Bitcoin exchange ceo arrested
13 comments
Litecoin difficulty projections
Bitcoin BTC is the first digital currency designed to be fully decentralized, meaning there is no trusted third-party, no company, no central bank authorizing, validating, and keeping track of transactions, yet Bitcoin is secure through clever use of well-known cryptographic primitives.
It is important to understand that today's attack exposed flaws in a particular exchange, not in Bitcoin itself. Some pointed out the pastebin message as a possible connection. On Sunday, June 19, At this exact second, a person placed one or more orders to sell hundreds of thousands of Bitcoins, causing its exchange rate to crash from 17 USD down to 0. It took half an hour for the trading platform to execute the order s. The MtGox site was very unresponsive during this time.
Whoever did that ended up trading the digital currency for a total of more than 1. Then, further trades occurred, either from confused MtGox users or from this same person. The largest trade seen, for It is possible that this person re-bought large amounts of Bitcoins. During the same time, other Bitcoin exchanges experienced severe volatility. A few minutes later, at This BTC represents 6. At first, it was unclear who initiated this transaction. If it had been the person who sold and possibly re-bought Bitcoins, then transferring them out of MtGox to his private Bitcoin wallet, it would have made these coins unrecoverable and the largest Bitcoin heist ever.
After a quick investigation, he determined an attacker used a stolen MtGox account with a lot of Bitcoins in it, sold them, and caused the crash.
He shut the MtGox site down, and posted a message explaining so. The list contains accounts. Most of the passwords are hashed with Unix MD5-based crypt , except of them which are plain MD5 hashes unsalted, non-iterated.
Many of these hashes, even those that appear to be strong passwords, show up on various websites about password brute-forcing when googling for them. Notably, 2 days ago, a user named georgeclooney posted requests to crack some of these hashes on the InsidePro password recovery forums.
He is almost certainly the same person who attacked MtGox since he knew about the hashes beforey they were publicly released. Unfortunately, many of the hashes are weak and were brute-forced easily according to these same websites. Some users discovering the leak have run password brute-forcers themselves against the hash list and easily broke hundreds of them. Contrary to previous claims from the MtGox owner, this indicates that many accounts had been compromised for at least days, if not weeks, before today's attack.
In the next hour or two , other Bitcoin exchanges chose to voluntarily temporarily shut down as a security precaution, as many users re-use the same passwords across different trading sites. Britcoin is one of them and happens to be hosted on the same server infrastructure as MtGox, and claimed that a SQL injection was used to attack MtGox.
Currently their homepage shows:. MTGox suffered an SQL injection which means access to the site's funds were in the hands of the malicious hacker. As such, until we see evidence to the contrary, for security reasons we are assuming that MTGox has none of it's [sic] client's bitcoins. For this reason, we have withdrawn their access to our servers and the sensitive information on those servers. We have already moved all our customer bitcoins to a wallet which has newly been created and has the highest measure of security possible.
The GBP deposits of course are still safe in our business bank account as well. Personally, even though I confirmed the validity of my password hash in the leaked list, I would normally see no need to change it since it is unique and very strong: However, if one assumes the worst, that the attacker had infiltrated MtGox for some time and has been logging all password authentication attempts, then passwords should be changed anyway.
This allowed for someone to pull our database. The site was not compromised with a SQL injection as many are reporting, so in effect the site was not hacked. MtGox announces that they are quickly working on immediately replacing MD5-based crypt hashes with SHAbased crypt for extra precaution, and are going to implement password-protected withdrawals.
The site is planning to re-open on June 21, Evidence is building up that there were, in fact, SQL injection vulnerabilities on mtgox. MtGox has not commented on this. Before re-opening MtGox, he wants to ensure that the process to claim ownership of one's account is secure, despite the password hashes having been leaked. MtGox announces that "you can now file requests to recover your Mt.
Gox account" through the special claim. A claim request consists of submitting the account name, email address, the old password, a new password; then verifying the email address; and optionally submitting more evidence such as the last known MtGox balance of the account, the Liberty Reserve account typically used for withdrawals, copy of a government ID, etc.
Claim requests appear are verified manually by MtGox staff. This has led to speculation that it was a stunt by an attacker wanting to draw attention to the fact that he truly had manual control of this amount presumably stolen from MtGox. The fraudulent trades have indeed been rolled back. The first one is executed at at In the next few hours, the exchange rate stabilized at around However I noticed that my open orders that were executed during the MtGox sell-off have not been reinstated.
I recommend MtGox users to check their order book. The Bitcoin community users were able to brute-force as of June 20, Assuming the attacker was also able to brute-force about the same amount, it is possible to imagine that this number of accounts happened to collectively hold the hundreds of thousands of Bitcoins that were used in this massive sell-off. But it is unclear what exactly the attacker had in mind exactly when selling off.
Did he think he would then be able to withdraw the USD? Did he have sufficiently compromised MtGox that he would be able to bypass these limits? Or perhaps, as it is sometimes the case, the attacker's purpose was simply to cause mayhem for fun think a script kiddie doing random things.
Not all attackers are like the well-prepared robbers in Ocean's 11, with a precise plan of action. This is probably the simplest explanation. Hi, beside the database hack and theft, i wonder why a "small" Sell Order can bring the whole rate down.
MtGox has to revisit their priceformula too. Good timeline - just a quick fix, there are only about 6. Another thing to note that I find interesting is that Mt.
But it is unlikely MagicalTux had the foresight to implement this as a moving average. This may make Mt. Gox's rollback very, very difficult and could mean lost money for many users, as Mt. Gox may simply not have the coins needed to do a real rollback. Yup, Forex is much bigger. Also the sharp uptrend, after Bitcoin was in the media worldwide, was unreal. Pricechange should be something like: So only someone selling the whole 6.
The price did not crash to 0. Also, on the traditional forex markets, a single person is not in control of most of the money, and is not stupid enough to sell everything down to zero. This attack emphasizes the need for more than 1 dominant Bitcoin exchange. Also, imagine this scenario: U want to buy a PC at a store at 9am.
Two hours later someone sold 60,btc at a market, rate is dropping. And now the PC in the store costs btc? If Bitcoins wants to become a real currency the market must be stable! There is no "formula". It's all bids and asks. The new salted hashes were created upon logging in with that account. You have to take a snapshot of the accounts before the data was leaked nobody knows when that was right now, sadly.
If mtgox is true about their salting-upon-login claim, then this differencein the numbers would be a hint at the maximum possible broken accounts. The claim that the few hunderts of unsalted accounts in the files were all possibly compromised is then wrong. Another thing that is pretty unsafe is re-authenticating accounts by sending mails with a new password.
That might work for a dating site but isn't at all safe enough for a financial service, even if eBay and Amazon do the same crap. I'd like it much more if account re-authentication would be done using a GnuPG signature for a public key which initially has to be deposited at the site. That makes it also possible to use existing SmartCard infrastructures for GnuPG, thus enabling much safer two-factor authentification. You need that anyway when you send payment adresses; Email isn't going to warrant integrity of your payment address and the next wave of fraud will be forgery of Bitcoin addresses.
It would also be more than helpful to use something like an mTAN scheme, requiring transactions confirmed by a number sent to a mobile phone. The owner of Bitcoin faucet managed to set that up, why not Mt Gox? Not that such is unbreakable but it is orders of magnitude safer than simple password authentication. I believe that the people running Mt Gox have best intentions and feel friendly for them, but I am actually embarassed to use a site with such poor security.
I wouldn't ask the Dalai Lama for a liver transplant, I'd trust rather some bad-assed surgeon with sardonic laugther. Strange number, isn't it? I really do not buy this explanation then: