Linode Exploit Caused Theft of Thousands of Bitcoins

Sabbetus writes "Popular web hosting service Linode had a serious exploit earlier today. Apparently the super admin password for their server management panel was leaked and allowed a malicious attacker to target multiple Bitcoin-related servers. The biggest loss happened to a major Bitcoin mining pool that lost over 3000 BTC, which is currently worth almost 15 000 USD. Now the question is, will Linode compensate for lost bitcoins?" Update: The 3000 BTC theft was not even close to being the biggest, Bitcoin trading site Bitcoinica lost over 40,000 BTC.

Comments

oops

[buzzsawddog]

oops...

Re:oops

[sg_oneill]

It has been said that on the internet, comedy is tragedy that ends in the words "And then I lost my bitcoins".

Thankyou randoids, thank you once again for proving that in the world there are people more comically thoughtless than I.

Re:oops

[subreality]

You accidentally all your bitcoins? :)

Newsflash

[Anonymous Coward]

Imaginary currency is not safe.

Re:Newsflash

[houstonbofh]

And real banks and credit systems are never robbed... They should have had insurance to cover this. If not, they are in a very bad way.

Re:Newsflash

[Kenja]

That would be an interesting claim to file. "They stole my bits! I demand that you replace them."

Re:Newsflash

[mrmeval]

Isn't that the point of bitcoin? To make the intangible tangible? If those bits can be stolen they're about as tangible as it gets. ;) So there is a loss. I'm sure Lloyds of London could write that policy but I don't see them doing it for a price that was affordable.

Re:Newsflash

[BenJCarter]

Perhaps if they paid for the policy in Bitcoins?

Re:Newsflash

[dlgeek]

How would insurance of bitcoins even work? It seems particularly challenging for many reasons.

Generally, insurance policies are written for things with a strongly-known approximate value. Jewlery, physical property, buildings, a fixed amount of cash in a safe.... You can't generally get insurance on things with fluctuating value like real estate (you can insure the building on top of it, but you can't insure the lot against loss of value), various financial instruments, commodities futures, etc. Bit coins are highly variable - if I take out a policy against 10,000 bit coins, and they're lost, what value would the policy pay out based on? The value at the time I got my policy? The value at the time they were stolen? The value at the time the claim is settled? Does this take into account that if someone steals a large number of bitcoins, they're probably going to liquidate them quickly, which would depress the market? If the policy is based on the value at the time it's issued, the insured party has a motivation to purposefully lose or destroy the coins if the market dramatically drops - the insured value is higher than the market value. On the other hand, if the policy is based on the market value at the time of the incident, the insurance company's costs can skyrocket and no sane underwriter would write such a policy.

Speaking of the insurred's motivation to defraud based on fluctuating value, the risk of fraud here is sky-high. A cryptographically-secure, untraceable currency where mere knowledge of a few numbers is enough to steal the entire value without leaving any evidence behind? It'd be trivial for the owner to purposefully leave a backdoor, then anonymously exploit it, especially given the nasscent state of computer security in the legal system. It wouldn't even have to be that subtle a hole, either. As far as I know, there isn't any precedent to establish what liability companies have with regard to negligence in the field, with the notable exception of PCI:DSS for the credit card industry. (For example, all the cases against Sony were dismissed as far as I'm aware.) In our current environment, the insurance company would have a hard time proving neglicence to dispute the claim. With that kind of risk, there's no way any insurer would issue that kind of policy. I just don't see any reasonable way that an insurance company would write a policy like this, at any price. Moreover, many of these issues reach past the bitcoin realm and apply to all sorts of online providers. As more and more of companies move data to "the cloud" - what kind of recourse do they have when security and availibility events happen. Can I get an insurance policy to protect me if my cloud email provider exposes confidential business informaton to the world which significantly impacts my revenue stream? It's a very thorny landscape...

Re:Newsflash

[plover]

It may appear thorny, but insurance is simply legitimized gambling, which ultimately is dirt simple. The company will lay odds against your losses. Now, they're going to study what's happening, and they're going to change the premiums on a scheduled basis, and they're going to present a quote that represents their estimate of your chances of loss, and they're going to have a lawyer write as many weaselly exclusions in the policy that they think they can get away with. If you ask them to insure $10,000 worth of bitcoins against loss, and they're only 50% confident in your security, they may take those odds and set your premium at $6,000.

That's the other thing about insurance companies. They're exactly the same as the casino owner: the house always gets its cut.

Re:Newsflash

[nedlohs]

How does one destroy a bitcoin?

Storing it at linode seems a good start.

Re:Newsflash

[ComaVN]

They're exactly the same as the casino owner: the house always gets its cut.

Not quite. The casino sets the rules of the game, making sure they know EXACTLY what the odds are, thereby turning long-term profit into a statistical certainty. The insurer has to guess the odds, and can actually guess wrong, so there's a lot less certainty. That's why there are reinsurers, who insure the insurers against unexpectedly large payouts.

Re:Newsflash

[__aajfby9338]

How does one destroy a bitcoin?

Send it to a nonexistent address, or lose the private key that is needed to send the bitcoin to somebody else. Either case results in a bitcoin that cannot be spent, so it is effectively destroyed. So, if you lose your bitcoin wallet and all backups of it, the associated bitcoins are gone for good.

Both situations have happened, and bitcoins have been lost forever as a result. Well, if and when it becomes practical to break the encryption that bitcoin is based on, then it should be possible to recover those lost private keys. I think that is a moot point though, because that would also render the current implementation worthless, and cause it to be replaced with something else (optimistically assuming that anybody still cares about bitcoin once computing power renders the crypto trivially breakable).

Re:Newsflash

[plover]

True, casinos are substantially more honest than insurance companies. The house cut is right there printed on the table for anyone to see. The insurance company, on the other hand, doesn't have to tell you the odds they calculated. They can compute them at 1% and charge you 10%, and you will never know.

And there are lots of methods for assessing risk that yield probabilities. FAIR is one such practice that's gaining acceptance in the info security world. ISO 31000 is an attempt to standardize risk management across the board. It's a lot more disciplined than "guessing".

Re:Newsflash

[Mister Transistor]

Actually more of them do than you think! I used to work for a bank, and we would NEVER publicize robberies. First, because of the fear of creating a wave of copycat crimes. Second, to not undermine the bank's secure image. There are 2-5 bank robberies a MONTH in the Chicagoland area, but none of them ever hits the news. Only when there's external involvement, like a shootout or a hostage situation does it ever make the evening news. I found this quite surprising how much the general public is kept in the dark about this sort of thing.

Re:Newsflash

[FatdogHaiku]

Well, we can replace the 1's with no problem, but we can't give you anything for the 0's...
Where would you like those emailed?

Re:Newsflash

[tlhIngan]

Generally, insurance policies are written for things with a strongly-known approximate value. Jewlery, physical property, buildings, a fixed amount of cash in a safe.... You can't generally get insurance on things with fluctuating value like real estate (you can insure the building on top of it, but you can't insure the lot against loss of value), various financial instruments, commodities futures, etc. Bit coins are highly variable - if I take out a policy against 10,000 bit coins, and they're lost, what value would the policy pay out based on? The value at the time I got my policy? The value at the time they were stolen? The value at the time the claim is settled? Does this take into account that if someone steals a large number of bitcoins, they're probably going to liquidate them quickly, which would depress the market? If the policy is based on the value at the time it's issued, the insured party has a motivation to purposefully lose or destroy the coins if the market dramatically drops - the insured value is higher than the market value. On the other hand, if the policy is based on the market value at the time of the incident, the insurance company's costs can skyrocket and no sane underwriter would write such a policy.

Guess what? All of them!

You can take an insurance policy on what the coins where worth when the agreement was signed. At that point, the insurer is basically converting it to a common currency (e.g., US Dollar) and insuring you for that amount.

You can take an insurance policy that gives you replacement value, too - at which point the insurance company will pick a day to pay out, and either give you the insured product, or the cash equivalent.

In all cases, the insurer will have to figure out the rate - if I was an insurer, I might take the spotty history of Bitcoin, and see that the past year, it topped at $20/coin. I would then set it out for 10,000 coins at $20/coin, or $200,000 plan. If it goes up to $30 one time, I would increase the premium you pay since it's cover $300,000 now.

And don't forget that there are often maximums as well. E.g., if the price goes up to $30, and you lose them all, the policy may state that it's replacement value, up to $200,000, whichever is lower.

Re:Newsflash

[sixtyeight]

That would be an interesting claim to file. "They stole my bits! I demand that you replace them."

The RIAA, MPAA and Microsoft have been doing it for years now.

Re:Newsflash

[snookums]

That would be an interesting claim to file. "They stole my bits! I demand that you replace them."

Do you think that when you deposit money in the bank they put a pile of cash in the safe for you?

Almost all modern currency is bits.

Re:Newsflash

[Dunbal]

Tell me, how much do you lose if your bank gets robbed?

Re:Newsflash

[Serious Callers Only]

What I find curious about these bit coin thefts is that they have no way to trace the coins once they have left - they see the account it goes to, but have no higher authority to dispute the transfer with, no way to find out who that is or where they are. It truly is virtual cash, but without the audit-trail which real banks have instituted for very good reasons for the cash in our bank accounts. So it seems once someone steals your digital wallet, it is truly gone, with no way to track who stole it, no compensation, no insurance (what insurance company would insure such risk?), and no way to call in the authorities. No wonder there have been a string of thefts, as this currency seems designed to avoid leaving an audit trail.

I can't see why someone would want to keep their wealth in something like bitcoin for this reason alone, quite apart from the volatility and potential for the entire currency to collapse at some point.

Re:Newsflash

[ultranova]

Imaginary currency is not safe.

All currency is imaginary. It's an abstract representation of wealth, which in turn is an abstract representation of resources and services owed to you. And of course the entire concept of owing - debt - is a purely social construct, and thus imaginary.

But yeah, wealth is not safe.

Re:Newsflash

[Anonymous Coward]

Actually, Bitcoin's leave an infinitely long trail in the block chain. Furthermore, the trail is generated and verified by the community, rather than a single authority, in way that makes it impossible for anyone to fake the money trail. Finally, it's made public to every Bitcoin client (the implementation depends on this) so there's no need to ask an authority for this information.

Anyone can find out with ease and absolute certainty which Bitcoins are being transferred and when. The problem lies in the fact that the addresses are anonymous and basically meaningless. You can easily see that the coins were transferred, but not to whom.

If there were a concerted effort, these sorts of thefts could be recorded however. Reputable exchanges and shops could then refuse to accept Bitcoins from dirty addresses, to deter theft.

Re:Newsflash

[subreality]

"They stole my $WHATEVER!" is exactly why umbrella insurance policies exist. Yes, they cover lost bits. Yes, they have value, and it costs real money to replace them, just like pieces of paper printed with green ink also have no intrinsic value but it's reasonable to have insurance to cover them.

As for the GP's point that Bitcoin is imaginary money: Your bank account balance is also just a bunch of bits in a database somewhere. The vast majority of those bits don't even have green pieces of paper to back them up.

Re:Newsflash

[repapetilto]

There are fool-proof methods that, if followed, allow you to keep your bitcoins safe from any hack. However, those methods are not usable when bitcoins need to be immediately accessible. This theft was actually only the "petty cash" of a major margin trading site as well as that of a mining pool.

Re:Newsflash

[Serious Callers Only]

Actually, Bitcoin's leave an infinitely long trail in the block chain....Anyone can find out with ease and absolute certainty which Bitcoins are being transferred and when. The problem lies in the fact that the addresses are anonymous and basically meaningless.

There is no verification of identity and therefore no audit trail - an audit trail of anonymous tokens is worthless, even if you can trace it to the n'th degree and watch your money being laundered anonymously.

Re:Newsflash

[Anonymous Coward]

I've personally had CC fraud where someone ordered many Palm Pilot unit under my name and shipped them elsewhere. When I reported it to my bank, they simply stated it would be handled and taken care of. Not too worry they said. Well, I didn't worry and everything seemed like it was swept under the rung.

What did you expect the bank to do? Send you and some bank staff on a dramatic thrill-ride as they pursue credit card fraudsters through the Moscow Metro, pausing occasionally to exchange bullets and witty one-liners with vacationing Yakuza?

Fraud has to be handled very sensitively, not least of all because it can result in criminal or civil proceedings. It makes sense to keep specifics of a case and the processes on a need-to-know basis. Fraud is a cost of doing business, and in "normal" incidents, there's no point in alarming customer unnecessarily. If my card gets abused, all I want to know is what I'm liable for and what I need to do to prevent this from happening again?

Re:Newsflash

[Dodgy G33za]

All currency has been imaginary ever since the gold standard was dropped. In theory there is nothing to stop the central bank from printing massive amounts of new currency (actually nowadays it doesn't even need to print it, it just magics it out of thin digital air).

In fact this is happening right now, with a number of central banks creating money, and then loaning it to banks for 1% to prop up the banks.

When you consider that increasing the money supply by 10% effectively makes the ones you have (and earn) worth 10% less (actually not quite, but let's not quibble), this is effectively a redistribution of the wealth of a nation everyone, to those that own shares in the bank. Which will have the inevitable consequence of moving said wealth into the hands of the already wealthy, since everyone has SOME money but in general only the wealthy have shares in banks.

Why this doesn't get people out on the streets rioting I have no idea. Oh, wait...

Just for the record IANAE

Re:Newsflash

[TheNinjaroach]

No wonder there have been a string of thefts, as this currency seems designed to avoid leaving an audit trail.

No, it's not the lack of an audit trail that makes bitcoins susceptible to this type of theft. It's the decentralized P2P nature of bitcoins that prevents any single entity (like your bank) from reversing an unauthorized transaction. With no central authority to regulate these transactions, bitcoins are very literally "finder's keepers."

Re:Newsflash

[shaitand]

That is called privacy which has a value all its own. But yes there is a trade off in the form of having to provide your own security. Those audit trails have mostly been instituted for the benefit of tax authorities and whether that is a 'good' reason is up for debate. Bitcoin is digital CASH, money in your bank account is NOT cash. Money in your physical wallet is cash. If someone steals your physical wallet there is less chance of catching them than with Bitcoin.

Bitcoin itself doesn't implement an audit trail but digital access to a file certainly does. Unlike your physical wallet stealing your bitcoin requires hacking your computer system which is a federal crime. You can most definitely call the authorities if this happens and invite the federal crime lab to examine the digital trail left by the attacker. Unlike local law enforcement tracking your stolen physical wallet the FBI can trade the digital footprints involved and demand the cooperation of internet providers to do so. If you are talking about a substantial theft then forensic accounting can be used to trace the funds but unlike actual cash the bitcoin global audit trail is visible to authorities without requiring any warrants or foreign cooperation and not all bitcoin addresses are anonymous. Many are publicaly known.

Is all this going to happen for your couple thousand in bitcoin? Probably not but then again there isn't likely to be any actual manhours dedicated to your lost wallet with $2000 in it either. For that matter nobody is going to expend effort investigating $2000 stolen from your bank account or $2000 worth of credit card fraud.

Bitcoin is like gold. It has a value independent of fiat currency. If the US dollar collapses tomorrow my bitcoin still has worth. Like gold it is relatively trivial to 'wash' the take if its stolen so it is upon me to protect it. Like gold the value relative to fiat currency is not guaranteed. Like gold bitcoin is an option for storing wealth used for transactions that are none of anyone's business. Like gold, your an idiot if you put all your wealth in bitcoin. At the end of the day you have to physically and digitally secure your bitcoin but only physically secure your gold. Even if you print your keys and lock them in a safe deposit box you risk the network somehow being hacked. So gold is superior in this sense. But gold has practical limitations to its use for small transactions. A tiny amount of gold is worth too much to be practical for paying me back for lunch. Bitcoin is infinitely divisible. It really doesn't matter if my normal transaction unit is 1 BTC .1 BTC or .01 BTC because these are just numbers on a screen and I need no scale to accurately divide bitcoin in this way. Bitcoin also allows me to make what amounts to a cash transaction with someone across the world where this is difficult with cash or gold.

Bitcoin can also be easily converted into local currency when traveling internationally alleviating the need to carry large sums of precious metals or cash that could be stolen by customs or pick pockets.

The greatest value of bitcoin

[cold fjord]

The greatest value of bitcoin seems to be in generating headlines.

Linode Terms of Service

[Laebshade]

http://www.linode.com/tos.cfm

Section 9, paragraph 1:

Subscriber acknowledges that the service provided is of such a nature that service can be interrupted for many reasons other than the negligence of Linode.com and that damages resulting from any interruption of service are difficult to ascertain. Therefore, subscriber agrees that Linode.com shall not be liable for any damages arising from such causes beyond the direct and exclusive control of Linode.com. Subscriber further acknowledges that Linode.com's liability for its own negligence may not in any event exceed an amount equivalent to charges payable by subscriber for services during the period damages occurred. In no event shall Linode.com be liable for any special or consequential damages, loss or injury. Linode.com is not responsible for any damages your business may suffer. Linode.com does not make implied or written warranties for any of our services. Linode.com denies any warranty or merchantability for a specific purpose. This includes loss of data resulting from delays, non-deliveries, wrong delivery, and any and all service interruptions caused by Linode.com.

Re:Linode Terms of Service

[Wonko the Sane]

Those people had no business storing $15,000 worth of irreplaceable data, electronic currency or not, on a service with these kinds of terms. Instead of spending an appropriate amount of money for the proper security they gambled with a service not designed to insure against that kind of liability and lost.

Re:Linode Terms of Service

[v1]

Subscriber further acknowledges that Linode.com's liability for its own negligence may not in any event exceed an amount equivalent to charges payable by subscriber for services during the period damages occurred.

So if this is binding and enforceable, (which should always be questioned, you can put just about anything in your TOS) that means if they are incompetent retards and let your hosted server get hacked through their back door to your hosted machine they won't be liable for anything beyond the monthly fees you paid them while being hacked?

That's very likely to go to court. They may win or they may lose, but that fails the "common sense" assumption that part of what you are paying for is at least reasonable security for your IP at the facility you are leasing time on. And losing control of your hypervisor-ish password should be easy to prove to be negligent.

I think if they came right out and had to decode that and say "we reserve the right to let random vandals come in and snoop all your data and you won't have any legal recourse" they'd lose a lot of customers. But that's basically what this is going to tell all their customers now. They'd have been a lot smarter to just have quietly reimbursed them. It'll cost them more due to bad publicity.

Re:Linode Terms of Service

[mysidia]

P.S. Linode may be implicitly and strictly liable for damages caused by the "linode admin" product on hosted servers.

Separate from any liability for the manner in which service is provided.

In many states, manufacturers cannot disclaim one or more forms of implicit liability.

Just in the same manner, as a manufacturer cannot disclaim warranty in case, your brand new toaster blows itself up the first time you plug it in, due to a manufacturing defect

The manufacturer will be responsible for your injuries, incidental, and consequential damages, even if the warranty, "Terms of use" and stickers on the box say otherwise, due to the manufacturer's negligence, in selling a defective product that causes damage to its user when used as directed.

Re:Linode Terms of Service

[Jeremi]

It's irreplaceable in the sense that Bitcoin transactions can not be reversed.

That would be 'irreversible', not irreplaceable. Obviously the stolen bitcoins can be replaced by transferring an equivalent number of bitcoins to victims' accounts.

It's not as if a particular BitCoin ID string is of great sentimental value to anyone here; it's the value of the stolen coins that is the issue. Bitcoins are fungible.

ToS

[Rinisari]

I saw an analysis of their Terms of Service somewhere, indicating that they will only compensate up to the value of the service paid. So, if your service was $100/mo, they'd only compensate you for the downtime you experienced, or up to that month's service charge of $100.

If Linode cares about Bitcoin, it will find a way to compensate its users. Otherwise, if the users who lost money are up to it, I'm sure there is at least one lawyer out there willing to be counsel on the first case involving theft of a digital currency, testing whether or not the data/rights to data stolen are legitimate property of legal value. We supporters of Bitcoin say, "Of course!" but it's not until there's a legal precedent that we really can say that.

Or, Linode can sit behind its ToS and test contract law.

Or, the users can vote with their money and leave Linode and tell others why they're leaving.

At least in my eyes, that I would ever consider Linode in the future is hanging in the balance, and they've previously always had a good reputation in my mind. I would venture that there are plenty of other like-minded geeks out there. Given that Linode's market is primarily we geeks, I believe it behooves them to do the right thing and compensate for the losses.

Re:ToS

[93 Escort Wagon]

If Linode cares about Bitcoin, it will find a way to compensate its users. Otherwise, if the users who lost money are up to it, I'm sure there is at least one lawyer out there willing to be counsel on the first case involving theft of a digital currency, testing whether or not the data/rights to data stolen are legitimate property of legal value.

Out of principle, shouldn't the complainants only hire a lawyer who will agree to be paid in Bitcoins?

Re:Don't you just LOVE an unregulated service

[Anonymous Coward]

Really? Isn't the dream of librarians of that top button finally being released to expose the...

Oh wait, that's my dream of librarians.

No correlation.

[Anonymous Coward]

Meh. No correlation. Linode has nothing to do with Bitcoins. You could store magic unicorns on their servers, want compensation if they get stolen? In the end _you_ are responsible for your data, not the host. So sorry if Bitcoin is flawed to the point where it can be so easily stolen by little old root. If you purchase service with a back up plan and the servers get hacked and your content is deleted, then you would legally/reasonably expect a restore but sorry fake money that gets "stolen" doesn't count.

The bank left the combination to their safe out

[atari2600a]

Let's write a news article about it

Re:So, to sum up...

[Anonymous Coward]

15k is nothing of value eh? Doesn't matter if you think they are worthless. Fact is, they are worth real value to about a million people who use them for a lot more then just interesting math.

if you pay $10/mo, you can't really expect damages

[Chalex]

Back when I worked for a web host company, we occasionally (rarely) had some issues where customers got screwed. In the worst case, your VPS is on a box where multiple disks die in a RAID array, and you don't have backups, and that's that.

We were customer-friendly, so we would refund the customer's hosting charges if something went terribly wrong. But if you're paying $19/month, you can't really expect us to refund you more than $19/mo when something goes wrong.

There's a rule of thumb in physical security; you should spend ~5% of the value of the thing to secure the thing. E.g. ~$1000 bicycle means ~$50 bicycle lock. If you're using a $19/mo service to hold $10k worth of value, you better be taking some other precautions. These guys were doing the equivalent of keeping $10k in cash in a $20 lockbox in a public place.

overblown news story, here's the real truth

[slashmydots]

Oh the drama. As an actual bitcoin miner, let me fill you in on the real story instead of that media fluff that's purposely inflated to overdramatic proportions. Almost all bitcoin mining pool websites are configured to pay people every time 1 BTC is reached. That's around $5 US and takes a mediocre mining rig approximately 2 days to generate. So the most that the average person probably lost is $0.01 - $5.00. NOBODY keeps massive piles of BTC sitting around at the pool itself. The exchanges, yeah, but not the pools. They're known for lax security too. At the #1 biggest mining pool, your miners' login passwords are listed as plaintext on the page because what are people going to do, mine for you? And none of your money stay there for long so nobody really cares.
What really doesn't add up is the 3000 BTC estimate. Even Deepbit, the largest pool, doesn't have 6000 members, which would be the number required to, at any given point in time, have an average of 3000 BTC on-hand. So it likely was the site owner's profit pool that got robbed the most heavily.

Re:overblown news story, here's the real truth

[godofpumpkins]

What about the 43,000 coins bitcoinica reported stolen in the same breach? Still overblown? https://bitcointalk.org/index.php?topic=66979.0

Re:overblown news story, here's the real truth

[Beelzebud]

Because they're not worth a lot.

Re:overblown news story, here's the real truth

[dbIII]

NOBODY keeps massive piles of BTC sitting around at the pool itself

I'm sorry, but do you really expect us to think that people who get taken in by ponzi schemes are likely to be careful with their get rich quick scheme?
It looks like we've got our own little cut rate reality TV show here where we can marvel at the sharks and minnows in a squalid little pretend ecosystem.

Bitcoins and US Customs

[Anonymous Coward]

A question I consider sometimes is the relationship between Bitcoins and the US Customs (or any other border agency.)

When we cross the border there are obvious signs making it clear that if you carry more than $10,000 across the border (Canadian or American in my case) in either direction you must declare the transaction. Suppose one's bitcoin wallet is on their cellphone and they are carrying more than $10,000 worth of bitcoins on their cellphone. Would these need to be declared?

I guess it would be similar to carrying bearer bonds across the border but I'm not certain what the conditions are for those, either.

The concern would be whether two people with cellphone bitcoin wallets could meet and move bitcoins from one cellphone wallet to the other without another server or service being involved in the transaction. If so then I can certainly see how this process could be used to facilitate illegal transactions with less obvious traces than carrying large volumes of actual cash.

Re:So, to sum up...

[slimjim8094]

They're worth US dollars, which I can use to pay for stuff, including my taxes. Even if every retailer on the planet took BitCoin, they'd still be less valuable than whatever the national currency is.

linode corporate post on incident

[YesIAmAScript]

If anyone (like me) was wondering if there was any confirmation that linode accepted blame other than from the person who was robbed, there is.

http://status.linode.com/2012/03/manager-security-incident.html

Linode is actually rather lucky this person who did this only went for 8 machines. They could have been in a whole lot more trouble when someone got access like this.

Multisignature transactions

[emeitner]

Bad decisions were made. If you have ever had to deal with PCI DSS certification then you know what the credit card processing companies expect of their merchant customers. Now imagine the standards the credit card companies themselves try to adhere to. Some developers using BitCoin need to think about the security Big Picture before creating infrastructure for their projects/businesses. Keeping a BitCoin wallet containing thousands of BTC on a little cloud server is not wise.

Having said that, there is a solution in the pipe to help with this problem. Gavin Andresen, lead BitCoin developer, had his Bitcoin Faucet Linode server hacked. While only a few Bitcoins were lost he now is using this incident to support his proposal for Multisignature Transactions.

Awesome

[glwtta]

So I take it we're back on the BitCoin thing full-time?

Does this mean that we at least don't have to see anything about Raspberry Pie or Strawberry Jam, or whatever, for a few weeks?

Re:Awesome

[Bieeanda]

You wish. As soon as the second batch goes out, there's going to be a flurry of articles about some guy who daisy-chained a hundred of them together for mining.

tip of the ice berg - not even the real story!

[slashmydots]

Boy did they bury the lead. Here's the entire story. Allegedly someone broke into the Linode web hosting company, hacked specifically just 8 sites involved in bitcoins and THAT'S IT, no other sites, and stole a hell of a lot more than 3000 BTC. 3000BTC isn't significant but 43,554 BTC were stolen from another major exchange, Bitcoinica. That company is claiming they have the money to cover it and will reimburse everyone. That's almost a quarter of a million US dollars by the way.

Apparently the word on the street is this was targeted and definitely an inside job from an employee or multiple employees at Linode. The easiest way a simultaneous 8-site web control panel hack would be to simply log in with a secret back-door master password that basically all web hosts have. Either someone hacked Linode and found out that master password or it was an employee, the latter of which is obviously a lot simpler and more believable.

Re:tip of the ice berg - not even the real story!

[Larryish]

secret back-door master password

Was the HACKER in question getting a BLOWJOB at the time while having a GUN pointed at his head?

Re:tip of the ice berg - not even the real story!

[slashmydots]

Maybe if you ever read slashdot, you'd know about the complaint years ago about someone finding out that their web hosting company, despite them renting an individual server, demanded that they keep an administrator password to access it whenever they wanted. Since it's THEIR server, that makes perfect sense. I wouldn't let someone lock me out of my own server. That's like a lessee changing the locks and locking a landlord out of their apartment. Basically all web hosting companies have a backdoor password and rarely do they bother to individualize it to each server. Thus making it a "master" backdoor password. So what's your issue with that?

Re:tip of the ice berg - not even the real story!

[SomethingOrOther]

That's like a lessee changing the locks and locking a landlord out of their apartment.

I can assure you, this is quite normal and perfectly legal behaviour in the UK and indeed, much of Europe. Whilst you are renting, you have exclusive access, and the landlord would be committing an act of trespass if they entered your apartment without your permission and 24hrs notice. (Except in an emergency obviously).

In some parts of Scotland, the landlord might also get a smack in the mouth into the bargain :-)

Similarly, I can think of plenty of examples where only exclusive access to a hosted server would be acceptable (perhaps even legal), due to strict security or data protection requirements.

Re:$15000 USD????

[Anonymous Coward]

Yes, you can do all of that with bitcoins. Just follow these steps:

1) you need to already have bitcoins. If you don't have any bitcoins, you can go to one of the sites that will convert dollars into bitcoins.
2) When you want to buy lunch/gas/videogame/whatever, go to one of the sites that will convert bitcoins into dollars, and convert your bitcoins to dollars.

Re:So, to sum up...

[Anonymous Coward]

You can use them to pay taxes, snort cocaine, or wipe your ass. That's three more things than bitcoins are good for.

References people, references!

[ashpool7]

http://status.linode.com/2012/03/manager-security-incident.html

Re:So, to sum up...

[nedlohs]

So in say 2008 in Zimbabwe you seriously think US dollars were less valuable than Zimbabwe dollars just because the government said Zimbabwe dollars were the national currency?

If every retailer on the planet took Bitcoin then all your local retailers would. So how would they be less valuable than the national currency?

Sure it's an illiquid market and you'd be silly to mark to market a large number of them at whatever the most recent trade was priced at and declare that that is what they are worth. But that's not the same as being worthless.

I have a 1 ounce silver round on my desk - I couldn't use it at the grocery store, I couldn't pay my taxes with it, it's completely useless to me aside from being the paper weight it's acting as. But that doesn't make it worthless - it's worth whatever I can find someone else to pay for it - most likely about $25 these days (it's not exactly pristine given it serves as a card protector in poker games when it isn't a paper weight and isn't in plastic or anything).

Re:Free Insurance

[bmo]

Oh, look, it's reductio ad absurdum *and* a strawman *and* a false dichotomy all in one neat little package!

Always the libertarian argument: Less regulation is ALWAYS good, and ANY regulation means TOTAL FASCISM and NO MIDDLE GROUND AT ALL.

--
BMO

How to covert bitcoins to hard currency

[yukk]

1. Generate bitcoins.
2. Hack in and steal bitcoins.
3. Sue for real money.
4. Profit!

Claim settlement difficulties

[tlambert]

Might be a bit difficult to find someone who even would insure their bitcoin balance, not to mention the difficulties that would probably arise if a claim was filed. Fortunately, in this case the operators of the services are absorbing the lose and their customers/clients are not directly affected.

It should be easily settled by converting real dollars into BTC.

I head about 3000 BTC has coincidentally just become available on the market, which if they put up the US$15,000 to buy them, should cover the "stolen" BTC.

1. Mine a bunch of BTC
2. Fake an online break-in and theft
3. Sell the not really stolen property to the entity who has to replace it, using an untraceable currency
4. Profit!

PS: There is no ???? step when it comes to insurance fraud, it's a rather well researched field.

-- Terry

Re:Free Insurance

[bill_mcgonigle]

Oh, look, it's reductio ad absurdum *and* a strawman *and* a false dichotomy all in one neat little package!

Oh, look, a list of fallacies with no backing - always a strong argument!

Go ahead, though, propose a mechanism where legal responsibility for lost revenue doesn't raise prices. Show me the magic money.

Always the libertarian argument: Less regulation is ALWAYS good, and ANY regulation means TOTAL FASCISM and NO MIDDLE GROUND AT ALL.

No, more customer regulation is a great thing. See GoDaddy/SOPA for how this works.

Re:$15000 USD????

[shaitand]

I can, there is a little cafe down the street that takes Bitcoin. In our office Bitcoin is also the typical method of settling a shared check for lunches. You can also conduct all manner of black market trade with Bitcoin. Drugs, guns, prostitutes, all on the table. Or you can just turn it into your local currency to conduct business.

Bitcoin has plenty of uses. It doesn't have to be used as a drop in replacement for us dollars.

Re:$15000 USD????

[Dahamma]

So basically they are NOT a currency at all.

They are about as much "currency" (defined as "a widely accepted medium of exchange") as cancelled postage stamps or baseball cards.

Re:FTFY

[Black Parrot]

I've just met a bunch of people who proclaim their utopian ideas of the world being better who would screw you and your aged grandmother in a heartbeat.

You missed the fine print: they think their ideas would make the world better for them.

(Though I've never met one who wasn't delusional, thinking he - always a he - has enough money or influence to come out ahead in a free-for-all society.)

Correction to "the real truth"

[subreality]

Actually, pool users aren't losing anything. The "hot" wallet stored at Linode was only the daily-use petty cash fund used for routine payouts. The bulk of the pool's balance is in "cold" storage and was not affected, so it's not like they were cleaned out. They got the register at the front, but not the safe in the back.

The owner of the pool, Slush, is covering the losses out of pocket, so nobody is losing anything except him.

The same story (though with a larger "hot" wallet) is happening over at Bitcoinica as well.

Re:$15000 USD????

[vipvop]

Dear god your office sounds horrible, and you must live in an insufferable city. If my coworkers wanted to settle a check with bitcoins, I'd lobby to get them fired. Do they all like Ron Paul too?

Re:$15000 USD????

[repapetilto]

Here is a place that accepts bitcoins for videogames:
http://gamerkeys.net/

Here is an ebay-like auction site:
http://bitmit.net/en/shop/c/13-pc-and-video-games/2-pc-games

There are no chargebacks with bitcoins, so you need to do research on the rep of various sellers and merchants. You save money on fees you would otherwise pay to cover chargebacks, etc.

Re:$15000 USD????

[Dahamma]

Yep, gold is not a currency either. Hasn't been in a while. Now it's mostly a commodity traded on the market like other commodities. I think I'd prefer to trade in gold than freaking bitcoins, though.

Re:So, to sum up...

[Anonymous Coward]

and i've met exactly zero people in life who will pay real money for comic books. so what? just because i don't hang out in the comic book collectors circle, doesn't mean they don't exist. i know that if i go looking for them, i'll find them.

same idea applies to bitcoin - if you go looking for people who will pay real money for bitcoins, you will find them. just like comic books, it is a niche market, and a 'random joe on the street' is not likely to be part of the niche.

Re:$15000 USD????

[Dunbal]

or gold

Not true. I bet you in 10,000 years if the human race is still around, gold will still be tradeable for anything used as a form of currency anywhere on the planet. Bitcoins? LOL. People are quick to point out how worthless they think gold is. Not one of them would pass up the opportunity to grab a bunch of gold coins if they were just lying there. Why? Because they recognize the value. They just don't want to admit it. The value of gold is not in the gold itself, it's in the fact that everyone on the planet is taught from an early age that it has value.

Bitcoin enthusiasts

[dadioflex]

are really starting to sound a lot like gold/silver bugs do on the investment forums. I'm invested in uranium exploration, oil exploration and undersea exploration companies and I suspect they are no more safe an investment that Bitcoin, or (right now) gold and silver. But damn, you don't hear me frothing at the mouth every time someone starts talking about BP or Fukushima. Fact is, the value of my risky investments and Bitcoin can both flat-line - if you're not prepared to accept that, then you shouldn't be investing either real money, or your time and energy in it. But honestly, best of luck to Bitcoin - I find the experiment at turns fascinating and ridiculous, but it never fails to entertain.

Re:Bitcoin enthusiasts

[Sycraft-fu]

Well there's two problems with bitcoins that make them more open to people to be stupid about.

One is that they are so easy to get in to. Anyone can buy in for a low price, and you can actually "mine" your own with a computer. You see it on hardware forums all the time, people looking to drop a grand on hardware to "make money" mining bitcoins.

The other is that there are more than a few True Believers(tm) who think this will be The Next Big Thing in currencies. They read Cryptonomicron and think it is a prediction, not science fiction, and see bitcoins as the digital currency from that novel made real. So they have an investment in it past just attempting to make money. They are emotionally invested in its success.

It's also really well regulated at casinos

[Sycraft-fu]

At least US ones. The gaming commission of the various states that engage in it checks to make sure payouts are as required. They catch any tampering with it, there is hell to pay.

In the case of physical game (like Roulette) there are possibilities for some strange streaks, the overall payout is regulated by payout vs probability (like every number has a 1/36 probability of occurring but a bet on any number pays only 34:1) but on machine games it is regulated even tighter. The machines have specific percentages they are expected to pay out, and there's also usually regulation about how they have to make sure there are no long losing streaks (that's what "progressive" slots are). So they don't just check the odds on those, but can make sure of things like "Machine A paid out precisely 95% of the money it took in."

Casinos are just the entertainment industry. They don't take any risks, and they don't even pretend to (all the odds are 100% known to you, as to them). It is just people seem to like the thrill of the chance of winning. Some people DO win big, and that tiny chance is enough to make people enjoy the thrill of playing.

They have to man

[Sycraft-fu]

If the people who play with Bitcoins don't keep making headlines and hype, they face the very real possibility of their "investment" going down to zero. They are not catching on as use as a general currency. You can't go spend BTC at Newegg or Amazon or the like. So they have to keep new people interested to keep this going. Otherwise nobody will want to buy BTC meaning the value will effectively be zero. You'd still be able to trade them among people who take them, but since that is almost nobody it gets you nothing.

Re:$15000 USD????

[M. Baranczak]

You can also conduct all manner of black market trade with Bitcoin. Drugs, guns, prostitutes, all on the table.

I would really like to see the prostitute who takes bitcoins.

No, on second thought, I would really not like to see the prostitute who takes bitcoins.

Re:Free Insurance

[bmo]

> let's make ISP's fully responsible for all incidental and consquential damages.

Strawman: Hi, you didn't say this, but I'm going to say that you want to have ISPs responsible for content and then I'm going to attack it.

False dichotomy: "obviously" some regulation leads to regulation of everything down to the most minor minutia, implying that you can either have no regulation at all or intrusive regulation, excluding the middle.

Reductio ad absurdum: "I'm going to take what you said and invent a mythical case (ISPs responsible for content) that would never exist in reality and somehow this is proof of something"

All three of these are related. Can you guess how?

In case you can't, I'll put it in simple terms: You are putting words in the parent's mouth that were never said. In even simpler terms, it's a lie.

>Calling you out on bullshit isn't allowed

Oh yes it is.

Good Day.

--
BMO

And in terms of their digital currency

[Sycraft-fu]

It is stored on secure systems which are more importantly tracked and audited. It is true most currency these days is just an entry in a digital system. It is much more convenient that way. However it isn't like it is just in some excel spreadsheet and if that sheet goes away the money is gone. It is on special system, and is very well accounted for. When money gets transfered bank to bank it is carefully tracked. At the immediate level it happens via some system like ACH, which itself is monitored and tracked, but that is just the banks chattering basically. Bank A says "You have $5000 more to go in to account X," and Bank B says "I now have $5000 more in that account," and balances are updated accordingly. However that is the banks loaning money, more or less. The actual transfer takes place on the fedwire later which is watched by the federal reserve, as the name implies.

Banks keep careful track of their digital currency, just like their physical currency. It isn't just having secure systems, it is having auditing and tracking. So if something unauthorized happens, it can be rolled back.

That's one of the big reasons to keep your money in a bank and not in a safe or something like that. You keep $10k in bills in a safe and someone steals it, it is gone, you are fucked. You keep $10k electronically in a bank and someone steals it, good chance the transaction can be reversed and you lose nothing.

Targeted attack

[bLanark]

I reckon this was a targeted attack.

There were at least two big bitcoin users with accounts there - if you actually RTFA, the biggest loss was 10,000 bitcoins (~45,000 USD) from Bitcoinica in addition to the 3,000 bitcoins from Palatinus.

If it was well-known, or could be easily discovered, that several bitcoin sites used the same hosting service, then that would be something worth breaking into, wouldn't it? Social attack, brute-force, some custom malware on a stick in the parking lot of the hosting site - it would be worth it to get your hands on big money.

Everyone should do their own research when choosing which hosting service to use (cost, uptime, features, history of security cock-ups), but it might also be worthwhile making sure no big players use the same host. If they do, then maybe avoid them and look at the next-best option.

Section 9: Limitation of Liability

[coldsalmon]

Like any vendor, Linode has included language in their contract which limits their liability. This is standard language, and it operates according to the following principal, which originated in landlord/tenant law: Linode has no control over the value or sensitivity of the property that you store on its site, so you must get insurance against the loss of this property yourself. No landlord/host wants to act as an insurance company, and they are in no position to do so. I can put anything I want in a rented space; it could be a $5,000,000.00 supercomputer, or a $30,000,000.00 Van Gogh. If there is a leak in my landlord's roof and a drop of water destroys the supercomputer, I must look to my own insurance policy, because I am the one why owns this property. If I want to store $15,000 in cash, I am not going to rent a storage unit and leave it lying all over the floor (the equivalent of what these Linode users did). I am going to put it in a BANK, which is a business specifically designed to store one type of thing, and which provides insurance against its loss.

Here's a link to the TOS: http://www.linode.com/tos.cfm

THIS POST DOES NOT CONSTITUTE LEGAL ADVICE OR CREATE AN ATTORNEY-CLIENT RELATIONSHIP. ANY LEGAL ADVICE MUST BE TAILORED TO YOUR INDIVIDUAL NEEDS BY AN ATTORNEY LICENSED IN YOUR JURISDICTION.

Re:$15000 USD????

[s73v3r]

And this right here is why Bitcoin is going to struggle to take off. Very few people want to actually go through the trouble to do this just to spend some money.