Slashdot Mirror
DNS Hijack Leads To Bitcoin Heist
First time accepted submitter FearTheFez writes "Social Engineering and poor DNS Security lead to a Bitcoin heist worth about $12000. Bitcoin broker Bitinstant was robbed after thieves managed to take over ownership of their domains. While Bitinstant claims that no customers lost any money, without 2 factor authentication all it took was a place of birth and a mothers maiden name to gain access. This looks like poor security from everyone involved."
I'm waiting to see whether or not someone would be convicted for stealing bit coins as no court or official government body recognizes them as being a legitimate currency. A case in this would lead to an interesting de-facto precedent being set.
Bitinstant's mother. She knows both her maiden name and his birthdate, probably.
DO NOT WANT!
All they lost were bitcoins!
If a standard currency exchange was robbed for $12,000 we would not even read the story. This is a trivial crime and of little interest. It serves more as a warning rather than as a bank robbery story. I hope that those that are concerned learn from this but if this is the crime of the century in the Bitcoin world then they are doing really well.
I love stacking my barbecues in the shed at the end of summer - you can't beat a bit of grill on grill action.
I don't know how bitcoins work; but don't they have serial numbers? Isn't there some way for the original owners to say something like, "153545FDCEAB-35353ABD-01 is hot" and publish that to a public list?
On my ranking site (Gibson Index), I rated this a Level Three Attack, but I think the submitter is wrong to say there was poor security. By all accounts, if they were any less secure, they would have lost tens of thousands more. It just happened that *one* of their exchange accounts did not have 2FA, because they weren't aware that that vendor had added support for it.
BitInstant's full blog post has more details: http://blog.bitinstant.com/blog/2013/3/4/events-of-friday-bitinstant-back-online.html
See subject.
Nothing to see here. Move along.
I've heard a few people with bitcoins complaining about how they can't do anything with them and they're locked in. Apparently there's an online store that catalogs all the stuff you can buy all over the place, with bitcoins . . . and it looked to me like the kind of shitty collection of stuff you'd expect at a flea market. High priced low-end windows laptops and speaker wire and shampoo and shit.
You talk here about theft worth only 300 BTCs or 12 000$
Well, I can only conclude that overall BTC security maybe has improved. Recall previous thefts worth of 25 000 BTC or 500 000$ (at that time) or 18 547 BTC or 87 000$ (at that time).
Why such conclusion? Well, if those evil people started to go after such low-profile target, it *can* mean that all high profile targets have adequate security.
#
#\ @ ? Colonize Mars
#
Social Engineering and poor DNS Security lead to a Bitcoin heist worth about $12000.
Bitcoins have a number of fundamental problems, such as determining in advance there are only going to be a finite number and naming that number to begin with guarantees the currency will be worthless. The amount of currency in an economy needs to be able to increase or deflation makes the currency so valuable that it becomes impossible to buy anything, and the common people won't have any money. Imagine if today, the government required everyone to turn in their cash, and they started issuing only $10,000 bills...
Customer: How much is that loaf of bread?
Clerk: Two ninety five.
Customer: The smallest thing I have is a $10,000 bill. Can you break it?
Clerk: No. The ten-gee note is the smallest thing there is.
Customer: So why are you open, there's nothing in the store that is anywhere near $10,000?
Clerk: That's a good point. Get out, we're closed. Or fuck it, stay. I quit, since I'm not getting paid anyway...
If you're having trouble understanding this, go try to buy a single piece of spaghetti. Or try to buy 1mL of plain drinking water. Instead of a box of them, try to buy one Cheerio. You can't, because in the first place, they're not for sale individually, and in the second, either would be about a tenth or a hundredth of a cent, and the smallest unit of modern American hard currency is the penny, $0.01. Bitcoins (if they were really worth anything,) would have the same problem with real-world products.
Also, weren't Bitcoins supposed to be resistant to the problems of that... ugh... real-money? Seems they're really not, are they.
It is a fun idea in theory, but it the real world, it's just not practical or sensible to have some random schmuck just make up his own currency, without it being exchangeable for some valuable commodity, or a service of some kind.
It's so quaint when people pretend Bitcoins are actually worth something. Mod me down, but what I've written will still true. It's a made up, bullshit, nonexistent currency - might as well be Angelbucks or Devildollars. It's not worth shit.
Of course you could make the same argument (and many have) about US Dollars, since they're "not based on or backed by anything," but the difference is that for starters, you can pay your tax-bill in dollars. Got a speeding ticket? Try paying that shit with Bitcoins. Just try it. Drop me a line from jail, let me know how it goes. The US dollar is coin of the realm (in the US and a few other places) and THAT'S why it's worth something, because people will accept it; you can buy stuff with them. Some countries have experienced runaway inflation where you needed a trillion units of it to buy a loaf of bread, and it has to be redenominated and re-redenominated, and it still descends into worthlessness. It can be argued that THAT currency is worthless, but shit, man, it's still legal tender in that country. Wrangle enough of them together and you can buy something. It might take a wheel-barrow full of them to buy a loaf of bread, but you can still buy a loaf of bread.
Anyone with any brains would accept payment for a job in fucking Trident Layers (TM) before accepting Bitcoins. It's not trolling if what you say is true, anymore than it would be mean to tell Mitt Romney he's not president because too many people thought he was a rich, arrogant, fucking robotic asshole from another planet. It might not be nice, but damn it, it's the truth!
Robbery is using violence or intimidation to take anothers property.
Social Engineering plus stealing is not robbery.
gets more like a Charlie Stross novel. Sigh.
Do people really use this stuff in place of real money? I'll keep my real cash thanks... And as the world's currencies (particularly the dollar) are being intentionally devalued, I'll hang on to my precious metals.
Mothers maiden name: 9zimu8sj4q99uf
Place of birth: wj9awitkj4girc
If you use real details, you're a fool.
Waterfox - a Firefox fork with legacy extension support, security updates and better privacy by default.
what actually happens in this type of incident? from what i read, the bitcoin is supposed to be tied to your secret keys and whatnot. so what do they actually steal from the "broker"?
One of the thieves was later seen at the racetrack, trying to put down 1024 bitcoins on a horse in the third race.
He was apprehended and later sentenced to 10 years of ridicule without possibility of parole.
You are welcome on my lawn.
This looks like poor security from everyone involved.
This is perhaps arguable in the case of VirWox, the exchange used to move the money out of the account. According to the article, VirWox has offered two factor authentication since September of last year. The fact that BitInstant didn't use it allowed the attackers to succeed with the heist. I say arguable because two factor authentication should probably be mandatory for anything that involves monetary transactions.
'The tyrant will always find pretext for his tyranny.' - Aesop's Fables
One way of doing it is to use somebody else's info for password reset so you can remember what you entered. Maybe you pick John Kennedy. You'd enter Kennedy's mother's maiden name, Kennedy's dog's name, etc. That way anyone impersonating you by entering your data doesn't get in, but you don't have to remember nonsense answers.
Believe it or not that was only approximately 266 bitcoins.
what about MMO games where you can take stuff form others as part of game play and let's say there are 3rd party sellers in game that lets you buy stuff with cash and also sell stuff for cash?
How will the courts look at that?
Some one can say Bitcoin is a game with real cash stores as part of it.
This is not a problem of Bitcoin, but of the site that got robbed. They should increase their security! Begin using Bitcoins here - http://thebitcoinmaster.blogspot.com
It is not the data that is being stolen. Data is just bits and bytes, kilobytes etc. of ones and zeroes.
What APPEARS AS being stolen is the information encoded within the data.
What is actually happening is UNAUTHORIZED ACCESS. Possibly unauthorized dissemination of information, revealing of trade and other secrets etc. IF the information is relayed to a third party.
It helps if you think of it as a case of early 20th century spying.
A spy intercepts and reads an enciphered radio transmission - he has the data but no information. Information gets to its intended recipient, clearly not stolen.
A spy deciphers the transmission - he has access to what he was actually after. The information.
Information still gets to its intended recipient, still not stolen, BUT - the spy above has also had access to information.
So far, all that the spy is guilty of is unauthorized access.
If and when he delivers the information to the third party, then he is guilty of various other things. None of them being stealing.
You can absolutely steal data. If you steal someone's debit card and buy a bunch of stuff with it, you have stolen data that allowed you to gain access to their bank account. Someone else ends up losing the stolen dollars you used.
That is not stealing data.
That is stealing a physical object, a debit card, THEN using it without authorization to gain access to the bank account, THEN stealing the money from the account.
No data was stolen. No, not even when the money was stolen in the end.
Data on the card was USED to access the bank account but it was not stolen - the CARD was stolen. And the money.
Same way you are not stealing the position of the teeth on a key used to open a safe - you are stealing a key.
Now, making a copy of the card or key - that's unauthorized copying OR just making a copy.
When you bring a "borrowed" key to a key copying store, the employee is not copying a key without authorization. He is just making a copy.
YOU are doing the unauthorized copying, but only if there is a specific rule prohibiting access to that key or making copies of it.
Same with the card.
Making a copy is unauthorized copying, accessing the account is unauthorized access, stealing money is stealing - but the card or the data were not stolen.
Money was.
Mit der Dummheit kämpfen Götter selbst vergebens
Amateur bankers hustled by trivial attack. Film at eleven.
what about MMO games where you can take stuff form others as part of game play and let's say there are 3rd party sellers in game that lets you buy stuff with cash and also sell stuff for cash?
How will the courts look at that?
Some one can say Bitcoin is a game with real cash stores as part of it.
MMO developers are adamant about retaining ownership any and all digital items in their game - you don't own the "Sword of Dragon-slaying Greatness" (or whatever..) you just have a license to access it. Selling an item that you don't own is iffy.
some games do have a in game store that they get a cut of the sales.
Now just saying a game maker can have all kinds of stuff in it but then what happens when that mixes with real laws out side of the game??
Let's say hacking is part of the game but let's just say the game makes messed up and you can get into people real data or a in game hack ends up taking down a sever.
But if you use the same person's data for every site you still have the problem of a hacker being able to use the information from one of the sites to get into all of the others.
You can shop for anything online using http://bitspend.net/
Amazon, newegg, ebay, department stores, etc.
You can get a US Dollar-denominated Mastercard debit card from http://www.okpay.com/en/services/accept-payments/index.html
and fund it with bitcoins.
Examples of data would be: 5, $, B, T, C. Meaningless values. 5 of what? How much IS 5? What does $ signify? Or B?
Examples of information would be: $5, BTC5 - data encoded with meaning. 5 dollars. 5 BitCoins.
KNOWING which one of those is worth more would be knowledge.
Wisdom would be using that knowledge to achieve something. Some form of advantage or additional value.
http://en.wikipedia.org/wiki/DIKW_Pyramid
Mit der Dummheit kämpfen Götter selbst vergebens