3 ms·

So they looked for connections to the IRC channel bitcoin uses to find linode IP's (or portscanned linode, but why bother when every bitcoin daemon hangs out ad

by joeyh 15y ago

So they looked for connections to the IRC channel bitcoin uses to find linode IP's (or portscanned linode, but why bother when every bitcoin daemon hangs out advertising its IP on IRC?). And they stole from at least 3 systems. One had $5; one $15 thousand, and one had nearly a quarter $million. Which makes me curious why they bothered with the $5 account at all. It's like robbing a bank, and stopping to smash a gumball machine in the lobby on your way in or out. My guess is that the attackers have a fully automated exploit payload that transfers the bitcoin out. And ran it on every system they could get on, indiscrimitely. So this is not a one-off. I'd be very cautious about running the bitcoin daemon, at least without setting noirc=1 in its configuration.

kiba 15y ago
My guess is that the attacker doesn't know how many bitcoin were stored on the target's.
- joeyh 15y ago
  The alternative is that they knew Bitcoinia was hosted on Linode, and when this customer service exploit became available for purchase on the 0day market (or whatever), they went in explicitly targeting Bitcoinia, but not knowing which IPs on Linode belonged to it. It's not clear if Bitcoinia separated its web server VM from its bitcoin VM, and if the attackers didn't know, it'd be best to target all the IPs.
  - kylebrown 15y ago
    Bitcoinica's web server is hosted on rackspace (through Heroku). They would likely have been able to determine that bitcoinica's bitcoin daemon was hosted separately on linode, by watching the ip addresses broadcasting withdrawal transactions. It is likely that bitcoinica was the target in breaching linode.
kylebrown 15y ago
Bitcoin faucet had 5 BTC or $20, but it was a service operated by the lead developer of bitcoin, Gavin Andresen. I think the attacker was just showing control of all of linode (rather than individual services). Also a bit of flexing, as he did when crafting a transaction size of 1337 bytes[1] using the stolen coins. http://blockchain.info/tx-index/2893660/d9804de366aa4c2a01565c3a3c8aa2ea20baafc276dc875f80b9044841205333 http://blockchain.info/tx-index/2893660/d9804de366aa4c2a0156...
jakubw 15y ago
They bothered with the $5 account because by stealing a wallet, they'd not only acquire its balance but also any future incoming transfers to one of its addresses.

by joeyh 15y ago

kiba 15y ago

My guess is that the attacker doesn't know how many bitcoin were stored on the target's.

joeyh 15y ago
The alternative is that they knew Bitcoinia was hosted on Linode, and when this customer service exploit became available for purchase on the 0day market (or whatever), they went in explicitly targeting Bitcoinia, but not knowing which IPs on Linode belonged to it. It's not clear if Bitcoinia separated its web server VM from its bitcoin VM, and if the attackers didn't know, it'd be best to target all the IPs.
- kylebrown 15y ago
  Bitcoinica's web server is hosted on rackspace (through Heroku). They would likely have been able to determine that bitcoinica's bitcoin daemon was hosted separately on linode, by watching the ip addresses broadcasting withdrawal transactions. It is likely that bitcoinica was the target in breaching linode.

kylebrown 15y ago

Bitcoin faucet had 5 BTC or $20, but it was a service operated by the lead developer of bitcoin, Gavin Andresen. I think the attacker was just showing control of all of linode (rather than individual services). Also a bit of flexing, as he did when crafting a transaction size of 1337 bytes[1] using the stolen coins. http://blockchain.info/tx-index/2893660/d9804de366aa4c2a01565c3a3c8aa2ea20baafc276dc875f80b9044841205333 http://blockchain.info/tx-index/2893660/d9804de366aa4c2a0156...

jakubw 15y ago

They bothered with the $5 account because by stealing a wallet, they'd not only acquire its balance but also any future incoming transfers to one of its addresses.