5 ms·

Theft has been a recurring problem with bitcoin and everyone ends up blaming the users or the institutions.

by jostmey 11y ago

adrianmacneil 11y ago
To be fair, this isn't just a problem with Bitcoin. Spear phishing attacks leading to fraudulent wire transfers are fairly common.
- pbreit 11y ago
  Bitcoin itself does have a mechanism to mitigate the risk: "2 of 3". As in, transfers require 2 out of 3 parties (or any n/n+m) to approve.
  - dogma1138 11y ago
    No it doesn't you can't choose not to "mine" a specific transaction, it requires other parties to "witness" it but not to approve it.
    - pbreit 11y ago
      OK. I guess I don't understand then what multisig is all about. My impression was that it could be set up to require 2 parties to authorize a transaction.
      - dogma1138 11y ago
        It can require more than 1 "key holder" to initiate a transaction, Bitcoin supports M of N it's just like splinting the private key between a number of people. Once it's out its out, with normal transactions both parties can hold, revoke, and reverse a transaction this doesn't work with Bitcoin. It doesn't matter into how many keys you split your private key it's still a single entity even if within the organization there will be more than 1 person needed to authorize it.
    - adrianmacneil 11y ago
      http://bitcoin.stackexchange.com/questions/3718/what-are-multi-signature-transactions http://bitcoin.stackexchange.com/questions/3718/what-are-mul...
- dogma1138 11y ago
  It is but most financial organizations are under quite allot of regulation which means that they have internal and external processes to prevent these types of transactions from happening. You'll find it's very hard to fool a bank or a financial institution to authorize a transaction in this manner, it's still is possible under some cases but then you'll need much more information to do it to the point of it being an "insider fraud" than just phishing. Companies are still vulnerable to this sort of phishing you'll be surprised how many fake invoices are sent to large organizations and just how many of them end up being actually paid out. In most cases those invoices tend to fall under the "petty cash" category so they are often not very well checked and if you send out 500,000 invoices a year to companies even a small percentage of those being paid is still a nice take. Now back to financial organizations, you can't just make a transfer from bank a to bank b and expect it to work there will be huge scrutiny on even fairly small sums, yet alone millions, the funds will also be frozen for a quite long period of time (2-3 business days at the least) and in many cases will not be liquid for at least another such period. And most importantly regular bank transactions can be reversed and those which can't are insured. Bitcoin exchanges seem to be too cool to adopt the same level of regulatory mandated processes that even the smallest financial institution has to adopt. And the fact that pretty much not a single Bitcoin exchange is insured against fraud and the fact that bitcoin transactions are for the most part "anonymous" and there is no way to revoke, or reverse them means that even the smallest case of fraud can bring down the entire exchange.
Vespasian 11y ago
Bitcoin has many flaws but in this case some major screw ups within BitPay were the root cause of the theft. Analyzing these can help to prevent similar mistakes in the future. - Why was the Google Account of a CFO (of a financial organisation) not secured with 2fa (most likely) and if it was how could it be breached? - Why did the CEO just sent the money ("an hour later" suggests that no much research could be done)? - Why did he send it the second and third time and only then CC the "customer" company? - Was there a paper trail of the fake purchase (order / confirmation / invoice etc) and if yes how could it be forged if no why didn't it exist? I suppose there are some details missing in this article and the attack was probably sophisticated and well prepared, however this is something you have to prepare for. If you are a financial service dealing with substantial amounts of money you have a red mark painted on your back at all times and since trust (in you, your organization and the whole bitcoin community) is one of your major assets an incident like must not to be taken lightly (I don't think it will)
- TwoBit 11y ago
  I'm not sure 2 factor would help. The hackers could echo his 2 factor key he typed into their fake login page to the real login page.
Mahn 11y ago
Well, I'm not saying bitcoin is perfect or fit for mainstream usage for that matter, but for what is worth, that is bound to happen with anything digital. Security data breaches are a recurring problem for internet companies and services too.
- dogma1138 11y ago
  It's not about it being digital or not, it's about not having the same processes as other financial institutions that are meant to prevent and reduce the risk of fraud. You have for the most part armatures and an unregulated industry playing with millions without any checkpoints.

Theft has been a recurring problem with bitcoin and everyone ends up blaming the users or the institutions.

by jostmey 11y ago

Theft has been a recurring problem with bitcoin and everyone ends up blaming the users or the institutions.

To be fair, this isn't just a problem with Bitcoin. Spear phishing attacks leading to fraudulent wire transfers are fairly common.

pbreit 11y ago
Bitcoin itself does have a mechanism to mitigate the risk: "2 of 3". As in, transfers require 2 out of 3 parties (or any n/n+m) to approve.
- dogma1138 11y ago
  No it doesn't you can't choose not to "mine" a specific transaction, it requires other parties to "witness" it but not to approve it.
  - pbreit 11y ago
    OK. I guess I don't understand then what multisig is all about. My impression was that it could be set up to require 2 parties to authorize a transaction.
    - dogma1138 11y ago
      It can require more than 1 "key holder" to initiate a transaction, Bitcoin supports M of N it's just like splinting the private key between a number of people. Once it's out its out, with normal transactions both parties can hold, revoke, and reverse a transaction this doesn't work with Bitcoin. It doesn't matter into how many keys you split your private key it's still a single entity even if within the organization there will be more than 1 person needed to authorize it.
  - adrianmacneil 11y ago
    http://bitcoin.stackexchange.com/questions/3718/what-are-multi-signature-transactions http://bitcoin.stackexchange.com/questions/3718/what-are-mul...
dogma1138 11y ago
It is but most financial organizations are under quite allot of regulation which means that they have internal and external processes to prevent these types of transactions from happening. You'll find it's very hard to fool a bank or a financial institution to authorize a transaction in this manner, it's still is possible under some cases but then you'll need much more information to do it to the point of it being an "insider fraud" than just phishing. Companies are still vulnerable to this sort of phishing you'll be surprised how many fake invoices are sent to large organizations and just how many of them end up being actually paid out. In most cases those invoices tend to fall under the "petty cash" category so they are often not very well checked and if you send out 500,000 invoices a year to companies even a small percentage of those being paid is still a nice take. Now back to financial organizations, you can't just make a transfer from bank a to bank b and expect it to work there will be huge scrutiny on even fairly small sums, yet alone millions, the funds will also be frozen for a quite long period of time (2-3 business days at the least) and in many cases will not be liquid for at least another such period. And most importantly regular bank transactions can be reversed and those which can't are insured. Bitcoin exchanges seem to be too cool to adopt the same level of regulatory mandated processes that even the smallest financial institution has to adopt. And the fact that pretty much not a single Bitcoin exchange is insured against fraud and the fact that bitcoin transactions are for the most part "anonymous" and there is no way to revoke, or reverse them means that even the smallest case of fraud can bring down the entire exchange.

Vespasian 11y ago

Bitcoin has many flaws but in this case some major screw ups within BitPay were the root cause of the theft. Analyzing these can help to prevent similar mistakes in the future. - Why was the Google Account of a CFO (of a financial organisation) not secured with 2fa (most likely) and if it was how could it be breached? - Why did the CEO just sent the money ("an hour later" suggests that no much research could be done)? - Why did he send it the second and third time and only then CC the "customer" company? - Was there a paper trail of the fake purchase (order / confirmation / invoice etc) and if yes how could it be forged if no why didn't it exist? I suppose there are some details missing in this article and the attack was probably sophisticated and well prepared, however this is something you have to prepare for. If you are a financial service dealing with substantial amounts of money you have a red mark painted on your back at all times and since trust (in you, your organization and the whole bitcoin community) is one of your major assets an incident like must not to be taken lightly (I don't think it will)

TwoBit 11y ago
I'm not sure 2 factor would help. The hackers could echo his 2 factor key he typed into their fake login page to the real login page.

Mahn 11y ago

Well, I'm not saying bitcoin is perfect or fit for mainstream usage for that matter, but for what is worth, that is bound to happen with anything digital. Security data breaches are a recurring problem for internet companies and services too.

dogma1138 11y ago
It's not about it being digital or not, it's about not having the same processes as other financial institutions that are meant to prevent and reduce the risk of fraud. You have for the most part armatures and an unregulated industry playing with millions without any checkpoints.