Slashdot Mirror

← Back to Stories (view on slashdot.org)

Linode Exploit Caused Theft of Thousands of Bitcoins

Posted by ryuzaki0 on from the say-goodbye dept.

Sabbetus writes "Popular web hosting service Linode had a serious exploit earlier today. Apparently the super admin password for their server management panel was leaked and allowed a malicious attacker to target multiple Bitcoin-related servers. The biggest loss happened to a major Bitcoin mining pool that lost over 3000 BTC, which is currently worth almost 15 000 USD. Now the question is, will Linode compensate for lost bitcoins?" Update: The 3000 BTC theft was not even close to being the biggest, Bitcoin trading site Bitcoinica lost over 40,000 BTC.

12 of 450 comments (clear)

  1. Newsflash by Anonymous Coward · · Score: 5, Insightful

    Imaginary currency is not safe.

    1. Re:Newsflash by dlgeek · · Score: 5, Insightful

      How would insurance of bitcoins even work? It seems particularly challenging for many reasons.

      Generally, insurance policies are written for things with a strongly-known approximate value. Jewlery, physical property, buildings, a fixed amount of cash in a safe.... You can't generally get insurance on things with fluctuating value like real estate (you can insure the building on top of it, but you can't insure the lot against loss of value), various financial instruments, commodities futures, etc. Bit coins are highly variable - if I take out a policy against 10,000 bit coins, and they're lost, what value would the policy pay out based on? The value at the time I got my policy? The value at the time they were stolen? The value at the time the claim is settled? Does this take into account that if someone steals a large number of bitcoins, they're probably going to liquidate them quickly, which would depress the market? If the policy is based on the value at the time it's issued, the insured party has a motivation to purposefully lose or destroy the coins if the market dramatically drops - the insured value is higher than the market value. On the other hand, if the policy is based on the market value at the time of the incident, the insurance company's costs can skyrocket and no sane underwriter would write such a policy.

      Speaking of the insurred's motivation to defraud based on fluctuating value, the risk of fraud here is sky-high. A cryptographically-secure, untraceable currency where mere knowledge of a few numbers is enough to steal the entire value without leaving any evidence behind? It'd be trivial for the owner to purposefully leave a backdoor, then anonymously exploit it, especially given the nasscent state of computer security in the legal system. It wouldn't even have to be that subtle a hole, either. As far as I know, there isn't any precedent to establish what liability companies have with regard to negligence in the field, with the notable exception of PCI:DSS for the credit card industry. (For example, all the cases against Sony were dismissed as far as I'm aware.) In our current environment, the insurance company would have a hard time proving neglicence to dispute the claim. With that kind of risk, there's no way any insurer would issue that kind of policy. I just don't see any reasonable way that an insurance company would write a policy like this, at any price. Moreover, many of these issues reach past the bitcoin realm and apply to all sorts of online providers. As more and more of companies move data to "the cloud" - what kind of recourse do they have when security and availibility events happen. Can I get an insurance policy to protect me if my cloud email provider exposes confidential business informaton to the world which significantly impacts my revenue stream? It's a very thorny landscape...

    2. Re:Newsflash by plover · · Score: 4, Insightful

      It may appear thorny, but insurance is simply legitimized gambling, which ultimately is dirt simple. The company will lay odds against your losses. Now, they're going to study what's happening, and they're going to change the premiums on a scheduled basis, and they're going to present a quote that represents their estimate of your chances of loss, and they're going to have a lawyer write as many weaselly exclusions in the policy that they think they can get away with. If you ask them to insure $10,000 worth of bitcoins against loss, and they're only 50% confident in your security, they may take those odds and set your premium at $6,000.

      That's the other thing about insurance companies. They're exactly the same as the casino owner: the house always gets its cut.

      --
      John
    3. Re:Newsflash by __aajfby9338 · · Score: 4, Insightful

      How does one destroy a bitcoin?

      Send it to a nonexistent address, or lose the private key that is needed to send the bitcoin to somebody else. Either case results in a bitcoin that cannot be spent, so it is effectively destroyed. So, if you lose your bitcoin wallet and all backups of it, the associated bitcoins are gone for good.

      Both situations have happened, and bitcoins have been lost forever as a result. Well, if and when it becomes practical to break the encryption that bitcoin is based on, then it should be possible to recover those lost private keys. I think that is a moot point though, because that would also render the current implementation worthless, and cause it to be replaced with something else (optimistically assuming that anybody still cares about bitcoin once computing power renders the crypto trivially breakable).

    4. Re:Newsflash by Serious+Callers+Only · · Score: 4, Insightful

      What I find curious about these bit coin thefts is that they have no way to trace the coins once they have left - they see the account it goes to, but have no higher authority to dispute the transfer with, no way to find out who that is or where they are. It truly is virtual cash, but without the audit-trail which real banks have instituted for very good reasons for the cash in our bank accounts. So it seems once someone steals your digital wallet, it is truly gone, with no way to track who stole it, no compensation, no insurance (what insurance company would insure such risk?), and no way to call in the authorities. No wonder there have been a string of thefts, as this currency seems designed to avoid leaving an audit trail.

      I can't see why someone would want to keep their wealth in something like bitcoin for this reason alone, quite apart from the volatility and potential for the entire currency to collapse at some point.

  2. Re:Linode Terms of Service by Wonko+the+Sane · · Score: 4, Insightful

    Those people had no business storing $15,000 worth of irreplaceable data, electronic currency or not, on a service with these kinds of terms. Instead of spending an appropriate amount of money for the proper security they gambled with a service not designed to insure against that kind of liability and lost.

  3. No correlation. by Anonymous Coward · · Score: 5, Insightful

    Meh. No correlation. Linode has nothing to do with Bitcoins. You could store magic unicorns on their servers, want compensation if they get stolen? In the end _you_ are responsible for your data, not the host. So sorry if Bitcoin is flawed to the point where it can be so easily stolen by little old root. If you purchase service with a back up plan and the servers get hacked and your content is deleted, then you would legally/reasonably expect a restore but sorry fake money that gets "stolen" doesn't count.

  4. if you pay $10/mo, you can't really expect damages by Chalex · · Score: 5, Insightful

    Back when I worked for a web host company, we occasionally (rarely) had some issues where customers got screwed. In the worst case, your VPS is on a box where multiple disks die in a RAID array, and you don't have backups, and that's that.

    We were customer-friendly, so we would refund the customer's hosting charges if something went terribly wrong. But if you're paying $19/month, you can't really expect us to refund you more than $19/mo when something goes wrong.

    There's a rule of thumb in physical security; you should spend ~5% of the value of the thing to secure the thing. E.g. ~$1000 bicycle means ~$50 bicycle lock. If you're using a $19/mo service to hold $10k worth of value, you better be taking some other precautions. These guys were doing the equivalent of keeping $10k in cash in a $20 lockbox in a public place.

  5. Re:Linode Terms of Service by Jeremi · · Score: 4, Insightful

    It's irreplaceable in the sense that Bitcoin transactions can not be reversed.

    That would be 'irreversible', not irreplaceable. Obviously the stolen bitcoins can be replaced by transferring an equivalent number of bitcoins to victims' accounts.

    It's not as if a particular BitCoin ID string is of great sentimental value to anyone here; it's the value of the stolen coins that is the issue. Bitcoins are fungible.

    --


    I don't care if it's 90,000 hectares. That lake was not my doing.
  6. Claim settlement difficulties by tlambert · · Score: 4, Insightful

    Might be a bit difficult to find someone who even would insure their bitcoin balance, not to mention the difficulties that would probably arise if a claim was filed. Fortunately, in this case the operators of the services are absorbing the lose and their customers/clients are not directly affected.

    It should be easily settled by converting real dollars into BTC.

    I head about 3000 BTC has coincidentally just become available on the market, which if they put up the US$15,000 to buy them, should cover the "stolen" BTC.

    1. Mine a bunch of BTC
    2. Fake an online break-in and theft
    3. Sell the not really stolen property to the entity who has to replace it, using an untraceable currency
    4. Profit!

    PS: There is no ???? step when it comes to insurance fraud, it's a rather well researched field.

    -- Terry

  7. Re:$15000 USD???? by Dahamma · · Score: 4, Insightful

    So basically they are NOT a currency at all.

    They are about as much "currency" (defined as "a widely accepted medium of exchange") as cancelled postage stamps or baseball cards.

  8. Re:$15000 USD???? by Dahamma · · Score: 4, Insightful

    Yep, gold is not a currency either. Hasn't been in a while. Now it's mostly a commodity traded on the market like other commodities. I think I'd prefer to trade in gold than freaking bitcoins, though.