5 ms·

That technical explanation sounds almost like word salad. How did a DDoS hit your SAN in the first place and how did your SAN blowing up allow a compromise?

by skorgu 13y ago

mmmooo 13y ago
iSCSI san, so attached via ethernet or similar, taking network devices offline would take san offline. The rest is pure magic.
- packetslave 13y ago
  If your iSCSI network traffic can be impacted by an Internet-based DDoS, your network architect is an idiot.
  - mmmooo 13y ago
    yep, sounded like they shared switches between public and iscsi lans, or worse.
- JoachimSchipper 13y ago
  Re: pure magic: perhaps the SAN is willing to talk to whoever sends it packets, and/or to be administered by whoever can enter admin:admin into a poorly-secured web interface as soon as it loses the appropriate connection/reboots due to overload/..? I agree with my sibling comment that this seems an odd way to install a SAN.
cryptocoin 13y ago
If you are new to bitcoin-related sites, you might find this story close to legitimate. But anyone that reads the article will see there is this "basic" flaw mentioning that DDoS attacks gave access to the server. If you read past (paid) articles about this very same service, you will see claims about how secure the system is, and how expert everyone that developed it is. The same was claimed by inputs.io, I'm sure you have read about that story earlier. The thing is, if you want to use bitcoin, you cannot trust third parties to hold your coins for you. If you want to support bitcoin in your business, you cannot trust other sites to handle the payment for you. Yes, it is not convenient. But you have everything available to handle this yourself and, yes, you will need someone competent to do that for you if you are not into it. Bitcoin is not meant for the average user or the unaware merchant and it might never be, people need to start accepting this fact. This is almost an exact copy from the other thread here https://news.ycombinator.com/item?id=6793984 https://news.ycombinator.com/item?id=6793984. I assume it is fine as it is ok to post duplicates like this topic.
- TrainedMonkey 13y ago
  Reading between the lines you are suggesting that this vector of attack had to come internally from BIPS? Given how much bitcoin price soared it is not unreasonable to question whether one of the engineers there had his price named.
  - nwh 13y ago
    I don't think they're suggesting that, more just gross incompetence on the part of the developer, and a little bit of liberty about how "secure" the systems they have created actually are. It's a lot like inputs.io, a web wallet compromised because the developer used Linode to protect millions of dollars. The developer of that particular service paid back about the half the funds then disappeared. > BIPS was built by passionate bitcoiners and talented developers. BIPS is hosted in our private server facilities. Passwords are stored with a double salted SHA-512 hashing algorithm. Our entire website is protected with AES RIJNDAEL 256 encryption and we have encryption of data traffic with 2048-bit, highest assurance Extended Validation SSL certificate, with 99.9% Browser Recognition. > BIPS protects your payment information with industry-leading security and fraud protection. On top of this, our server/database is regularly stored on tape backups. For added security you can also enable Secure Card and Google Authenticator at any time for up to 3 levels of authentication.
    - Crito 13y ago
      Appearing to be incompetent in some circumstances may be a pretty good cover. If you are a security guard at an art museum, and buddies with some art thieves, then it might be in your best interest to get yourself a reputation for sleeping on the job.
    - TrainedMonkey 13y ago
      So if he gotten over 50% of stolen funds as his `fee` he could end up ahead? But yeah, given that he paid back half of stolen funds this angle does look weak. Is it possible to launder stolen bitcoins on Chinese exchange?
    - tetha 13y ago
jakejake 13y ago
I've heard of DDoS attacks used to divert the admins attention while a real attack is occurring. Also I know packet flooding can cause some network hardware to switch into a lower security mode in an attempt to handle the load. I'm not sure if either of those apply in this case, though. I definitely am not a network or security expert.
- meowface 13y ago
  Right, they're used as distractions fairly often. The rest of the explanation makes no sense though; that is, I don't see how the DDoS would then "make the system vulnerable" to Bitcoin theft. Unless it was something like where the attackers already had access, but most everything was kept in cold storage and they wanted to force them to move a lot of BTC into their live wallets.
aray 13y ago
How can we be sure that the attack wasn't inspired/originated by the site itself? Similar to how an EVE bank exited with everyone's funds after operating for almost a year[0] [0] http://massively.joystiq.com/2011/08/12/biggest-eve-online-scam-ever-recorded-nets-over-a-trillion-isk/ http://massively.joystiq.com/2011/08/12/biggest-eve-online-s...

That technical explanation sounds almost like word salad. How did a DDoS hit your SAN in the first place and how did your SAN blowing up allow a compromise?

by skorgu 13y ago

That technical explanation sounds almost like word salad. How did a DDoS hit your SAN in the first place and how did your SAN blowing up allow a compromise?

mmmooo 13y ago

iSCSI san, so attached via ethernet or similar, taking network devices offline would take san offline. The rest is pure magic.

packetslave 13y ago
If your iSCSI network traffic can be impacted by an Internet-based DDoS, your network architect is an idiot.
- mmmooo 13y ago
  yep, sounded like they shared switches between public and iscsi lans, or worse.
JoachimSchipper 13y ago
Re: pure magic: perhaps the SAN is willing to talk to whoever sends it packets, and/or to be administered by whoever can enter admin:admin into a poorly-secured web interface as soon as it loses the appropriate connection/reboots due to overload/..? I agree with my sibling comment that this seems an odd way to install a SAN.

cryptocoin 13y ago

If you are new to bitcoin-related sites, you might find this story close to legitimate. But anyone that reads the article will see there is this "basic" flaw mentioning that DDoS attacks gave access to the server. If you read past (paid) articles about this very same service, you will see claims about how secure the system is, and how expert everyone that developed it is. The same was claimed by inputs.io, I'm sure you have read about that story earlier. The thing is, if you want to use bitcoin, you cannot trust third parties to hold your coins for you. If you want to support bitcoin in your business, you cannot trust other sites to handle the payment for you. Yes, it is not convenient. But you have everything available to handle this yourself and, yes, you will need someone competent to do that for you if you are not into it. Bitcoin is not meant for the average user or the unaware merchant and it might never be, people need to start accepting this fact. This is almost an exact copy from the other thread here https://news.ycombinator.com/item?id=6793984 https://news.ycombinator.com/item?id=6793984. I assume it is fine as it is ok to post duplicates like this topic.

TrainedMonkey 13y ago
Reading between the lines you are suggesting that this vector of attack had to come internally from BIPS? Given how much bitcoin price soared it is not unreasonable to question whether one of the engineers there had his price named.
- nwh 13y ago
  I don't think they're suggesting that, more just gross incompetence on the part of the developer, and a little bit of liberty about how "secure" the systems they have created actually are. It's a lot like inputs.io, a web wallet compromised because the developer used Linode to protect millions of dollars. The developer of that particular service paid back about the half the funds then disappeared. > BIPS was built by passionate bitcoiners and talented developers. BIPS is hosted in our private server facilities. Passwords are stored with a double salted SHA-512 hashing algorithm. Our entire website is protected with AES RIJNDAEL 256 encryption and we have encryption of data traffic with 2048-bit, highest assurance Extended Validation SSL certificate, with 99.9% Browser Recognition. > BIPS protects your payment information with industry-leading security and fraud protection. On top of this, our server/database is regularly stored on tape backups. For added security you can also enable Secure Card and Google Authenticator at any time for up to 3 levels of authentication.
  - Crito 13y ago
    Appearing to be incompetent in some circumstances may be a pretty good cover. If you are a security guard at an art museum, and buddies with some art thieves, then it might be in your best interest to get yourself a reputation for sleeping on the job.
  - TrainedMonkey 13y ago
    So if he gotten over 50% of stolen funds as his `fee` he could end up ahead? But yeah, given that he paid back half of stolen funds this angle does look weak. Is it possible to launder stolen bitcoins on Chinese exchange?
  - tetha 13y ago

jakejake 13y ago

I've heard of DDoS attacks used to divert the admins attention while a real attack is occurring. Also I know packet flooding can cause some network hardware to switch into a lower security mode in an attempt to handle the load. I'm not sure if either of those apply in this case, though. I definitely am not a network or security expert.

meowface 13y ago
Right, they're used as distractions fairly often. The rest of the explanation makes no sense though; that is, I don't see how the DDoS would then "make the system vulnerable" to Bitcoin theft. Unless it was something like where the attackers already had access, but most everything was kept in cold storage and they wanted to force them to move a lot of BTC into their live wallets.

aray 13y ago

How can we be sure that the attack wasn't inspired/originated by the site itself? Similar to how an EVE bank exited with everyone's funds after operating for almost a year[0] [0] http://massively.joystiq.com/2011/08/12/biggest-eve-online-scam-ever-recorded-nets-over-a-trillion-isk/ http://massively.joystiq.com/2011/08/12/biggest-eve-online-s...