6 ms·

Bitcoin payment processor BIPS compromised, 1295 BTC stolen

72 points by nwh 13y ago

skorgu 13y ago
That technical explanation sounds almost like word salad. How did a DDoS hit your SAN in the first place and how did your SAN blowing up allow a compromise?
- mmmooo 13y ago
  iSCSI san, so attached via ethernet or similar, taking network devices offline would take san offline. The rest is pure magic.
  - packetslave 13y ago
    If your iSCSI network traffic can be impacted by an Internet-based DDoS, your network architect is an idiot.
    - mmmooo 13y ago
      yep, sounded like they shared switches between public and iscsi lans, or worse.
  - JoachimSchipper 13y ago
    Re: pure magic: perhaps the SAN is willing to talk to whoever sends it packets, and/or to be administered by whoever can enter admin:admin into a poorly-secured web interface as soon as it loses the appropriate connection/reboots due to overload/..? I agree with my sibling comment that this seems an odd way to install a SAN.
- cryptocoin 13y ago
  If you are new to bitcoin-related sites, you might find this story close to legitimate. But anyone that reads the article will see there is this "basic" flaw mentioning that DDoS attacks gave access to the server. If you read past (paid) articles about this very same service, you will see claims about how secure the system is, and how expert everyone that developed it is. The same was claimed by inputs.io, I'm sure you have read about that story earlier. The thing is, if you want to use bitcoin, you cannot trust third parties to hold your coins for you. If you want to support bitcoin in your business, you cannot trust other sites to handle the payment for you. Yes, it is not convenient. But you have everything available to handle this yourself and, yes, you will need someone competent to do that for you if you are not into it. Bitcoin is not meant for the average user or the unaware merchant and it might never be, people need to start accepting this fact. This is almost an exact copy from the other thread here https://news.ycombinator.com/item?id=6793984 https://news.ycombinator.com/item?id=6793984. I assume it is fine as it is ok to post duplicates like this topic.
  - TrainedMonkey 13y ago
    Reading between the lines you are suggesting that this vector of attack had to come internally from BIPS? Given how much bitcoin price soared it is not unreasonable to question whether one of the engineers there had his price named.
    - nwh 13y ago
      I don't think they're suggesting that, more just gross incompetence on the part of the developer, and a little bit of liberty about how "secure" the systems they have created actually are. It's a lot like inputs.io, a web wallet compromised because the developer used Linode to protect millions of dollars. The developer of that particular service paid back about the half the funds then disappeared. > BIPS was built by passionate bitcoiners and talented developers. BIPS is hosted in our private server facilities. Passwords are stored with a double salted SHA-512 hashing algorithm. Our entire website is protected with AES RIJNDAEL 256 encryption and we have encryption of data traffic with 2048-bit, highest assurance Extended Validation SSL certificate, with 99.9% Browser Recognition. > BIPS protects your payment information with industry-leading security and fraud protection. On top of this, our server/database is regularly stored on tape backups. For added security you can also enable Secure Card and Google Authenticator at any time for up to 3 levels of authentication.
      - Crito 13y ago
        Appearing to be incompetent in some circumstances may be a pretty good cover. If you are a security guard at an art museum, and buddies with some art thieves, then it might be in your best interest to get yourself a reputation for sleeping on the job.
      - TrainedMonkey 13y ago
        So if he gotten over 50% of stolen funds as his `fee` he could end up ahead? But yeah, given that he paid back half of stolen funds this angle does look weak. Is it possible to launder stolen bitcoins on Chinese exchange?
      - tetha 13y ago
- jakejake 13y ago
  I've heard of DDoS attacks used to divert the admins attention while a real attack is occurring. Also I know packet flooding can cause some network hardware to switch into a lower security mode in an attempt to handle the load. I'm not sure if either of those apply in this case, though. I definitely am not a network or security expert.
  - meowface 13y ago
    Right, they're used as distractions fairly often. The rest of the explanation makes no sense though; that is, I don't see how the DDoS would then "make the system vulnerable" to Bitcoin theft. Unless it was something like where the attackers already had access, but most everything was kept in cold storage and they wanted to force them to move a lot of BTC into their live wallets.
- aray 13y ago
  How can we be sure that the attack wasn't inspired/originated by the site itself? Similar to how an EVE bank exited with everyone's funds after operating for almost a year[0] [0] http://massively.joystiq.com/2011/08/12/biggest-eve-online-scam-ever-recorded-nets-over-a-trillion-isk/ http://massively.joystiq.com/2011/08/12/biggest-eve-online-s...
deleted 13y ago
[deleted]
nwh 13y ago
Address of the stolen funds: https://blockchain.info/address/1LuG91tcSQxKj32BsCoRkX7yQLfj9LtkCs https://blockchain.info/address/1LuG91tcSQxKj32BsCoRkX7yQLfj...
- hadem 13y ago
  At this time (1BTC = USD $781.90) that translates to USD $1,012,560.50!
  - deleted 13y ago
    [deleted]
  - deleted 13y ago
    [deleted]
- zhuzhuor 13y ago
  Since every bitcoin transaction is in public, why don't we build a public blacklist for these addresses with stolen coins (and all addresses these bitcoins further transferred to)? such that the hackers cannot get too much from their actions
  - rtpg 13y ago
    if you could get such a thing in place, couldn't everyone just roll back transactions? I feel like having such a system in place would probably end up breaking a lot of the legitimacy (since you'd need over half of miners to agree to it, in which case some sort of "central" entity would exist)
    - nwh 13y ago
      You could to a point, but you would need a lot of mining power and the ability to act quickly. BIPS didn't announce that they'd been compromised until over a week since the funds were sent out, so it's completely impossible at this point. If you wanted to get a transaction with one confirmation reversed, you would need to convince the two largest pools (ghash.io and btcguild) to mine a fork that doesn't contain your blacklisted transaction in under 10 minutes, and even then they'd create a very noticeable reorganisation. You'd also then have to race to get your funds out, as you know your keys have been compromised. It's fairly impossible really.
stretchwithme 13y ago
Hey, how about just disconnecting the critical machines from the network when under such an attack?
- fleitz 13y ago
  Our DDOS recovery plan is to just shut everything off and admit defeat. Brilliant.
  - eli 13y ago
    That seems infinitely better than catastrophic loss of customer funds.
    - fleitz 13y ago
      There's no difference as if you shut your site down everytime someone DDoS then you'll have no customers anyway.
      - fat0wl 13y ago
        mmm i think at this point in the Bitcoin community, stating that practice on your homepage would actually get you more customers. "In the event of an obvious attack, we disconnect from the network and begin diagnostics after __ minutes of sustained activity."
        buster 13y ago
        ddos can run over a rather long period of time and come and go fairly quick. cutting the internet connection just is no viable solution for an online service.
      - astrodust 13y ago
        "If we keep closing our retail store every time there's a riot inside of it, we'll never have any customers." No, you shut the thing down, you post a page that explains what is going on and what you're doing about it, then you open again when it's clear.
omni_ 13y ago
How do we know this isn't an inside job?
- aparadja 13y ago
  We don't.
- benatkin 13y ago
  A good question to be asking. I agree with this sentiment: > Every time a company loses somebody else's bitcoins, the main assumption should be that it was an inside job. It's way too easy for a company to take the money and say that they were hacked. http://www.reddit.com/r/Bitcoin/comments/1rexob/bitcoin_payment_processor_bips_attacked_over_1m/ http://www.reddit.com/r/Bitcoin/comments/1rexob/bitcoin_paym...
d0ugie 13y ago
1295 stolen, sounds like a lot - does that figure count as actual bitcoin transactions?
iso-8859-1 13y ago
Linked post is from November 19, 2013.
Erwin 13y ago
Here's their security page: https://bips.me/security https://bips.me/security -- "industry-leading security" .. "BIPS ... does not store bitcoin on its servers". Is it time for a PCI-like consortium that will validate your bitcoin storage security procedures? (Not that PCI is guarantee of anything, but at least following it prevents you from having full credit card data lying around in files). I.e. analyze your fail-safes (which seem to be lacking) and validate that unless someone is holding a gun to the owner's head, that your 1000 bitcoins held for you in their "vault" cannot be sent off to a random address.
- steveklabnik 13y ago
  Bitcoin advocates talk about lack of regulations a feature, not a bug, so I'd wonder how well it'd go over. I think it's important and will have to happen eventually.
  - warfangle 13y ago
    Could see if voluntary adoption works out.
pearjuice 13y ago
1295 bitcoin stolen with a value of x dollar. See, they didn't care about the bitcoin they cared about the dollars behind it. As long as a bitcoin its value is measured in dollars and accepting bitcoin is merely done because it is at a high dollar rate, how can this possibly be a viable alternative currency? Apart from the whole fluctuation on steroids, bitcoin is nothing more than a wrapper for American dollars. Because, at the end of the day, you have to pay for your groceries and mortgage in dollars. B-but muh Subway sandwich
- woah 13y ago
  Honestly, let's think a little bit here. If this story was reported on in China, what currency would it be converted to for the readership? If a story about American dollars being stolen was reported on in China, what currency would it be reported in? Is the dollar just a wrapper for the Yuan?
- benatkin 13y ago
  The submitter is doing this. The person representing BIPS on the forum is speaking in terms of Bitcoins. Probably makes it easier to downplay because even the most avid bitcoin users perceive it as a secondary currency.
woah 13y ago
Why do people use online wallets? I don't understand.
- letstryagain 13y ago
  BIPS was a payments processor. Merchants used them to accept Bitcoin payments AFK.
- samolang 13y ago
  I use coinbase because it is very convenient.
ChuckMcM 13y ago
Pretty sad, especially for folks who lost coin. The part that intrigues me is the whole security aspect of it. Take your average bright guy and say "Lets set up a place where people can store and move around gold coins. All the gold coins are going to sit in your living room, and of course if anyone were to get there hands on those coins they could melt them down into pieces and resell them so that you never knew where they went. There is going to be more than a million dollars worth of coins in your living room, do you think you're door lock is up to it?" Ok so its a stretch, but Bitcoin has two interesting properties, one it is pretty fungible, and two most if not all governments consider it about as 'real' as the gold in World of Warcraft. If CFAA doesn't apply (say the server is outside the US) then what exactly would you even charge someone with who "stole" 1000 BTC? It isn't recognized as currency by any jurisdiction on the planet as far as I can tell, so what got stolen? Numbers? Block chain data? This fairly unique combination of properties quite possibly make Bitcoin the ideal target for thieves. Better than cash, better than raw gemstones, better than pretty much anything except possibly bearer bonds [1]. Have you seen how much security there is around vaults that hold bearer bonds? And yet people create exchanges or wallet services or whatnot and then seem shocked when they get compromised by very sophisticated programmers [2], that steal all their BTC? You are surprised? Given these huge thefts where is the money going? I mean is there a steady stream of redemptions at exchanges? Is there a note in the chain when the coin is transacted for cash? Should there be? [1] http://www.investopedia.com/articles/bonds/08/bearer-bond.asp http://www.investopedia.com/articles/bonds/08/bearer-bond.as... [2] When the payoff is huge, the risk small, you can pay someone a lot of money if they are good to get you the coins.
- benatkin 13y ago
  >This fairly unique combination of properties quite possibly make Bitcoin the ideal target for thieves Or someone who runs an online wallet service with a privacy policy, who can pretend to have their hands tied when people ask where the money went.
  - ChuckMcM 13y ago
    The best thieves are the ones who get their victims to hand over their valuables willingly ...
vbuterin 13y ago
> It is imperative to understand that everything was wiped out from our servers and getting functionality back is priority #1. The wallet part of BIPS was a free service to make payments easier for users. Web Wallets are like a regular wallet that you carry cash in and not meant to keep large amounts in. Hence we offered a paper wallet as a cold storage alternative for those who wanted a safe storage solution. "Oh, we never said that our food is screened against infection - if you wanted that you should have checked out the premium section!"

72 points by nwh 13y ago

That technical explanation sounds almost like word salad. How did a DDoS hit your SAN in the first place and how did your SAN blowing up allow a compromise?

mmmooo 13y ago
iSCSI san, so attached via ethernet or similar, taking network devices offline would take san offline. The rest is pure magic.
- packetslave 13y ago
  If your iSCSI network traffic can be impacted by an Internet-based DDoS, your network architect is an idiot.
  - mmmooo 13y ago
    yep, sounded like they shared switches between public and iscsi lans, or worse.
- JoachimSchipper 13y ago
  Re: pure magic: perhaps the SAN is willing to talk to whoever sends it packets, and/or to be administered by whoever can enter admin:admin into a poorly-secured web interface as soon as it loses the appropriate connection/reboots due to overload/..? I agree with my sibling comment that this seems an odd way to install a SAN.
cryptocoin 13y ago
If you are new to bitcoin-related sites, you might find this story close to legitimate. But anyone that reads the article will see there is this "basic" flaw mentioning that DDoS attacks gave access to the server. If you read past (paid) articles about this very same service, you will see claims about how secure the system is, and how expert everyone that developed it is. The same was claimed by inputs.io, I'm sure you have read about that story earlier. The thing is, if you want to use bitcoin, you cannot trust third parties to hold your coins for you. If you want to support bitcoin in your business, you cannot trust other sites to handle the payment for you. Yes, it is not convenient. But you have everything available to handle this yourself and, yes, you will need someone competent to do that for you if you are not into it. Bitcoin is not meant for the average user or the unaware merchant and it might never be, people need to start accepting this fact. This is almost an exact copy from the other thread here https://news.ycombinator.com/item?id=6793984 https://news.ycombinator.com/item?id=6793984. I assume it is fine as it is ok to post duplicates like this topic.
- TrainedMonkey 13y ago
  Reading between the lines you are suggesting that this vector of attack had to come internally from BIPS? Given how much bitcoin price soared it is not unreasonable to question whether one of the engineers there had his price named.
  - nwh 13y ago
    I don't think they're suggesting that, more just gross incompetence on the part of the developer, and a little bit of liberty about how "secure" the systems they have created actually are. It's a lot like inputs.io, a web wallet compromised because the developer used Linode to protect millions of dollars. The developer of that particular service paid back about the half the funds then disappeared. > BIPS was built by passionate bitcoiners and talented developers. BIPS is hosted in our private server facilities. Passwords are stored with a double salted SHA-512 hashing algorithm. Our entire website is protected with AES RIJNDAEL 256 encryption and we have encryption of data traffic with 2048-bit, highest assurance Extended Validation SSL certificate, with 99.9% Browser Recognition. > BIPS protects your payment information with industry-leading security and fraud protection. On top of this, our server/database is regularly stored on tape backups. For added security you can also enable Secure Card and Google Authenticator at any time for up to 3 levels of authentication.
    - Crito 13y ago
      Appearing to be incompetent in some circumstances may be a pretty good cover. If you are a security guard at an art museum, and buddies with some art thieves, then it might be in your best interest to get yourself a reputation for sleeping on the job.
    - TrainedMonkey 13y ago
      So if he gotten over 50% of stolen funds as his `fee` he could end up ahead? But yeah, given that he paid back half of stolen funds this angle does look weak. Is it possible to launder stolen bitcoins on Chinese exchange?
    - tetha 13y ago
jakejake 13y ago
I've heard of DDoS attacks used to divert the admins attention while a real attack is occurring. Also I know packet flooding can cause some network hardware to switch into a lower security mode in an attempt to handle the load. I'm not sure if either of those apply in this case, though. I definitely am not a network or security expert.
- meowface 13y ago
  Right, they're used as distractions fairly often. The rest of the explanation makes no sense though; that is, I don't see how the DDoS would then "make the system vulnerable" to Bitcoin theft. Unless it was something like where the attackers already had access, but most everything was kept in cold storage and they wanted to force them to move a lot of BTC into their live wallets.
aray 13y ago
How can we be sure that the attack wasn't inspired/originated by the site itself? Similar to how an EVE bank exited with everyone's funds after operating for almost a year[0] [0] http://massively.joystiq.com/2011/08/12/biggest-eve-online-scam-ever-recorded-nets-over-a-trillion-isk/ http://massively.joystiq.com/2011/08/12/biggest-eve-online-s...

deleted 13y ago

[deleted]

nwh 13y ago

Address of the stolen funds: https://blockchain.info/address/1LuG91tcSQxKj32BsCoRkX7yQLfj9LtkCs https://blockchain.info/address/1LuG91tcSQxKj32BsCoRkX7yQLfj...

hadem 13y ago
At this time (1BTC = USD $781.90) that translates to USD $1,012,560.50!
- deleted 13y ago
  [deleted]
- deleted 13y ago
  [deleted]
zhuzhuor 13y ago
Since every bitcoin transaction is in public, why don't we build a public blacklist for these addresses with stolen coins (and all addresses these bitcoins further transferred to)? such that the hackers cannot get too much from their actions
- rtpg 13y ago
  if you could get such a thing in place, couldn't everyone just roll back transactions? I feel like having such a system in place would probably end up breaking a lot of the legitimacy (since you'd need over half of miners to agree to it, in which case some sort of "central" entity would exist)
  - nwh 13y ago
    You could to a point, but you would need a lot of mining power and the ability to act quickly. BIPS didn't announce that they'd been compromised until over a week since the funds were sent out, so it's completely impossible at this point. If you wanted to get a transaction with one confirmation reversed, you would need to convince the two largest pools (ghash.io and btcguild) to mine a fork that doesn't contain your blacklisted transaction in under 10 minutes, and even then they'd create a very noticeable reorganisation. You'd also then have to race to get your funds out, as you know your keys have been compromised. It's fairly impossible really.

stretchwithme 13y ago

Hey, how about just disconnecting the critical machines from the network when under such an attack?

fleitz 13y ago
Our DDOS recovery plan is to just shut everything off and admit defeat. Brilliant.
- eli 13y ago
  That seems infinitely better than catastrophic loss of customer funds.
  - fleitz 13y ago
    There's no difference as if you shut your site down everytime someone DDoS then you'll have no customers anyway.
    - fat0wl 13y ago
      mmm i think at this point in the Bitcoin community, stating that practice on your homepage would actually get you more customers. "In the event of an obvious attack, we disconnect from the network and begin diagnostics after __ minutes of sustained activity."
      - buster 13y ago
        ddos can run over a rather long period of time and come and go fairly quick. cutting the internet connection just is no viable solution for an online service.
    - astrodust 13y ago
      "If we keep closing our retail store every time there's a riot inside of it, we'll never have any customers." No, you shut the thing down, you post a page that explains what is going on and what you're doing about it, then you open again when it's clear.

omni_ 13y ago

How do we know this isn't an inside job?

aparadja 13y ago
We don't.
benatkin 13y ago
A good question to be asking. I agree with this sentiment: > Every time a company loses somebody else's bitcoins, the main assumption should be that it was an inside job. It's way too easy for a company to take the money and say that they were hacked. http://www.reddit.com/r/Bitcoin/comments/1rexob/bitcoin_payment_processor_bips_attacked_over_1m/ http://www.reddit.com/r/Bitcoin/comments/1rexob/bitcoin_paym...

d0ugie 13y ago

1295 stolen, sounds like a lot - does that figure count as actual bitcoin transactions?

iso-8859-1 13y ago

Linked post is from November 19, 2013.

Erwin 13y ago

Here's their security page: https://bips.me/security https://bips.me/security -- "industry-leading security" .. "BIPS ... does not store bitcoin on its servers". Is it time for a PCI-like consortium that will validate your bitcoin storage security procedures? (Not that PCI is guarantee of anything, but at least following it prevents you from having full credit card data lying around in files). I.e. analyze your fail-safes (which seem to be lacking) and validate that unless someone is holding a gun to the owner's head, that your 1000 bitcoins held for you in their "vault" cannot be sent off to a random address.

steveklabnik 13y ago
Bitcoin advocates talk about lack of regulations a feature, not a bug, so I'd wonder how well it'd go over. I think it's important and will have to happen eventually.
- warfangle 13y ago
  Could see if voluntary adoption works out.

pearjuice 13y ago

1295 bitcoin stolen with a value of x dollar. See, they didn't care about the bitcoin they cared about the dollars behind it. As long as a bitcoin its value is measured in dollars and accepting bitcoin is merely done because it is at a high dollar rate, how can this possibly be a viable alternative currency? Apart from the whole fluctuation on steroids, bitcoin is nothing more than a wrapper for American dollars. Because, at the end of the day, you have to pay for your groceries and mortgage in dollars. B-but muh Subway sandwich

woah 13y ago
Honestly, let's think a little bit here. If this story was reported on in China, what currency would it be converted to for the readership? If a story about American dollars being stolen was reported on in China, what currency would it be reported in? Is the dollar just a wrapper for the Yuan?
benatkin 13y ago
The submitter is doing this. The person representing BIPS on the forum is speaking in terms of Bitcoins. Probably makes it easier to downplay because even the most avid bitcoin users perceive it as a secondary currency.

woah 13y ago

Why do people use online wallets? I don't understand.

letstryagain 13y ago
BIPS was a payments processor. Merchants used them to accept Bitcoin payments AFK.
samolang 13y ago
I use coinbase because it is very convenient.

ChuckMcM 13y ago

Pretty sad, especially for folks who lost coin. The part that intrigues me is the whole security aspect of it. Take your average bright guy and say "Lets set up a place where people can store and move around gold coins. All the gold coins are going to sit in your living room, and of course if anyone were to get there hands on those coins they could melt them down into pieces and resell them so that you never knew where they went. There is going to be more than a million dollars worth of coins in your living room, do you think you're door lock is up to it?" Ok so its a stretch, but Bitcoin has two interesting properties, one it is pretty fungible, and two most if not all governments consider it about as 'real' as the gold in World of Warcraft. If CFAA doesn't apply (say the server is outside the US) then what exactly would you even charge someone with who "stole" 1000 BTC? It isn't recognized as currency by any jurisdiction on the planet as far as I can tell, so what got stolen? Numbers? Block chain data? This fairly unique combination of properties quite possibly make Bitcoin the ideal target for thieves. Better than cash, better than raw gemstones, better than pretty much anything except possibly bearer bonds [1]. Have you seen how much security there is around vaults that hold bearer bonds? And yet people create exchanges or wallet services or whatnot and then seem shocked when they get compromised by very sophisticated programmers [2], that steal all their BTC? You are surprised? Given these huge thefts where is the money going? I mean is there a steady stream of redemptions at exchanges? Is there a note in the chain when the coin is transacted for cash? Should there be? [1] http://www.investopedia.com/articles/bonds/08/bearer-bond.asp http://www.investopedia.com/articles/bonds/08/bearer-bond.as... [2] When the payoff is huge, the risk small, you can pay someone a lot of money if they are good to get you the coins.

benatkin 13y ago
>This fairly unique combination of properties quite possibly make Bitcoin the ideal target for thieves Or someone who runs an online wallet service with a privacy policy, who can pretend to have their hands tied when people ask where the money went.
- ChuckMcM 13y ago
  The best thieves are the ones who get their victims to hand over their valuables willingly ...

vbuterin 13y ago

> It is imperative to understand that everything was wiped out from our servers and getting functionality back is priority #1. The wallet part of BIPS was a free service to make payments easier for users. Web Wallets are like a regular wallet that you carry cash in and not meant to keep large amounts in. Hence we offered a paper wallet as a cold storage alternative for those who wanted a safe storage solution. "Oh, we never said that our food is screened against infection - if you wanted that you should have checked out the premium section!"