13 ms·
Update on Coinbase Data Security
- pbreit 13y agoLess sympathetic than I was hoping for but copacetic. Could they have nipped this in the bud with a faster response? Perhaps. However having dealt with reports like this, I cannot recall a decent interaction with a reporter.
- bertil 13y agocopacetic : in excellent order. (For the lazy like me, who still want to learn new and useful words.)
- Einstalbert 13y agoMany people automatically assume that this word means something bad. Something about "cetic" makes them think "septic" or "toxic" even. I've had to explain the word a few times to co-workers. I picked it up from a crappy song, come on guys!
- bbrian 13y agoThree-finger click on OS X defines the word. Or right-click and Look up in Dictionary.
- bertil 13y agoIndeed, and a great trick too — but that appears to be a great but non-default option, only working within Apple software (namely Safari browser when surfing HN) and uses the System language (not English for me). I personally prefer Right click “Search with Google…” in Chrome: it has the upside of coming up with a definition when the word is actually rare -- so it prevents me from defining an word I didn't know simply because I’m not a native English speaker.
- MBCook 13y agoIt works in any software in OS X using standard text controls. It's insanely handy. The few programs I use that don't support it actually drive me nuts because I've become so used to it. The system language thing is a little annoying. It would be fantastic to be able to look up the random Spanish or Japanese word, but I understand the limitation.
- drifkin 13y agoControl + Command + D also brings up the definition popover
- pbreit 13y agoHmmm...I might have to refine my use of the word. I'm more familiar with "very satisfactory" which is what I had in mind here.
- revelation 13y agoRate limiting Do we have to spell it out to them?
- relate 13y agoFrom the text: "For example, we employ rate limits around sensitive actions, such as requesting money, to prevent them from being abused at scale."
- sillysaurus3 13y agoThey don't appear to be rate limiting their API that allows enumeration of first and last names. Also, We’d also like to address the claim of a “leaked” list of Coinbase emails and user names. This list (the size of which is less than one half of one percent of Coinbase users) was not the result of a data breach at Coinbase. There are 2,040 names on the leaked list. Fun fact: that means there are about 408,000 Coinbase users total.
- MichaelGG 13y agoThe list duplicates every entry, probably another silly tactic by the "attacker" to fluff up his feathers.
- sillysaurus3 13y agoI wonder if that means there are around 200,000 Coinbase users? Depends whether they noticed the dupes. Good catch.
- trevorcreech 13y agoActually over a million: http://blog.coinbase.com/post/78016535692/a-major-coinbase-milestone-1-million-consumer-wallets http://blog.coinbase.com/post/78016535692/a-major-coinbase-m...
- sillysaurus3 13y ago
- bowmessage 13y agoNo mention of the claimed IRS / Fed gag order, interesting. (although I realize its not their main focus right now)
- zrail 13y agoIf they have a gag order and they talk about it they go to jail. Probably not going to hear any official word one way or the other.
- danielweber 13y agoThe gag-order is impossible to disprove. If anything in the release is bullshit, it's that. I would consider it screamingly obvious that Coinbase reports stuff to the IRS, because they want to run a business, not be crushed to death.
- MichaelGG 13y agoWell they can't mention it if they have it, but they can mention if they don't. So this would be the only way Coinbase could communicate that they are under a gag order, barring a prior warrant canary. So it's probably prudent to act as if they have acknowledged the gag order until they deny it. Although it'd be really dumb if anyone was assuming the records were private. I guess they could say "We have implemented a warrant canary at <url>" then 404, but perhaps their legal team wisely denied that one.
- mcherm 13y agoYes. And while we're at it, I wanted to point out that cbcbcb (who posted the initial leak) is ALSO under a federal gag order. He/she either won't deny it (because, obviously, they can't) or WILL lie and deny it (forced to lie by the gag order). Oh, and I'm under a federal gag order too... or at least there's no way to prove that I'm not.
- MichaelGG 13y agoHas it been shown that the USG can order an entity to lie?
- yid 13y agoI'm curious why, given the prior reports of security issues at Coinbase and the ongoing drama with Mt Gox, you guys didn't immediately hire, say, tptacek's company to do extensive penetration testing and a full security audit. It appears that not all API calls were rate-limited, as they probably should have been, and there certainly doesn't seem to be any sort of monitoring of brute-force attempts like this in place. With all the negative publicity around Bitcoin exchanges, you should have doubled down on security weeks ago, or at least explained the privacy tradeoffs in your design decisions clearly.
- FredEE 13y agoA few thoughts. I agree with you, which is why we are currently going through a third party security audit in addition to the impromptu peer review by Andreas the day MtGox went down and our normal reviews by accountants. We also hired a director of security from FB. Also, there were rate limits, just not well tuned enough. So it's definitely in focus for us. Hope this helps clarify (edited for formatting)
- vinhboy 13y agoThanks for coming here and addressing the community. It's a thankless job. But thank you for doing it.
- coinbase-craig 13y agoFurther, the security audit began this week before this issue. It was proactive, not responsive.
- lvs 13y agoNot to make anything awkward, but this is a far better reply than Brian's replies in this thread and on the blog.
- dobbsbob 13y agoWhat precautions have you taken against meatspace robbery? What's to stop 3 thugs with guns walking into your office(s) and cleaning out all the coins? Can you get insurance against this? Do you also have measures to prevent evil janitor attacks like hardware keyloggers being planted at 4:00am? Do you have screens facing an open window to watch from across the street? Can I rent beside your offices, drill holes through the walls and set up spycams or gain entry? Not to sound alarmist but seems no exchange has given a thought to physical security meanwhile bank execs are dropped off at work by private guards specializing in counter-kidnapping operations, even though their money is fully insured and extremely difficult to steal. Bitcoin's are easy to steal.
- scottlinux 13y agoIs there an option to opt your account info OUT of the api?
- virtuabhi 13y agoI think many users will assume, with a finance site like Coinbase, that the name they have provided is for $ transactions (taxes, Visa, MasterCard, etc.) not for social aspects. In my opinion, getting behind the Privacy Policy and claiming that users know their names will be publicly shared is unethical. Why people want to hide their names? Personally I don't hide my name. But it is not too hard to understand that on "web-scale" there will be someone who is stalked, who has posted on suicide help forums, etc.
- danielweber 13y agoWe’d also like to address the claim of a “leaked” list of Coinbase emails and user names. This list (the size of which is less than one half of one percent of Coinbase users) was not the result of a data breach at Coinbase. This list of emails was likely sourced from other sites - probably Bitcoin related ones. It’s clear there was no data breach because no other user information is provided. That last sentence is doing a lot of lifting, out of its weight class. This immediate "no it's not true" might reassure some folks, but it scares me because of how quick it is. Have you looked at the audit systems on your database? "We believe this information is bogus but are investigating to make sure" is a better response, assuming you actually do investigate to make sure.
- zorpner 13y agoYou’ll find that user enumeration is possible on Facebook, Google, Dropbox, and nearly every other major internet site. And yet, most banks & payment processors do not do this, for good reason. Seems like Coinbase is suffering from some domain confusion.
- barmstrong 13y agoAs mentioned in the blog post, payment services also commonly allow user enumeration, including Paypal, Venmo, Square Cash, and others. The reason you don't see it with banks is that they don't allow you to send money to an email address.
- waterside81 13y agoMaybe in the US they don't, but in Canada you can. I'm quite sure in most of Europe & Australia you can as well.
- patmcc 13y agoInterac e-Transfers (the only widely used method for doing this I'm aware of) do let you send money to someone via an email address, but it's a notification channel, nothing more. An account enumeration isn't possible with it, the actual email is sent some time after the money for the transfer has left the source account, and the sender doesn't get any information about the delivery of the email. I suppose you could send e-Transfers to random email addresses and then see if any are accepted, but that would cost you an absolute minimum of $0.01 per attempt and would probably have a terrible response rate. Source: this is my day job. Edit: sorry, forgot to mention this is Canada-specific.
- jgani 13y agoYou can't in Australia Source: I live in Australia
- dzlobin 13y agoI don't know about the other large US banks, but Chase definitely does and has been for years.
- tobias2014 13y agoI don't who is wrong or right here (Coinbase saying there was no breach or alledged hackers via pastebin), but isn't having fake security breaches for large bitcoin sites a good opportunity to manipulate the rates? If one wanted to bring the rate down it might be possible to do this with creating a good fake security breach of a large site.
- broolstoryco 13y agoMy email was not published anywhere with regards to bitcoin or coinbase, I receive relatively little spam, yet I received 4 of these spam messages. Smells fishy.
- downandout 13y agoWhile not ideal, I think this is being blown out of proportion by someone that doesn't like Coinbase. For starters, of the 2042 "leaked" emails, 1153 are unique. That means the person that posted it was trying to pad their results, which combined with the possible but unfounded FBI/Fincen accusations, illustrates that someone is mad at Coinbase and is lashing out. Enumeration isn't a fantastic idea, but given its ubiquity in various forms on major sites throughout the internet, I don't think it's worthy of all of this negative attention directed specifically at Coinbase either. I once wrote a program that could take a list of random emails and use Facebook to turn it into a CSV matching each email to a name, a list of their friends, their location, and interests. That should have been scandalous, but it wasn't. We are acting as pawns in someone's revenge scheme against Coinbase.
- doktrin 13y ago> For starters, of the 2042 "leaked" emails, 1153 are unique. Nice observation. I hadn't noticed it at a glance. > combined with the possible but unfounded FBI/Fincen accusations, illustrates that someone is mad at Coinbase and is lashing out. I agree. Those are bold accusations, and bold accusations require at least some proof.
- NathanKP 13y ago> For starters, of the 2042 "leaked" emails, 1153 are unique. Sure enough, when I sorted the email alphabetically I could see that whoever posted that Pastebin listed most of the emails twice to make the list look longer than it actually was.
- 13y ago
- pearjuice 13y ago>there has been no data breach of names or emails at Coinbase I have a Pastebin URL with 200 email addresses to prove the contrary. Why lie in PR?
- wes-exp 13y agoIf Coinbase can't admit any amount of fault whatsoever for enabling the large-scale harvesting of their customer list, I'm sorry, but I've lost faith in their security. This is a service that stores digital cash. It should be like an online Fort Knox, not "safe as Facebook" like that's some kind of high bar.
- deleted 13y ago[deleted]
- jypepin 13y agothey say the list is less than 0.5% of their total user base. Not sure if you can call this "large-scale".
- wes-exp 13y agoI agree that 1000+ people may not be "large-scale" depending on how we define it, but I do see it as a proof of concept that Coinbase permits large-scale user enumeration. (Not that it has necessarily happened yet)
- jypepin 13y agoYea ok, I got your point :) Now we just need to make sure the data came from coinbase directly, which they refute. They say data comes from other services - mostly bitcoin related ones.
- tptacek 13y agoIf you read the post even a little bit carefully, they refute the idea that this was a harvesting of their database. One compelling bit of evidence they present is that the list is tiny, and their customer list is very large. It's not just that this isn't a "large scale" leak; it's that they say it's not a leak at all; that this data was made available through some other combination of services that exposed it, not Coinbase. They don't provide any additional evidence (but few companies would) --- but it's a plausible argument.
- peterwwillis 13y ago(Bug report at https://hackerone.com/reports/5200 https://hackerone.com/reports/5200) From Ryan McGeehan, director of security (user magoo): > This behavior is mostly informational to an attacker and does not > directly increase risk in any significant way All information leaks are useful to an attacker. By themselves they are harmless, but can be combined with other information to successfully exploit a system. From bug reporter Shubham Shah (user zero): > This request can now be replayed unlimited times, with unlimited email > addresses inputted. Coinbase does not limit the rate of POST requests > to /transactions/request_money This should not be possible at all. The reporter must have made a mistake and forgot to mention the X-CSRF-Token needs to be updated each time. If it didn't need to be updated, this would be a basic CSRF vuln. All this being said, the real flaw here is the lack of rate limiting on transactions, for three reasons: 1. The spam will eventually mount up and ISPs will block their servers for days or weeks. 2. Their network and app stack is subject to DoS attacks unless they rate-limit transactions. 3. Harvesting of e-mail addresses would be stopped by basic rate limiting of email<->user queries.
- deleted 13y ago[deleted]
- FireBeyond 13y agoI always find my ‘skeptic’ meter ticks faster when I read of a data breach, and find a company: a) using language that is very specific when making a denial b) also introducing a new Director of Security in the same post
- dangrossman 13y agoNo new director was introduced; the Ryan McGeehan hire was in the news weeks ago.
- FireBeyond 13y agoThanks, I stand corrected. It was my gut reaction at the phrasing, all good.
- diminoten 13y agoThere was no data breach, chill out.
- razfar 13y agodoes anyone know what blogging software they are using for the coinbase blog? is it tumblr?
- dangrossman 13y agoIf you view the source, you'll see tumblr right from the first line.
- razfar 13y agothanks boss
- ParadisoShlee 13y agoYou should write a book - Babies first pentest.
- akennberg 13y agoYou can add a soft rate limit with a captcha to make sure it's a human doing the requests rather than a spammer's script.
- dangrossman 13y agoYou can't rate limit APIs with CAPTCHAs.
- korzun 13y agoDo you smell it? They believe it's not a risk to their users (never minds those users who are now targeted via e-mail leak because they have BitCoins). "You’ll also find many leading payment services allow user enumeration" They also do pattern monitoring and rate limiting. And instead of saying 'but they do it!' they should be saying 'they do it too, but we think this is a valid privacy issue that we need to fix'. This is more or less 'If you don't get privacy implications , we will bullshit you so you don't panic and go elsewhere with your money. Everything is fine!'
- jseip 13y agoInteresting to note that they did not dispute the claim (posted on HN with the pastebin data) that they are providing transaction data to government agencies.
- Aqueous 13y agoThere was no mention of the IRS and FBI gag orders/data transfer in this post.
- danielweber 13y agoBecause those were bogus. In retrospect, it should have been a huge warning sign that the entire thing was bogus. At worst (for Coinbase), they have someone reporting a legit security issue with a bunch of jokes at the top.
- Mizza 13y agoI filed a Freedom of Information Act request to the FBI about Coinbase, and they replied that they have no documents. https://www.muckrock.com/foi/united-states-of-america-10/coinbase-fbi-9727/ https://www.muckrock.com/foi/united-states-of-america-10/coi... Of course, the FBI is explicitly allow to lie in response to FOIA requests if it will protect an ongoing investigation. However, I was also told at a party by a Coinbase employee that this is not true (which is why I filed the request to begin with.) I am certain that they have a relationship.
- Ryel 13y agoI also think this whole thing is overblown but I hope it will help to further humble Coinbase in realizing that they really need to focus more efforts on squashing things like this before they become a problem. Coinbase has a large responsibility in whether or not Bitcoin is to become "accepted" in the USA and several small events like these left unsettled or left to fester could prove catastrophic(IMO). I don't believe Coinbase should consider this a real "security threat". I believe that this is a negative side-effect of what may be a feature. It is certainly something that needs improvement, as I'm sure all of the people whose email has been leaked will tell you... I'm not sure if Coinbase has an engineering blog or a similar outlet where they can speak to more developers directly but if they do not have one already, this may be the time to start. This could've been squashed entirely within a small development community but when left unsettled for so long, it is things like this that the news will latch onto and run with We all know how blown out of proportion things get when that happens. Anyway, long story short... I hope Coinbase improves. As much as I hate to say that a tech company needs more representatie
- tcarey83 13y agoI was phished for coinbase just recently with an email telling me "You just received 0.08525920 BTC" and just "Click here to sign in and view this transaction" and I stupidly I did click on the link and did try to log in. The login failed (as it would with a trojan and the coinbase 2 factor authentication I have enabled). But even so, the phishing site was able to attach 3 Android apps to my account with full access. I deleted the apps and notified coinbase, but they were totally less than helpful.
- meowface 13y agoPeople should upvote this much more. This shows that the reported exposure has resulted in at least one successful phishing. The fact that the 2 factor auth can apparently be bypassed by attaching apps is another security vulnerability entirely. If that is what you are claiming is the case, then they should be immediately fixing this as soon as you reported it to them.