6 ms·

Bitcoin thefts at MTGOX (Bitcoin exchange) confirmed to be CSRF vulnerability

68 points by ezl 15y ago

chopsueyar 15y ago
Nice tip: ^There's no need to install an entirely separate browser. Make a new profile, just for Mt. Gox, and run it from a shortcut like this: firefox.exe -P "NewProfileNameHere" -no-remote Then you can do the same for your other profile and run both at the same time, with no interaction.
- pavel_lishin 15y ago
  Does Chrome support multiple profiles? I know you can launch an Incognito window, but Incognito windows share cookies, etc.
  - jsnell 15y ago
    Yes, with the --user-data-dir flag.
  - palish 15y ago
    Incognito windows share cookies? That doesn't sound right... I would have thought incognito would prevent CSRF.
    - bdhe 15y ago
      Yes, incognito windows and tabs share cookies. The cookies are deleted once you close the incognito window of course and are not shared between the incognito window and the regular browser window. But as long as one incognito window is open your cookies are still there. Edit: You can easily test this by logging into GMail in Incognito mode and then going to youtube/google maps etc. and notice that you're still logged in. Even if you open a new incognito window.
      - palish 15y ago
        Right. So open an incognito window; go to MtGox; do your business; then close.
  - abraham 15y ago
    The Chrome dev channel has support for multiple profiles. Incognito windows share cookies with other incognito windows but not the regular windows.
- simonb 15y ago
  Or just use "Private Browsing". http://support.mozilla.com/en-US/kb/Private%20Browsing http://support.mozilla.com/en-US/kb/Private%20Browsing
teyc 15y ago
I've been thinking about bitcoins. If there is some way clearing houses can prove they own a certain quantity of bitcoins, then, the bitcoins don't need to be physically transferred. This has some advantages. Firstly, the bitcoins can be secured off the grid. Secondly, the transfers between clearing houses are simply bookkeeping entries, meaning there is less bitcoins that need to be actually exchanged. In the event of fraud, there is some traceability and reversibility, since clearing houses can implement rules similar to what banks already do. For instance, monies deposited cannot be withdrawn straight away, until it is clear that there are no other claims on the money.
- kseudo 15y ago
  I think on a very low scale this is what Youtipit does(http://www.youtipit.org http://www.youtipit.org). People deposit their coins, tip them internally and this is handled by our bookkeeping system. If someone wants their coins out they simply withdraw them and the transaction goes out to the block chain. This has many of the advantages that you have stated (also tips are instantaneous, no need for confirmations) If you give it a look I would like to hear your opinions on it.
  - omouse 15y ago
    So you basically have an internal currency that just happens to be bitcoin? Kinda like when you store $$ in a PayPal account?
    - kseudo 15y ago
      You make it sound like a bad thing...But yes thats exactly what we have :-). Except with us there are no fees: no deposit fees, no withdraw fees, no fees to tip. If you can get over the fact that it is bitcoin based, its probably the cheapest way to reward someone online. This would not be possible without bitcoin. In fact we built the system to use USD and EUR initially but eventually realized that financial/legal costs were making the project totally unviable. Changing to bitcoin allowed us to continue and play with this idea of the 'Online street performer' and develop it somewhat. I think what we do shows that there are some positive applications for bitcoin and it does open opportunities for online business. Unfortunately most of the press dwells on 'bitcoin for drugs' stories, why cant they to story about Youtipit! ... probably because there are far more people interested in buying drugs than tipping online :-0
rauljara 15y ago
From the comments: "Pretty sure Mt. Gox would have legal responsibility for coins/funds lost due to the exploit. Allowing users who haven't read this thread to lose funds is negligent." IANAL, but pretty sure this is completely wrong. That is what a completely unregulated market is like: freedom, but no recourse if something goes wrong. I have to wonder what happens when people who are used to the benefits of regulated markets (not saying there aren't downsides, just that there ARE benefits) enter into a market they assume is regulated, but isn't. With bitcoin, this is more than just a hypothetical musing.
- IgorPartola 15y ago
  I imagine you can still attempt to sue them. However, yhe person to cast the first stone would probably incur the wrath of Anonymous or some such.
- omouse 15y ago
  Well you get what you get in a free market; private companies/groups form that act as Consumer Reports. Still unregulated but then you have a trust network built up. Also, with more people entering and after this vulnerability has been exposed, there will be some more caution when using random websites.
- smokeyj 15y ago
  People getting into bitcoin now are buying it because of it's decentralized unregulated nature. This whole p2p economy thing is very new, so you can't compare it to an established market like the US economy. It could easily be argued that market regulation doesn't add much value considering the constant and systematic recurrence of financial crisis in the US.
  - hysterix 15y ago
    This is absurd seeing as how we are purposefully led into these many "market crisis" by the federal reserve and the people who run it. Your argument is ridiculous because you are making an assumption that the federal reserve and the like are acting in the best interest for the united states and the crises, "just keeps on happening" which is absolutely wrong.
brad22 15y ago
if you are using chrome always use this plugin http://goo.gl/AJ752 http://goo.gl/AJ752. although it doesn't help within a browsing session it can help if you want don't want to manually delete cookies or use the safe mode of the browser.
DevX101 15y ago
Any security researchers have link to a study detailing the prevalence of security lapses among a large sample of websites? I hear about these attacks, and I'd be curious to know how vulnerable the sites I visit are.
- lukeschlather 15y ago
  As Lulzsec so clumsily illustrated, you can't know because most vulnerabilities are silently patched, or undiscovered (but still in use without the site's knowledge.) Any such index would more likely penalize the most honest than the most vulnerable.
  - derrickpetzold 15y ago
    Are you saying its better not to know? It wouldn't be hard determine is a site is CSRF vulnerable.
woodall 15y ago
OWASP write up on CSRF. https://www.owasp.org/index.php/Cross-Site_Request_Forgery_%28CSRF%29 https://www.owasp.org/index.php/Cross-Site_Request_Forgery_%...
unreal37 15y ago
Misleading headline, as no actual bitcoins were stolen from this exploit according to the owner of MtGox.
- hugh3 15y ago
  How would they know? (Serious question)
  - deleted 15y ago
    [deleted]
    - regularfry 15y ago
      That only tells you that a transaction occurred. It doesn't tell you who initiated it.
      - deleted 15y ago
        [deleted]
  - ScottBurson 15y ago
    My guess is they're looking at the HTTP referrer field in their server logs. Normally, a CSRF exploit shows up as an HTTP request originating from a different site (i.e., other than mtgox.com). I think the referrer can be spoofed, though, which would disguise the exploit in the logs.
    - tlrobinson 15y ago
      The referrer isn't spoofable in any normal browsers (and CSRF attacks occur within the user's browser).
- ScottBurson 15y ago
  I've seen one post on the forum from a user claiming to have had bitcoins stolen from his/her account. While there's no way to know for sure, at the moment I find the user's claim more plausible than Mt. Gox's denial.
derrickpetzold 15y ago
It is incredibility poor form that websites are still vulnerable to these attacks. Django made CSRF protection mandatory back in 2009. http://code.djangoproject.com/wiki/CsrfProtection http://code.djangoproject.com/wiki/CsrfProtection and if you operating a website that is still is use today it must also guard against these attacks. See http://www.squarefree.com/securitytips/web-developers.html#CSRF http://www.squarefree.com/securitytips/web-developers.html#C... there is absolutely no excuse for this other than incompetence or ignorance. Take your pick.

68 points by ezl 15y ago

Nice tip: ^There's no need to install an entirely separate browser. Make a new profile, just for Mt. Gox, and run it from a shortcut like this: firefox.exe -P "NewProfileNameHere" -no-remote Then you can do the same for your other profile and run both at the same time, with no interaction.

pavel_lishin 15y ago
Does Chrome support multiple profiles? I know you can launch an Incognito window, but Incognito windows share cookies, etc.
- jsnell 15y ago
  Yes, with the --user-data-dir flag.
- palish 15y ago
  Incognito windows share cookies? That doesn't sound right... I would have thought incognito would prevent CSRF.
  - bdhe 15y ago
    Yes, incognito windows and tabs share cookies. The cookies are deleted once you close the incognito window of course and are not shared between the incognito window and the regular browser window. But as long as one incognito window is open your cookies are still there. Edit: You can easily test this by logging into GMail in Incognito mode and then going to youtube/google maps etc. and notice that you're still logged in. Even if you open a new incognito window.
    - palish 15y ago
      Right. So open an incognito window; go to MtGox; do your business; then close.
- abraham 15y ago
  The Chrome dev channel has support for multiple profiles. Incognito windows share cookies with other incognito windows but not the regular windows.
simonb 15y ago
Or just use "Private Browsing". http://support.mozilla.com/en-US/kb/Private%20Browsing http://support.mozilla.com/en-US/kb/Private%20Browsing

teyc 15y ago

I've been thinking about bitcoins. If there is some way clearing houses can prove they own a certain quantity of bitcoins, then, the bitcoins don't need to be physically transferred. This has some advantages. Firstly, the bitcoins can be secured off the grid. Secondly, the transfers between clearing houses are simply bookkeeping entries, meaning there is less bitcoins that need to be actually exchanged. In the event of fraud, there is some traceability and reversibility, since clearing houses can implement rules similar to what banks already do. For instance, monies deposited cannot be withdrawn straight away, until it is clear that there are no other claims on the money.

kseudo 15y ago
I think on a very low scale this is what Youtipit does(http://www.youtipit.org http://www.youtipit.org). People deposit their coins, tip them internally and this is handled by our bookkeeping system. If someone wants their coins out they simply withdraw them and the transaction goes out to the block chain. This has many of the advantages that you have stated (also tips are instantaneous, no need for confirmations) If you give it a look I would like to hear your opinions on it.
- omouse 15y ago
  So you basically have an internal currency that just happens to be bitcoin? Kinda like when you store $$ in a PayPal account?
  - kseudo 15y ago
    You make it sound like a bad thing...But yes thats exactly what we have :-). Except with us there are no fees: no deposit fees, no withdraw fees, no fees to tip. If you can get over the fact that it is bitcoin based, its probably the cheapest way to reward someone online. This would not be possible without bitcoin. In fact we built the system to use USD and EUR initially but eventually realized that financial/legal costs were making the project totally unviable. Changing to bitcoin allowed us to continue and play with this idea of the 'Online street performer' and develop it somewhat. I think what we do shows that there are some positive applications for bitcoin and it does open opportunities for online business. Unfortunately most of the press dwells on 'bitcoin for drugs' stories, why cant they to story about Youtipit! ... probably because there are far more people interested in buying drugs than tipping online :-0

rauljara 15y ago

From the comments: "Pretty sure Mt. Gox would have legal responsibility for coins/funds lost due to the exploit. Allowing users who haven't read this thread to lose funds is negligent." IANAL, but pretty sure this is completely wrong. That is what a completely unregulated market is like: freedom, but no recourse if something goes wrong. I have to wonder what happens when people who are used to the benefits of regulated markets (not saying there aren't downsides, just that there ARE benefits) enter into a market they assume is regulated, but isn't. With bitcoin, this is more than just a hypothetical musing.

IgorPartola 15y ago
I imagine you can still attempt to sue them. However, yhe person to cast the first stone would probably incur the wrath of Anonymous or some such.
omouse 15y ago
Well you get what you get in a free market; private companies/groups form that act as Consumer Reports. Still unregulated but then you have a trust network built up. Also, with more people entering and after this vulnerability has been exposed, there will be some more caution when using random websites.
smokeyj 15y ago
People getting into bitcoin now are buying it because of it's decentralized unregulated nature. This whole p2p economy thing is very new, so you can't compare it to an established market like the US economy. It could easily be argued that market regulation doesn't add much value considering the constant and systematic recurrence of financial crisis in the US.
- hysterix 15y ago
  This is absurd seeing as how we are purposefully led into these many "market crisis" by the federal reserve and the people who run it. Your argument is ridiculous because you are making an assumption that the federal reserve and the like are acting in the best interest for the united states and the crises, "just keeps on happening" which is absolutely wrong.

brad22 15y ago

if you are using chrome always use this plugin http://goo.gl/AJ752 http://goo.gl/AJ752. although it doesn't help within a browsing session it can help if you want don't want to manually delete cookies or use the safe mode of the browser.

DevX101 15y ago

Any security researchers have link to a study detailing the prevalence of security lapses among a large sample of websites? I hear about these attacks, and I'd be curious to know how vulnerable the sites I visit are.

lukeschlather 15y ago
As Lulzsec so clumsily illustrated, you can't know because most vulnerabilities are silently patched, or undiscovered (but still in use without the site's knowledge.) Any such index would more likely penalize the most honest than the most vulnerable.
- derrickpetzold 15y ago
  Are you saying its better not to know? It wouldn't be hard determine is a site is CSRF vulnerable.

woodall 15y ago

OWASP write up on CSRF. https://www.owasp.org/index.php/Cross-Site_Request_Forgery_%28CSRF%29 https://www.owasp.org/index.php/Cross-Site_Request_Forgery_%...

unreal37 15y ago

Misleading headline, as no actual bitcoins were stolen from this exploit according to the owner of MtGox.

hugh3 15y ago
How would they know? (Serious question)
- deleted 15y ago
  [deleted]
  - regularfry 15y ago
    That only tells you that a transaction occurred. It doesn't tell you who initiated it.
    - deleted 15y ago
      [deleted]
- ScottBurson 15y ago
  My guess is they're looking at the HTTP referrer field in their server logs. Normally, a CSRF exploit shows up as an HTTP request originating from a different site (i.e., other than mtgox.com). I think the referrer can be spoofed, though, which would disguise the exploit in the logs.
  - tlrobinson 15y ago
    The referrer isn't spoofable in any normal browsers (and CSRF attacks occur within the user's browser).
ScottBurson 15y ago
I've seen one post on the forum from a user claiming to have had bitcoins stolen from his/her account. While there's no way to know for sure, at the moment I find the user's claim more plausible than Mt. Gox's denial.

derrickpetzold 15y ago

It is incredibility poor form that websites are still vulnerable to these attacks. Django made CSRF protection mandatory back in 2009. http://code.djangoproject.com/wiki/CsrfProtection http://code.djangoproject.com/wiki/CsrfProtection and if you operating a website that is still is use today it must also guard against these attacks. See http://www.squarefree.com/securitytips/web-developers.html#CSRF http://www.squarefree.com/securitytips/web-developers.html#C... there is absolutely no excuse for this other than incompetence or ignorance. Take your pick.