way to make everyone believe one is innocent precisely because one showed good intention to pay back funds.

That's the "THAT WHAT THEY WANT YOU BELIEVE" indirection and so on that is a common feature in a conspiracy theory.

Always remember that the more complex a gambit is, the more likely they will get caught.

1480906070
Hero Member
*
Offline Offline

Posts: 1480906070

View Profile Personal Message (Offline)

Ignore
1480906070
Reply with quote  #2

1480906070
Report to moderator
1480906070
Hero Member
*
Offline Offline

Posts: 1480906070

View Profile Personal Message (Offline)

Ignore
1480906070
Reply with quote  #2

1480906070
Report to moderator
1480906070
Hero Member
*
Offline Offline

Posts: 1480906070

View Profile Personal Message (Offline)

Ignore
1480906070
Reply with quote  #2

1480906070
Report to moderator
Advertised sites are not endorsed by the Bitcoin Forum. They may be unsafe, untrustworthy, or illegal in your jurisdiction. Advertise here.
1480906070
Hero Member
*
Offline Offline

Posts: 1480906070

View Profile Personal Message (Offline)

Ignore
1480906070
Reply with quote  #2

1480906070
Report to moderator
1480906070
Hero Member
*
Offline Offline

Posts: 1480906070

View Profile Personal Message (Offline)

Ignore
1480906070
Reply with quote  #2

1480906070
Report to moderator
1480906070
Hero Member
*
Offline Offline

Posts: 1480906070

View Profile Personal Message (Offline)

Ignore
1480906070
Reply with quote  #2

1480906070
Report to moderator
disclaimer201
Legendary
*
Offline Offline

Activity: 1316


View Profile
July 23, 2012, 11:13:11 PM
 #662

Or it would be a perfect way to make everyone believe one is innocent precisely because one showed good intention to pay back funds.

That's the "THAT WHAT THEY WANT YOU BELIEVE" indirection and so on that is a common feature in a conspiracy theory.

Always remember that the more complex a gambit is, the more likely they will get caught.

You are right. It's too complicated. And that's why it has to be more in the direction of the second sentence above. I really can't believe all the hacker stories, sorry. Just doesn't get into my head.

kiba
Legendary
*
Offline Offline

Activity: 980


View Profile
July 23, 2012, 11:23:29 PM
 #663

You are right. It's too complicated. And that's why it has to be more in the direction of the second sentence above. I really can't believe all the hacker stories, sorry. Just doesn't get into my head.

A successful hack attempt is the simplest story and have the strongest evidence thus far. All the other hypothesis don't have much evidence and is more complicated to attempt.

LoupGaroux
Sr. Member
****
Offline Offline

Activity: 420



View Profile
July 23, 2012, 11:24:35 PM
 #664

How about a public demand for any settled assets be pooled for a proportional payment to all claimants (except Maria!)? That's what a Court would order if this does actually go into any kind of receivership, especially since certain privileged friends were paid in full while others were being lied to.

Sorry boys, but quitting does not absolve you of your liability for this criminal act- each and every one of you, Zhou, Patrick, Tihan et al. remain jointly and severally liable for the debt which you took on, especially since you chose to take it on under an apparently fraudulent basis considering your filings with the New Zealand government. Saying you got voted off the island does not remove the stain of criminal actions, and I hope each one of you is apprehended, charged and tried for the massive fraud that you have committed. Bitcoin has suffered immensely at the hands of your premeditated acts of criminal diversion of funds, and the on-going lies and misdirection that you have subjected this community to. I hope the victims are filing charges against you right now, and I look forward to hearing how your little investment group gets it's nuts torn off by the police in whatever jurisdiction you are hiding in.

Scumbags all.

54Gh/s bASIC Bitcoin Mining Devices
Pre-Order Yours Today!     
Only $1069.99 ! @ http://www.BitcoinASIC.com


Look^^ I'm selling my soul too!
kiba
Legendary
*
Offline Offline

Activity: 980


View Profile
July 23, 2012, 11:29:09 PM
 #665

Sorry boys, but quitting does not absolve you of your liability for this criminal act- each and every one of you, Zhou, Patrick, Tihan et al. remain jointly and severally liable for the debt which you took on, especially since you chose to take it on under an apparently fraudulent basis considering your filings with the New Zealand government. Saying you got voted off the island does not remove the stain of criminal actions, and I hope each one of you is apprehended, charged and tried for the massive fraud that you have committed.

That is your opinion. Care to back it up with facts?

Quote
Bitcoin has suffered immensely at the hands of your premeditated acts of criminal diversion of funds, and the on-going lies and misdirection that you have subjected this community to. I hope the victims are filing charges against you right now, and I look forward to hearing how your little investment group gets it's nuts torn off by the police in whatever jurisdiction you are hiding in.

Scumbags all.

Unless you have evidence that this a premeditated theft and knowledge there is on-going lies and misdirection by bitcoinica team members, it have no basis.

Bitcoin Oz
Hero Member
*****
Offline Offline

Activity: 700


Wat


View Profile WWW
July 23, 2012, 11:33:46 PM
 #666

This still hasnt been reported to the cops Huh?

kiba
Legendary
*
Offline Offline

Activity: 980


View Profile
July 23, 2012, 11:34:46 PM
 #667

This still hasnt been reported to the cops Huh?

MtGox filed a police report, but would not details what they know until investigation is over. Bitcoinica are probably talking to their lawyers about what they should do.

zhoutong
VIP
Hero Member
*
Offline Offline

Activity: 490


View Profile WWW
July 23, 2012, 11:35:32 PM
 #668


Sorry boys, but quitting does not absolve you of your liability for this criminal act- each and every one of you, Zhou, Patrick, Tihan et al. remain jointly and severally liable for the debt which you took on, especially since you chose to take it on under an apparently fraudulent basis considering your filings with the New Zealand government.

Please, I haven't signed anything about Bitcoinica since the end of 2011.

I have never signed on any New Zealand document.

And I have never signed any document with the name "Patrick" in it.

I quit because the pre-requesite I set has been met - Bitcoinica pays back 50% of all available funds, which is true after the Mt. Gox account hack. I'm a claimant too. Bitcoinica owes me $350 in USD account balance, and about $780 in the bills. I even have to cancel two of my credit cards because I don't have the access to the accounts that keep charging me every month.

Founder of NameTerrific (https://www.nameterrific.com/). Co-founder of CoinJar (https://coinjar.io/)

Donations for my future Bitcoin projects: 19Uk3tiD5XkBcmHyQYhJxp9QHoub7RosVb
repentance
Hero Member
*****
Offline Offline

Activity: 840


View Profile
July 23, 2012, 11:43:27 PM
 #669

How about a public demand for any settled assets be pooled for a proportional payment to all claimants (except Maria!)? That's what a Court would order if this does actually go into any kind of receivership, especially since certain privileged friends were paid in full while others were being lied to.

A court would order the Official Assignee to take control of the assets of the business and liquidate them, period.  The manner in which the liquidated assets must be distributed is laid down by law and unsecured creditors are actually at the bottom of that list.

Until otherwise established by a court ruling, Bitcoinica LP is the only entity responsible for returning user funds.  Any legal action to make people liable at an individual level hasn't yet taken place, may be quite pointless to pursue and would not necessarily succeed.

All I can say is that this is Bitcoin. I don't believe it until I see six confirmations.
kiba
Legendary
*
Offline Offline

Activity: 980


View Profile
July 23, 2012, 11:44:01 PM
 #670


Please, I haven't signed anything about Bitcoinica since the end of 2011.


The hacker is anonymous, so they're going to blame identifiable individuals, even if the evidence is sorely lacking.

Any time a hacking fiasco happens, it basically turns into a witchhunt, because people feel extremely powerless.

MrTeal
Legendary
*
Offline Offline

Activity: 1246


View Profile
July 23, 2012, 11:47:02 PM
 #671

Hi, you misunderstood me. I was talking about mtgox, not LastPass.

There would be no need to log in multiple times to MtGox. From what Genjix claimed, the thief hacked into their LastPass account, which had the new MtGox password stored within. It's the hacking into LastPass that would require guessing the password correctly within 5 attempts.
We regret to inform you that there has been another huge breach of Bitcoinica. While all passwords were changed after the theft which occurred May 11th, the password for LastPass was not compromised and thus left unchanged. The breach today occured because the password for LastPass was in fact a duplicate password which had been compromised during the hack.

Unbeknownst to us, Tihan was using the mtgox api key as the password for a website called LastPass.

LastPass contains all your passwords. The username was info@bitcoinica.com. After the initial compromise, the sourcecode would have been tainted. But the password for LastPass was not changed.
Even if it was the original hacker, according to genjix the LastPass PW was not compromised. The password was the MtGox API key and that key was stored in the source that the Rackspace hacker would have had access to, but how likely is it that if you had 5 guesses you would choose an API key buried in the source vs attempting one of the other passwords that you did compromised to see if it was a duplicate of those?
repentance
Hero Member
*****
Offline Offline

Activity: 840


View Profile
July 24, 2012, 12:00:40 AM
 #672

Even if it was the original hacker, according to genjix the LastPass PW was not compromised. The password was the MtGox API key and that key was stored in the source that the Rackspace hacker would have had access to, but how likely is it that if you had 5 guesses you would choose an API key buried in the source vs attempting one of the other passwords that you did compromised to see if it was a duplicate of those?

Which is what most people assume they did.  You get 5 attempts before it locks you out for 5 minutes and sends an email.  If the list of compromised passwords the hacker had wasn't especially long, then they didn't have a lot to lose by trying the duplicates - if one of them was right, there was every chance they'd be into the LastPass account before anyone read the email.

Quote
Any time a hacking fiasco happens, it basically turns into a witchhunt, because people feel extremely powerless.

This is equally true when conventional companies go out of business.

All I can say is that this is Bitcoin. I don't believe it until I see six confirmations.
Bitcoin Oz
Hero Member
*****
Offline Offline

Activity: 700


Wat


View Profile WWW
July 24, 2012, 12:05:00 AM
 #673

This still hasnt been reported to the cops Huh?

MtGox filed a police report, but would not details what they know until investigation is over. Bitcoinica are probably talking to their lawyers about what they should do.

You need to speak to lawyers first when you get stolen from ?

greyhawk
Hero Member
*****
Offline Offline

Activity: 924


View Profile
July 24, 2012, 12:09:01 AM
 #674

This still hasnt been reported to the cops Huh?

MtGox filed a police report, but would not details what they know until investigation is over. Bitcoinica are probably talking to their lawyers about what they should do.

You need to speak to lawyers first when you get stolen from ?

If you're a criminal organization, then yes, it would be advisable.
zhoutong
VIP
Hero Member
*
Offline Offline

Activity: 490


View Profile WWW
July 24, 2012, 12:16:44 AM
 #675

I just tried the LastPass account. I didn't expect to be able to log in, but I was able to using the original credentials!

And LastPass didn't log the IP that reverted the master password. It's so weird.


Quote
07/12/2012 22:17:04
LastPass.com
 
67.188.9.35
Master Password Changed
07/17/2012 08:30:52
LastPass.com
 
0.0.0.0
Master Password Reverted

Founder of NameTerrific (https://www.nameterrific.com/). Co-founder of CoinJar (https://coinjar.io/)

Donations for my future Bitcoin projects: 19Uk3tiD5XkBcmHyQYhJxp9QHoub7RosVb
repentance
Hero Member
*****
Offline Offline

Activity: 840


View Profile
July 24, 2012, 12:21:18 AM
 #676



You need to speak to lawyers first when you get stolen from ?

When a non-trivial amount of your users have likely been using your service to commit financial offences, then you sure as shit want to be consulting your lawyers when deciding how to proceed after a theft.


Quote
07/12/2012 22:17:04
LastPass.com
 
67.188.9.35
Master Password Changed
07/17/2012 08:30:52
LastPass.com
 
0.0.0.0
Master Password Reverted

Was the 12 July master password change after the hack (hack was announced on 13 July)?

It's concerning that anyone would revert the password.

All I can say is that this is Bitcoin. I don't believe it until I see six confirmations.
elux
Legendary
*
Offline Offline

Activity: 1454



View Profile
July 24, 2012, 12:24:29 AM
 #677

I just tried the LastPass account. I didn't expect to be able to log in, but I was able to using the original credentials!

And LastPass didn't log the IP that reverted the master password. It's so weird.


What. The. Hell.
BitBuster
Member
**
Offline Offline

Activity: 101


View Profile
July 24, 2012, 12:27:02 AM
 #678

I may have my facts wrong on some of this, so (those who actually know) please feel free to correct me?

1. Why did the hacker make a cash withdrawal? This supposedly gives Mt. Gox the account details of where the money was sent? If he/she were smart, they'd surely try to buy up as much bitcoin as possible then transfer the lot out of Mt. Gox and into an outside bitcoin address? Surely its worth maintaining anonimity and reducing the risk of being caught for the sake of not being able to take the whole $40k?

2. Keyrings like LastPass are great for fools who refuse to take responsibility for their own data/account security. But for a programmer or system administrator to provide one attack vector (externally sourced, no less!) that gives access to all parts of the system isn't just negligent, its deliberate and wilful.

3. Understanding that the API key was used as a password temporarily by someone who isn't normally involved in such matters, may be forgivable. However, this being brought to the attention of those in charge of technical operations and it not being resolved immediately is laughable.

In relation to 2 and 3; either the person/people responsible are clearly without the faculties to run such an operation, or they do have the technical sense to know that these flaws were critical and were either complicit or wilfully negligent.

Its clear from reading the email transcripts that competition with other exchanges and profitability were driving factors in whatever arrangements were being made regarding ownership. Regardless of this strong incentive not to suspend Bitcoinica's operation, those in charge should have done so as soon as they discovered these open barn doors and worked on shutting them before resuming.

What I find most troubling is that despite (according to the email transcripts) the Intersango / Bitcoin Consultancy trio knowing about these issues before they were exploited and therefore being absolutely culpable, people still seem to trust them enough to be trading on Intersango still?! If they were willing to leave holes unfilled for the sake of profit continuity at Bitcoinica, how can it be concluded that the same isn't true for Intersango?

My honest feeling is that the bitcoin community is blessed with technical talent. Unfortunately many appear to be straying far from their own skill sets and wasting other people's money while they learn new ones.


BB.
zhoutong
VIP
Hero Member
*
Offline Offline

Activity: 490


View Profile WWW
July 24, 2012, 12:31:38 AM
 #679


Was the 12 July master password change after the hack (hack was announced on 13 July)?

It's concerning that anyone would revert the password.

It should be. I can't answer with definite answers because I didn't change it.

It's concerning because an email account with admin rights of the entire Google Apps domain and also the domain name itself is stored in LastPass. The hacker can easily remove any critical email notifications by changing the settings of the mailing list info@bitcoinica.com.

Founder of NameTerrific (https://www.nameterrific.com/). Co-founder of CoinJar (https://coinjar.io/)

Donations for my future Bitcoin projects: 19Uk3tiD5XkBcmHyQYhJxp9QHoub7RosVb
kiba
Legendary
*
Offline Offline

Activity: 980


View Profile
July 24, 2012, 12:38:19 AM
 #680

I just tried the LastPass account. I didn't expect to be able to log in, but I was able to using the original credentials!

And LastPass didn't log the IP that reverted the master password. It's so weird.

From my understanding, it doesn't matter if the hacker didn't log into a LastPass account. That's because API key is the same password for a MtGox account.

Pages: « 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 [34] 35 36 37 38 39 40 41 »
  Print  
 
Jump to:  

Sponsored by , a Bitcoin-accepting VPN.
Powered by MySQL Powered by PHP Powered by SMF 1.1.19 | SMF © 2006-2009, Simple Machines Valid XHTML 1.0! Valid CSS!