4 ms·

I would be really interested to know how much a black-hat hacker could have stolen. I found this on the Overstock Wikipedia page [1]: > In the first 22 hours,

I would be really interested to know how much a black-hat hacker could have stolen. I found this on the Overstock Wikipedia page [1]: > In the first 22 hours, they received over 800 orders worth US $126,000 in bitcoin. This represents a 4.33% increase in sales from their normal income of $3 million per day. ... In mid-2014 Overstock.com announced that bitcoin sales were averaging $300,000 per month and that the company expected bitcoin sales to add 4 cents to the company's 2014 earnings per share. I can't find any recent information, but it might have slowed down since Bitcoin transactions are so expensive now. Overstock is also holding 50% of their Bitcoin revenue as an investment, but I presume that's in cold storage. If they were doing $10,000 USD per day in 2014, then I would guess they might be doing around $100,000 in 2018. So the refunds are probably coming out of some addresses that hold around $100,000 to $500,000 USD. Their Coinbase integration might have a daily buy limit of around $1M, or maybe even no limit. So a hacker could have stolen 6 or 7 figures, but probably no more than that. You could write a script to automate all of the orders and refunds. You could use Tor, or you could use Bitcoin to rent VMs and IP addresses, then connect to your VMs via Tor. I don't know if Overstock has CAPTCHAs, but that's not a big deal if you're making 4-5 figures per CAPTCHA. And finally, you just trade the stolen Bitcoin for Monero, then back to Bitcoin. The only thing you have to worry about is a guilty conscience. It's unclear if you could only use pre-fork transactions, or if you could spend the Bitcoin Cash from new blocks. If it's the latter, then you could just buy Bitcoin Cash using your refunded Bitcoin, and create/cancel orders in an infinite loop until you emptied their account. I find it very interesting that Bancsec specializes in bank security. It's probably a bit harder for JB Snyder to get away with something like this than your average software engineer, since the FBI and IRS are probably keeping an eye on him. He's also the founder of a very successful security company, so 6 or 7 figures probably isn't worth the risk. (And of course, he's probably a model citizen and a saint.) Anyway, it's not every day that you come across a virtual duffel bag with 6 or 7 figures of anonymous cash. I hope Coinbase or Overstock paid a bug bounty.

sillysaurus3 9y ago
The answer you're looking for is "Yeah, as much as people like to cry moral decay, honor is still a thing." You're right, there was no advantage to reporting the vuln. Most people would have jumped on that vuln like <edgy metaphor>. But "fuck you, got mine" mentality won't get us to Mars. And as stupid as it sounds, having a story to tell is at least partly as satisfying as doing the actual heist. Zero risk, and you get to brag how smart you were. People are also much more likely to trust you in the future (as opposed to you being an unknown quantity). Heists like that also punish the ecosystem. If Overstock lost $1m, it would forever show that moving to crypto is fundamentally a terrible idea. It would destabilize the basis of wealth you sought to acquire. But... Yeah, passing up a $1m payday would not be easy.
- nathan_f77 9y ago
  This would be pretty mild hack compared to all the other cryptocurrency hacks that have happened so far. There's the $30M Parity hack, $94M stolen from Bitfinex, $473M from Mt Gox, $5.1M from Bitstamp, $50M from DAO, $7M from CoinDash, $8M from Veritaseum, and $500k from Enigma. I'm probably missing a few big ones, and countless small ones. But a $1M Overstock hack would barely make the news, and would probably be covered by insurance. It's fun to think about all the people behind these hacks. JB Snyder could have been one of them, and we'd never know. A lot of them are probably just regular software engineers and security experts who stumbled onto these vulnerabilities. I think it's true that the "fuck you, got mine" mentality won't get us to Mars, but that's the motivation behind cryptocurrencies. We can't trust billions of strangers, but we can trust math and physics. Except, we already have systems that allow us to trust billions of strangers (governments and laws). Governments and banks could have reversed all of these transactions. The FBI might have tracked down the hackers, and a judge might have sent them to prison. I'm starting to think that we don't really need cryptocurrencies, and the current system is actually pretty good.

sillysaurus3 9y ago

The answer you're looking for is "Yeah, as much as people like to cry moral decay, honor is still a thing." You're right, there was no advantage to reporting the vuln. Most people would have jumped on that vuln like <edgy metaphor>. But "fuck you, got mine" mentality won't get us to Mars. And as stupid as it sounds, having a story to tell is at least partly as satisfying as doing the actual heist. Zero risk, and you get to brag how smart you were. People are also much more likely to trust you in the future (as opposed to you being an unknown quantity). Heists like that also punish the ecosystem. If Overstock lost $1m, it would forever show that moving to crypto is fundamentally a terrible idea. It would destabilize the basis of wealth you sought to acquire. But... Yeah, passing up a $1m payday would not be easy.

nathan_f77 9y ago
This would be pretty mild hack compared to all the other cryptocurrency hacks that have happened so far. There's the $30M Parity hack, $94M stolen from Bitfinex, $473M from Mt Gox, $5.1M from Bitstamp, $50M from DAO, $7M from CoinDash, $8M from Veritaseum, and $500k from Enigma. I'm probably missing a few big ones, and countless small ones. But a $1M Overstock hack would barely make the news, and would probably be covered by insurance. It's fun to think about all the people behind these hacks. JB Snyder could have been one of them, and we'd never know. A lot of them are probably just regular software engineers and security experts who stumbled onto these vulnerabilities. I think it's true that the "fuck you, got mine" mentality won't get us to Mars, but that's the motivation behind cryptocurrencies. We can't trust billions of strangers, but we can trust math and physics. Except, we already have systems that allow us to trust billions of strangers (governments and laws). Governments and banks could have reversed all of these transactions. The FBI might have tracked down the hackers, and a judge might have sent them to prison. I'm starting to think that we don't really need cryptocurrencies, and the current system is actually pretty good.