12 ms·

Bitcoin Payment Processor BitPay Loses $1.8M in Phishing Hack

40 points by BallinBige 11y ago

dbot 11y ago
The legal case about whether the insurer must pay the claim is pretty interesting. The insurer's position is that hack was pure social engineering and that no systems were compromised - everything operated as it should. That's correct, but the effect was the same as a system hack.
- em3rgent0rdr 11y ago
  Seems like someone needs to develop a "Social Engineering" insurance.
  - aianus 11y ago
    Oops, I got socially engineered and sent all my money to this Bitcoin account that totally doesn't belong to me or my brother in law wink. Please double me up, Mr. Insurer. Come on.
    - eli 11y ago
      Insurance fraud is a crime. They already insure against technical hacks, which I would think would not be much harder to fake if you wanted to.
      - aianus 11y ago
        Crime or no crime, if you make something profitable and easy to get away with, people will do it. For all we know, this was an instance of insurance fraud. I wouldn't touch insuring Bitcoin hot wallets with a twelve foot pole. Cold storage, maybe, but only if I had my experts set it all up and maintained control over all private keys.
  - zekevermillion 11y ago
    Big moral hazard problem. I'm sure someone would write a policy that covers social engineering attacks (and I would say arguably the Hartford policy also should cover this loss). But the loss limit, as with the Hartford policy, would be so low compared to the risk as to render it largely useless. I mean come on, I have a higher loss limit on my freakin car insurance than BitPay has to cover their hot wallet balance. To date, as far as I am aware, insurers will only write policies to cover small losses on hot wallet balances. Most of the big exchanges and processors are probably well-capitalized enough that they could in effect self-insure against such a loss. And the larger magnitude risk of a deeper-level intrusion, or flat out physical robbery of the private key components for cold wallets, is not insurable.
- zekevermillion 11y ago
  The insurer made some arguments that seem weak, for example that the policy protects against the theft of money from "inside" the building but that the stolen bitcoin was stored "on the web" and therefore not in the building and not a covered loss. This shows to me that buying insurance on bitcoin hot wallet balances is more of a marketing ploy than any substantive protection. The coverage amount is negligible, and the insurer has no intention of paying out in the most likely type of breach (social engineering attack).
- flatline 11y ago
  It could very well be an exit scam - I wouldn't want to cover it as an insurer, either. "Hey, I screwed up and sent this money to the wrong party!" without any way to show that you are not in fact still in control of the money through some means. Hacking into your own system puts a much higher barrier on orchestrating such a scam.
snitko 11y ago
I know it's kind of sad and I honestly wish all the luck to the BitPay guys - it's not an easy situation. However, this is why we've built Mycelium Gear: we don't hold merchant's money at all and anyone who wants to accept Bitcoin and cares about privacy and security should consider using it: https://gear.mycelium.com https://gear.mycelium.com
- adrianmacneil 11y ago
  This doesn't really have anything to do with holding customers funds, given that this attack was related to OTC Bitcoin trading.
weavie 11y ago
You would have thought they would have had systems in place to ensure that it would take more than just a simple email from the boss to transfer thousands of bitcoins.
- aianus 11y ago
  This. This has little to do with social engineering and the compromised email account and everything to do with a company where standard operating procedure is to manually send $700,000 around based on an email.
em3rgent0rdr 11y ago
I've used bitpay and liked their service. Seems like these social engineering hacks can happen to most anyone. Although Im suprised such emails wouldnt require a two-factor authenitication or at least a PGP-signature.
- Vespasian 11y ago
  As said in another comment, phishing can circumvent 2fa (just phish the code as well).
  - Sanddancer 11y ago
    2fa doesn't necessarily have to be something online. For quarter million dollar transfers, it could, and probably should, require some steps of offline verification, like needing the CFO to sign off on it too, or a quick phone call to make sure everything is on the up and up. Hell, the CEO shouldn't even be handling these transactions. I don't know of a single other place where the CEO would be this involved, especially if transfers of this size are "routine". This is just poor accounting top to bottom.
- jandrese 11y ago
  Good luck getting anybody else to use PGP. I've been trying for years and to date not a single person has ever sent me an encrypted email. The only company that bothers is Facebook, and I'm not sure their pilot program is going to last much longer.
  - flatline 11y ago
    For internal usage s/mime is not really that bad. Works fine with gmail. $25 a year gets you a personal cert. All my work email is encrypted. Bitpay is small enough to be able to do this without any extra infrastructure.
  - aianus 11y ago
    We use PGP for sensitive internal emails at Coinbase as well as for signing releases on some of our open-source client libraries. Keybase makes it pretty easy. You can see all of our keys here: https://keybase.io/coinbase https://keybase.io/coinbase
jostmey 11y ago
Theft has been a recurring problem with bitcoin and everyone ends up blaming the users or the institutions.
- adrianmacneil 11y ago
  To be fair, this isn't just a problem with Bitcoin. Spear phishing attacks leading to fraudulent wire transfers are fairly common.
  - pbreit 11y ago
    Bitcoin itself does have a mechanism to mitigate the risk: "2 of 3". As in, transfers require 2 out of 3 parties (or any n/n+m) to approve.
    - dogma1138 11y ago
      No it doesn't you can't choose not to "mine" a specific transaction, it requires other parties to "witness" it but not to approve it.
      - pbreit 11y ago
        OK. I guess I don't understand then what multisig is all about. My impression was that it could be set up to require 2 parties to authorize a transaction.
        dogma1138 11y ago
        It can require more than 1 "key holder" to initiate a transaction, Bitcoin supports M of N it's just like splinting the private key between a number of people. Once it's out its out, with normal transactions both parties can hold, revoke, and reverse a transaction this doesn't work with Bitcoin. It doesn't matter into how many keys you split your private key it's still a single entity even if within the organization there will be more than 1 person needed to authorize it.
      - 11y ago
iLoch 11y ago
So many screw ups here because of bad or no company policy. It's hard to feel bad for these guys. No live/voice confirmation between the CEO and CFO during the transfer of $700,000 worth of Bitcoins? No confirmation with the purchaser? No two factor authentication on their Google accounts? Sorry for your loss BitPay, but that's on you.
- rememberlenny 11y ago
  The phishing attack on the CEO to sign in to "google docs" subverts two factor.
  - iLoch 11y ago
    How? That's exactly what it's for. The attacker would attempt to sign in on their machine and would be prompted to enter a code.
    - adrianmacneil 11y ago
      2 factor doesn't protect against phishing. It's trivial for a phishing site to ask for a 2fa code, and then immediately use that to sign in on your behalf.
      - philrapo 11y ago
        that's why you always voice confirm...
      - ryan-c 11y ago
        Have you ever seen a phishing attack that actually asks for and uses the two factor auth code? I don't deny that this is possible, I've just never seen it.
        eli 11y ago
        Not only is it possible, it really isn't very hard to execute. It takes some basic web programming skills. It's been seen in the wild: https://www.schneier.com/blog/archives/2009/09/hacking_two-fac.html https://www.schneier.com/blog/archives/2009/09/hacking_two-f...
Axsuul 11y ago
Been going through their compliance process recently and all of a sudden no response. Looks like they have their hands full. Can anyone recommend any alternatives to BitPay?
- Mahn 11y ago
  Coinbase is often recommended as a BitPay alternative. Unlike BitPay it's not a specialized processor but an online wallet, but much like PayPal you can use it to collect payments as well.
devit 11y ago
1. CFO is using Gmail without 2-factor authentication 2. CFO enters his Google credentials on a random website 3. CEO takes CFO e-mail as valid without checking for the existence and verifying a PGP signature 4. CEO sends Bitcoin for an existing customer to a new address he got by e-mail rather than to the established one On the positive side, the CEO eventually sought confirmation from the customer.
mindcreek 11y ago
I don't believe the story.

40 points by BallinBige 11y ago

dbot 11y ago

The legal case about whether the insurer must pay the claim is pretty interesting. The insurer's position is that hack was pure social engineering and that no systems were compromised - everything operated as it should. That's correct, but the effect was the same as a system hack.

em3rgent0rdr 11y ago
Seems like someone needs to develop a "Social Engineering" insurance.
- aianus 11y ago
  Oops, I got socially engineered and sent all my money to this Bitcoin account that totally doesn't belong to me or my brother in law wink. Please double me up, Mr. Insurer. Come on.
  - eli 11y ago
    Insurance fraud is a crime. They already insure against technical hacks, which I would think would not be much harder to fake if you wanted to.
    - aianus 11y ago
      Crime or no crime, if you make something profitable and easy to get away with, people will do it. For all we know, this was an instance of insurance fraud. I wouldn't touch insuring Bitcoin hot wallets with a twelve foot pole. Cold storage, maybe, but only if I had my experts set it all up and maintained control over all private keys.
- zekevermillion 11y ago
  Big moral hazard problem. I'm sure someone would write a policy that covers social engineering attacks (and I would say arguably the Hartford policy also should cover this loss). But the loss limit, as with the Hartford policy, would be so low compared to the risk as to render it largely useless. I mean come on, I have a higher loss limit on my freakin car insurance than BitPay has to cover their hot wallet balance. To date, as far as I am aware, insurers will only write policies to cover small losses on hot wallet balances. Most of the big exchanges and processors are probably well-capitalized enough that they could in effect self-insure against such a loss. And the larger magnitude risk of a deeper-level intrusion, or flat out physical robbery of the private key components for cold wallets, is not insurable.
zekevermillion 11y ago
The insurer made some arguments that seem weak, for example that the policy protects against the theft of money from "inside" the building but that the stolen bitcoin was stored "on the web" and therefore not in the building and not a covered loss. This shows to me that buying insurance on bitcoin hot wallet balances is more of a marketing ploy than any substantive protection. The coverage amount is negligible, and the insurer has no intention of paying out in the most likely type of breach (social engineering attack).
flatline 11y ago
It could very well be an exit scam - I wouldn't want to cover it as an insurer, either. "Hey, I screwed up and sent this money to the wrong party!" without any way to show that you are not in fact still in control of the money through some means. Hacking into your own system puts a much higher barrier on orchestrating such a scam.

snitko 11y ago

I know it's kind of sad and I honestly wish all the luck to the BitPay guys - it's not an easy situation. However, this is why we've built Mycelium Gear: we don't hold merchant's money at all and anyone who wants to accept Bitcoin and cares about privacy and security should consider using it: https://gear.mycelium.com https://gear.mycelium.com

adrianmacneil 11y ago
This doesn't really have anything to do with holding customers funds, given that this attack was related to OTC Bitcoin trading.

weavie 11y ago

You would have thought they would have had systems in place to ensure that it would take more than just a simple email from the boss to transfer thousands of bitcoins.

aianus 11y ago
This. This has little to do with social engineering and the compromised email account and everything to do with a company where standard operating procedure is to manually send $700,000 around based on an email.

em3rgent0rdr 11y ago

I've used bitpay and liked their service. Seems like these social engineering hacks can happen to most anyone. Although Im suprised such emails wouldnt require a two-factor authenitication or at least a PGP-signature.

Vespasian 11y ago
As said in another comment, phishing can circumvent 2fa (just phish the code as well).
- Sanddancer 11y ago
  2fa doesn't necessarily have to be something online. For quarter million dollar transfers, it could, and probably should, require some steps of offline verification, like needing the CFO to sign off on it too, or a quick phone call to make sure everything is on the up and up. Hell, the CEO shouldn't even be handling these transactions. I don't know of a single other place where the CEO would be this involved, especially if transfers of this size are "routine". This is just poor accounting top to bottom.
jandrese 11y ago
Good luck getting anybody else to use PGP. I've been trying for years and to date not a single person has ever sent me an encrypted email. The only company that bothers is Facebook, and I'm not sure their pilot program is going to last much longer.
- flatline 11y ago
  For internal usage s/mime is not really that bad. Works fine with gmail. $25 a year gets you a personal cert. All my work email is encrypted. Bitpay is small enough to be able to do this without any extra infrastructure.
- aianus 11y ago
  We use PGP for sensitive internal emails at Coinbase as well as for signing releases on some of our open-source client libraries. Keybase makes it pretty easy. You can see all of our keys here: https://keybase.io/coinbase https://keybase.io/coinbase

jostmey 11y ago

Theft has been a recurring problem with bitcoin and everyone ends up blaming the users or the institutions.

adrianmacneil 11y ago
To be fair, this isn't just a problem with Bitcoin. Spear phishing attacks leading to fraudulent wire transfers are fairly common.
- pbreit 11y ago
  Bitcoin itself does have a mechanism to mitigate the risk: "2 of 3". As in, transfers require 2 out of 3 parties (or any n/n+m) to approve.
  - dogma1138 11y ago
    No it doesn't you can't choose not to "mine" a specific transaction, it requires other parties to "witness" it but not to approve it.
    - pbreit 11y ago
      OK. I guess I don't understand then what multisig is all about. My impression was that it could be set up to require 2 parties to authorize a transaction.
      - dogma1138 11y ago
        It can require more than 1 "key holder" to initiate a transaction, Bitcoin supports M of N it's just like splinting the private key between a number of people. Once it's out its out, with normal transactions both parties can hold, revoke, and reverse a transaction this doesn't work with Bitcoin. It doesn't matter into how many keys you split your private key it's still a single entity even if within the organization there will be more than 1 person needed to authorize it.
    - 11y ago

iLoch 11y ago

So many screw ups here because of bad or no company policy. It's hard to feel bad for these guys. No live/voice confirmation between the CEO and CFO during the transfer of $700,000 worth of Bitcoins? No confirmation with the purchaser? No two factor authentication on their Google accounts? Sorry for your loss BitPay, but that's on you.

rememberlenny 11y ago
The phishing attack on the CEO to sign in to "google docs" subverts two factor.
- iLoch 11y ago
  How? That's exactly what it's for. The attacker would attempt to sign in on their machine and would be prompted to enter a code.
  - adrianmacneil 11y ago
    2 factor doesn't protect against phishing. It's trivial for a phishing site to ask for a 2fa code, and then immediately use that to sign in on your behalf.
    - philrapo 11y ago
      that's why you always voice confirm...
    - ryan-c 11y ago
      Have you ever seen a phishing attack that actually asks for and uses the two factor auth code? I don't deny that this is possible, I've just never seen it.
      - eli 11y ago
        Not only is it possible, it really isn't very hard to execute. It takes some basic web programming skills. It's been seen in the wild: https://www.schneier.com/blog/archives/2009/09/hacking_two-fac.html https://www.schneier.com/blog/archives/2009/09/hacking_two-f...

Axsuul 11y ago

Been going through their compliance process recently and all of a sudden no response. Looks like they have their hands full. Can anyone recommend any alternatives to BitPay?

Mahn 11y ago
Coinbase is often recommended as a BitPay alternative. Unlike BitPay it's not a specialized processor but an online wallet, but much like PayPal you can use it to collect payments as well.

devit 11y ago

1. CFO is using Gmail without 2-factor authentication 2. CFO enters his Google credentials on a random website 3. CEO takes CFO e-mail as valid without checking for the existence and verifying a PGP signature 4. CEO sends Bitcoin for an existing customer to a new address he got by e-mail rather than to the established one On the positive side, the CEO eventually sought confirmation from the customer.

mindcreek 11y ago

I don't believe the story.