32 ms·
Mt. Gox Has Been Hacked by People Trying to Find Out What Happened?
- zoba 13y agoIn case my server goes, here is the text: Right now in ##mtgox-chat someone named nanashi____ claims to be speaking for a group of hackers who have gotten into Mt Gox in an attempt to figure out what happened. Nanashi says they have a DB dump and are looking at what to do with it. Nanashi gave these links: A conversation in Japanese with Karpeles and a Banker (http://picosong.com/Y7di/ http://picosong.com/Y7di/) Some Mt Gox Code (http://pastebin.com/W8B3CGiN http://pastebin.com/W8B3CGiN) Nanashi also posted personal information on those employed by Mt Gox including phone numbers and addresses. Nanashi says the group plans on releasing more info. Nanashi also said they group plans on not releasing the huge store of passport scans they found… Hopefully this group has the public’s best interests at heart.
- jychang 13y agoThey have passport scans? I'm impressed by how hard MtGox is fucking up.
- deleted 13y ago[deleted]
- badman_ting 13y agoYeah, that is really something. To think that people actually supplied that info. Wow.
- buro9 13y agoI didn't, I signed up to an account and stopped at this point because unlike a financial institution they are not governed by laws that require this or would ensure the security of such data. But I totally understand why people did supply it. They supplied it because: 1) They've been trained to 2) For a while MtGox was actually the most well-known (and therefore trusted) of the exchanges On #1, every financial institution in the world goes through some form of KYC (Know Your Customer) anti-laundering process that involves identity verification. And people are so used to doing this when signing up to financial accounts that they failed to comprehend that MtGox (and other exchanges) is not a financial institution being regulated by the same safeguards for their data. On #2, even if you accepted that they were not a financial institution almost all of the bitcoin exchanges are asking for verification. And the larger more well-known exchanges are viewed as "least risky". It's a herd-like mentality, if these thousands of others did it, it must be safe. I never supplied the info, to this or other exchanges, but I totally see why excited people who feared missing out as the price rose were willing to do so.
- badman_ting 13y agoThat is a rather charitable way of looking at this situation. Which is to be commended, I wish I was still capable of thinking that way.
- ealloc 13y agoI signed up before they had ID verification about two years ago, and deposited a little money. Then a few months later I'd had my fun and I wanted to take my money back, but discovered they wouldn't let me withdraw unless I provided ID. After some back and forth with them I somehat angrily provided ID and got my money returned. It later turned out that they had either been dishonest or incompetent in their argument for providing ID, and I got them to promise me that they had deleted any and all ID docs I sent them, specifically because of scenarios like this one. Well, I hope they were telling the truth.
- justincormack 13y agoMoney laundering legislation in Japan may well apply to them.
- ssg_rolson 13y agoI am sure it said that they will 'dispose' of the scans after 2 weeks. Looks like they fucked up again!
- twistedpair 13y agoOn the interwebs 'temporary' is forever.
- jmomo 13y agoThis is why I have had to stop using a number of services which requested a photocopy of official government documentation. I am specifically thinking of how I had to dump my Dwolla account.
- astrodust 13y agoDon't worry. Your documents will be there forever.
- sentenza 13y agoAlso, we now see that the Wild West metaphor for Bitcoin banking carries quite far. If you fuck up in the wilderness, you'll not only be sorry, but you'll also be ripped apart by the wolves! Maybe this can serve as a warning that the tedious processes used by banks and other institutions handling "serious" money can't just be disrupted away.
- Gigablah 13y agoIn case anyone's wondering, "nanashi" means "anonymous" in Japanese.
- sounds 13y agoThanks, zoba. Here is the link you added to the IRC transcript: http://pastebin.com/N7B5DC4d http://pastebin.com/N7B5DC4d "Nanashi" (japanese: Anonymous) claims to be in Serbia, but posting on behalf of a Russian group.
- nothxbro 13y agoOk, some good news. It might be untrue about them having passport scans. Reason I say that, is the following: We know from the leaked mtgox crisis plan doc that they have 550,000 verified accounts. Each user who wanted to be verified had to scan at least 2 documents- a passport+license and a electric bill of sorts. Assuming both documents alone were only 100KB combined (and its likely way more than that since scans are usually 500KB+ per document) than we can estimate the file size: 550,000 x 100KB = 52.45GB Thats more than double the claimed 20GB. In fact, even if we believe that every persons doc is in the DB; and assuming nothing else but passports is in there- you are only allowing for 20KB per document
- ekianjo 13y agoespecially since they required passport scans in color and high resolution (at least 200 dpi).
- mschuster91 13y agoIt is possible for them to extract the MRZ data of the passport (the Machine Readable Zone), it contains the passport ID, issuer state, DOB and DOE. I don't know if the regulatory requirements state that you must keep a photocopy, but in case you do not it would be foolish to store more data than you need.
- alcari 13y agoThat may be possible, but they also accepted non-passport images, which don't necessarily have such information.
- bencollier49 13y agoPerhaps Gox lost two thirds of them. Or the hackers didn't download them all.
- talkingquickly 13y agoMy impression was they were claiming to have passport scans and a 20GB DB dump, e.g. that they were separate?
- quickpost 13y ago> Nanashi also said they group plans on not releasing the huge store of passport scans they found… Hopefully this group has the public’s best interests at heart. Good lord. Lose all your bitcoins AND your identity. Mt. Gox can't go away fast enough!
- ck2 13y agoWTF is all that doing on a web-accessible server.
- mtgoxloser 13y agoReposting what I commented in the other thread since the post was deleted. -- I just saw this also in ##mtgox-chat. What legitimized this was the fact there was a portion where MtGox connected to Eligius's servers to broadcast free transactions. Eligius and MtGox had a partnership where MtGox provided free hosting for their pool in return for their acceptance of MtGox's transactions with no charge.
- SkynetSystems 13y agoCould these hacking incidents against Mt Gox have been the work of the NSA? It is extremely unlikely to be Karpeles because hurting Mt Gox would send the price of Bitcoin tumbling, so he would be stealing from himself. It could be other staff that worked for him or maybe just organized crime, sure. But who really has a motive to destroy faith in cryptocurrencies by hurting trust in the exchanges that make it appealing to use by everyday people? Mostly the American government, which does not want to see any competitor to the dollar as a global international reserve currency. I'm not saying Bitcoin was going to take that spot, but when Bitcoin suddenly gets popular internationally and even the Central Bank of China is talking about it, there is definitely a looming threat that exists for the dollar. We know the NSA has managed to attack all kinds of routers, firewalls, and servers. We know they conduct acts of sabotage against so called enemies, and we know they have the expertise needed to exploit the weaknesses in the system. Now obviously this is just speculation, but I think simple theft doesn't make sense if you know you won't be able to dump a large amount of stolen Bitcoin without being noticed, and without also losing a lot of money from the panic you created in other investors.
- nathan_f77 13y agoWow, that's a lot of my personal data leaked in these last months. My email and encrypted password in the adobe breach, my user id and part of my mobile number via SnapChat, and now hackers potentially have scans of my passport courtesy of Mt. Gox. I'm probably forgetting about some leaks, and who knows how many security breaches were never discovered. The internet is not a safe place.
- nwh 13y agoI'm still getting almost daily phishing/malware from the Mt Gox leak in 2011, and I never even signed up for anything more than to see what it's interface was like. Can't imagine how that will be with people having copies of passports (supposedly).
- claudius 13y agoMy spam folder is also full of, well, spam addressed to the email address I supplied to Dropbox (and only Dropbox) when I first signed up there sometime in 2011 and later leaked (I think 2012). Sometimes I wish data privacy laws were stricter, but it appears that not even financial services laws are sufficiently strict, as just demonstrated here.
- nwh 13y agoPretty much what mine is too, a pile of spam from various compromises services I should have done better than to trust. Mt Gox, Dropbox, Bitstamp (yeah, they never made a big mention of that one) and a variety of other small services.
- Cthulhu_ 13y ago> Sometimes I wish data privacy laws were stricter I think the laws and awareness are good enough atm, but no laws and probably no amount of knowledge or auditing will stop a data leak from indadvertedly occurring.
- claudius 13y ago
- protomyth 13y agoWhy do they have passport scan?
- zoba 13y agoIdentity verifications.
- sdrothrock 13y agoEdit: I misread the original post and thought they were scans of employee passports. Apparently a personal verification option was a scan of a passport. I still have no clue why this kind of information would be kept on a public-facing server. It's reaching a bit, but they may be scans of passports for foreign employees who need to be registered with proof of identity but do not (for whatever reason) have a form of identity that the Japanese government considers "official."
- jpalomaki 13y agoProbably customers send them to identify themselves.
- pmorici 13y agoIt was part of the account creation process to verify your identity. You had to send in a government issue id and proof of address. I believe I sent in a copy of my drivers license and a cable bill but passport was also an option. I wouldn't be surprised if they have access to all the data that was collected for KYC purposes.
- pmorici 13y agoThe Reddit thread on this has a bunch of links to paste bins being posted.... http://www.reddit.com/r/Bitcoin/comments/1zeurx/alleged_mtgox_code_leaked_on_irc_node_by_russian/ http://www.reddit.com/r/Bitcoin/comments/1zeurx/alleged_mtgo...
- gklitt 13y agoI'm fluent in Japanese. I listened to the beginning of the recording and it's legit. One of the voices is almost certainly Mark Karpeles' (based on hearing his voice in his recent public apology -- his Japanese is broken but reasonably proficient). It seems to be a recording of a Jan 30 2014 meeting where bankers from Mizuho Bank are asking Karpeles various questions about Bitcoin, the nature of his business, his partnerships in different countries, connections to underground activity, etc. Definitely not something that's meant to be publicly released. EDIT: Listening to snippets from the rest of the recording, it seems that Mizuho is explaining that they want to cancel Mt Gox's accounts with the bank. Karpeles seems to be protesting and asking why the accounts are being shut down. The guy from Mizuho explains (at 28:00 for Japanese speakers out there) that it's a combination of a lot of factors, including recent technical issues, which make the bank uncomfortable dealing with Mt Gox. Karpeles also mentions following the orders of the Financial Services Agency (金融庁） EDIT2: 15:00~16:10: Mizuho guy explains that the Mt Gox bank accounts will have to be shut down eventually. Karpeles says that he understands that position, but he thinks that the bank has been rude about trying to force the closure, and would appreciate a more cooperative approach. EDIT3: 18:00~19:00: An awkward discussion of Karpeles' Japanese. The Mizuho person seems to be offended by Karpeles' rude Japanese, which frequently lacks the correct honorifics that would be expected in a business setting. A woman (I think she's on the Gox team?) explains that Karpeles' first language is French and that he means no offense. I can work on a fuller description of the call, but just wanted to get a quick verification of its authenticity out there, along with some snippets of the contents.
- sillysaurus3 13y agoPlease consider typing out a full English translation. If you post your bitcoin address here, then I'm sure plenty of people here will pay you some coin for your effort.
- zoba 13y agoAwesome, thank you for this.
- pmorici 13y agoThere are additional comments about this call in this reddit thread... http://www.reddit.com/r/Bitcoin/comments/1zepgt/mark_apparently_leaked_conversation_with_a_bank/ http://www.reddit.com/r/Bitcoin/comments/1zepgt/mark_apparen...
- McGlockenshire 13y agoThe code is ... interesting. Smells organic, not designed. Comments are rare but usually useful. Highly coupled. Static methods everywhere. Violates SOLID principles. Basically, ignores current best practices. Clearly not designed for any sort of automated testing, which should be the first damn thing you do when there's any sort of money involved. Hell, even when there isn't money involved. We'd already guessed that last bit, given the previous mentions of them having no testing/staging/QA environment.
- pinaceae 13y agono shit, magic the gathering exchange is not coded like paypal.
- aegiso 13y agoWay too much schadenfreude given Gox's history. Although contrary to popular belief Gox was never a Magic exchange, they were a Bitcoin startup at a time when Bitcoin was not much more than internet lols and pizza deliveries. The first thing you do when hacking together a stupid exchange for a joke e-currency isn't writing unit tests. You just write the code and blast it up on a domain you had lying around for a different project. Cue runaway success, a company sale or two, scaling issues with complicated technology and not much precedent legal or otherwise, and this is what you get. There is nothing at all surprising about this code. And it seems Gox's problems were much more deeply rooted than the subjective non-compliance of their code with "best practices".
- McGlockenshire 13y ago> contrary to popular belief Gox was never a Magic exchange The Wayback Machine disagrees. http://web.archive.org/web/20070701000000*/http://mtgox.com http://web.archive.org/web/20070701000000*/http://mtgox.com Whether it was open as one is unclear, but that was the obvious intent here. Also, remember that the current owners aren't the original owners. This code is wrong in design but new in attempted style, made or majorly updated within the past year or two (based on the language features used).
- snitko 13y agoThis will be another excuse to not release any official specific information about what happened.
- viraptor 13y agoThought I'll quickly scan the source code... On the first screen: $bean->Coins = (int)round($info['balance'] * 100000000); Really? Currency as a float and rounding? Just so that he can later: $client->sendToAddress($addr, $bean->Coins / 100000000); I'm ready to believe in any error "due to a bug" they claim now.
- negamax 13y agoCan you explain what's wrong with this? If I had 1 million in $info[ 'balance' ]? Would $bean->Coins overflow?
- reikonomusha 13y agoUsing floats to represent currency is a big no-no. Floats have limited precision, and some numbers aren't representable by floats. Go try adding 0.1 to itself over and over again in your favorite implementation. It is better to represent as integers or fixed-precision numbers. That way, you are dealing with exact quantities.
- negamax 13y agoTo me it seems like floats are being converted to int and then code is working with it. I don't think this will create an issue unless the int is overflowing. Any failing testcase?
- SixSigma 13y ago> some numbers aren't representable by floats an infinite number of them in fact
- deleted 13y ago[deleted]
- SixSigma 13y agoTuring proved there's an uncountable set of numbers that cannot even be computed let alone represented
- atmosx 13y agoSo what you have here is: * People who know how to properly right code, don't mess with bitcoin because they understand the involved complexity and high risk of error since money is at stake * People who don't give a damn about the complexity and are prone to risk, but lack the technical skill to support their ventures (MtGox was 50% of the time not scaling well enough. The website was slow even when not under DDOS). What MtGox shows, IMHO, is that there's a market out there for serious, professional-grade bitcoin exchangers.
- psykovsky 13y agoWhat we have here is one person who can't write write right.
- sushijain 13y agoLike putting salt in the wound . Credibility shot. Abort mission
- cryptocurlive 13y agoGet the latest cryptocurrency news at www.cryptocurrencylive.com/newest
- patio11 13y agoConsider not taking advantage of the illegal compromise of someone else's servers, even if you are very interested in the contents of their purloined data. You'd hate it if it happened to your startup, and odds are your startup has plenty of ways to get into equally private data. If nothing else, consider it your moral down payment on being able to criticize the NSA ever again.
- vbuterin 13y agoExcept that MtGox is known to with very high probability have been acting criminally dishonestly and there is a strong public interest in helping people determine what happened and recover what could potentially be up to 200000 of their own bitcoins. That pretty much passes all the standard tests for an involuntary violation of privacy; this is NOT a case of hurting an innocent startup.
- patio11 13y agoThat sounds like an excellent reason for a judge in Tokyo to issue a subpoena. It does not sound like an excellent reason for the Internet to vicariously participate as a group of Russian hackers roots their boxes.
- simias 13y agoWho are you talking to exactly? The hackers? I doubt they care. HN readers? How are we taking advantage of anything exactly?
- scotty79 13y agoThe thing with NSA is not about privacy. It's about goverment violating it en masse in vastly useless and potentially malicious even Orwellian schemes. I don't mind hackers doing what they must because they can. I consider them force for good when they get into rich and poweful peoples drawers and publish things. It's a reminder that no matter how rich you are and how many laws you have bought you are never outside of public scrutiny.
- j45 13y agoIf true, this article provides an example why I will not feel comfortable scanning or emailing my license or passport online, without sufficient reassurances.
- deleted 13y ago[deleted]