More than $215,000 stolen from Bitcoinica in Linode incident | Hacker News Reader

More than $215,000 stolen from Bitcoinica in Linode incident

bitcointalk.org

102 pointsredegg55 comments

Ah, Bitcoin. Security amateur hour. Again.

Seriously, trusting ~$200 000 to the security of a general-purpose VPS provider? With no failsafes of any kind? Ever notice how real banks don't do that? Even if you don't want to build your own data center, you could at least chat with http://www.thebunker.net/colocation/ or another properly-paranoid data center.

At least these guys didn't leave all their Bitcoins on this machine...

> Ever notice how real banks don't do that

https://news.ycombinator.com/item?id=3656063

+1. The real issues here are that the coins were all stored in a hot wallet, and that wallet was on a VPS. For some bizarre reason people have started to act like having a VPS is as good as running a dedicated box with a backup power supply and physical (cage) security. A VPS is just a big shared server dolled up with OS partitions. There's no reason to assume that a the provider doesn't have non-physical root access to all the accounts, or that a single compromised account can't escalate via god-knows what kinds of buffer overflows or other exploits into gaining control of the whole machine.

I run a Bitcoin site that keeps a very small percentage profit out of a relatively large amount of coins in and out, which have to be held in trust for customers. Not only is our bitcoin daemon not running on our webservers (it's got its own dedicated box with all unnecessary ports closed and a vicious denyhosts policy that's locked me out more than once), we also set up low limits to immediate withdrawals so that no more is stored in the hot/withdrawals wallet than could be withdrawn immediately by players currently online (usually no more than $250), with all larger withdrawals processed in batches on demand. That lets us offload the excess coins to another wallet as soon as they're deposited, so in the worst-case scenario we might lose a couple hundred bucks. The cold wallet is stored in a truecrypt archive on a thumb drive in my pocket, with an encrypted backup stored on a server in a third country, manually, with each batch transaction. Moreover, a lot of our funds are moved out into USD and held for safekeeping to avoid excess Bitcoin risk.

This is why banks keep their money in a safe, not in the little drawers in front of the teller. And no offense to Zhou, but this should have been the obvious step to take from the beginning. Hopefully they'll do it now.

So they looked for connections to the IRC channel bitcoin uses to find linode IP's (or portscanned linode, but why bother when every bitcoin daemon hangs out advertising its IP on IRC?).

And they stole from at least 3 systems. One had $5; one $15 thousand, and one had nearly a quarter $million. Which makes me curious why they bothered with the $5 account at all. It's like robbing a bank, and stopping to smash a gumball machine in the lobby on your way in or out.

My guess is that the attackers have a fully automated exploit payload that transfers the bitcoin out. And ran it on every system they could get on, indiscrimitely. So this is not a one-off. I'd be very cautious about running the bitcoin daemon, at least without setting noirc=1 in its configuration.

My guess is that the attacker doesn't know how many bitcoin were stored on the target's.

The alternative is that they knew Bitcoinia was hosted on Linode, and when this customer service exploit became available for purchase on the 0day market (or whatever), they went in explicitly targeting Bitcoinia, but not knowing which IPs on Linode belonged to it. It's not clear if Bitcoinia separated its web server VM from its bitcoin VM, and if the attackers didn't know, it'd be best to target all the IPs.

Bitcoinica's web server is hosted on rackspace (through Heroku). They would likely have been able to determine that bitcoinica's bitcoin daemon was hosted separately on linode, by watching the ip addresses broadcasting withdrawal transactions. It is likely that bitcoinica was the target in breaching linode.

Bitcoin faucet had 5 BTC or $20, but it was a service operated by the lead developer of bitcoin, Gavin Andresen. I think the attacker was just showing control of all of linode (rather than individual services). Also a bit of flexing, as he did when crafting a transaction size of 1337 bytes[1] using the stolen coins.

http://blockchain.info/tx-index/2893660/d9804de366aa4c2a0156...

They bothered with the $5 account because by stealing a wallet, they'd not only acquire its balance but also any future incoming transfers to one of its addresses.

I'm not trying to troll here at all, but if "$215,000" worth of bitcoins are stolen, do the authorities investigate as they would $215,000 worth of cash?

Is there taskforces that recognizes this? or is it just the wild west?

Unlikely. It's worth $215k on some open markets. But that's highly variable, so it's not obvious that it's actually worth that amount of USD.

And yes, it is like the Wild West. That's part of the point of BitCoin, there are no chargebacks, and no-one can freeze your account. Once the money moves, the money moves. This has disadvantages if you are the victim of a theft (like this) and you're bitcoins are essentially gone.

I feel incidents like these raise an interesting question about the long term credibility of any crypto currency system. For instance if a traditional nation state felt its monetary system was threatened by a crypto currency could they employ an organization such as the NSA to attempt to undermine the credibility of the crypto currency in this way? I know its a very speculative proposition but it makes one wonder if even in a geographically agnostic realm like the internet the force of a nation state is required to maintain crediblity/stability for a new money system.

Much larger thefts than this in $USD happen pretty frequently, you just don't hear about them that much. I don't know how the government could guarantee any credibility (Edit: beyond already existing measures, this was theft so if the thief is caught there is punishment available and if Linode was negligent they might also be liable)--the stability is inherent in the network. All the BTC thefts have been to improper security measures taken by the owner(s) and in some cases a misplaced trust in the security of others. Anyone or group with over 1000 BTC in one place should be taking way more security precautions than these guys.

could they employ an organization such as the NSA

The NSA is a US Governmental organisation. I don't they are available for private tenders.

However there are loads of private security companies.

I am not well-versed in the technical details behind bitcoins, but does the nature of bitcoins make them vastly easier to track than normal currency? E.g. if the attackers try to cash out or transfer the stolen bitcoins, is it much easier to flag them?

Where the money goes is all publically available, yes. But it can be split up and fed through any number of accounts (you can make as many accounts as you like) to try to launder it. Also, does Silk Road care where the bitcoin being used to buy drugs came from?

I believe Silk Road is operated by actual agorist, or market anarchists to be more general. If that is true, even they would care about where the money comes from, especially if it is stolen money.

Not if you know what you're doing, no. Investigations of previous thefts have shown that you can't really hide bitcoins by shuffling them around. However there is a number of bitcoin addresses from services like exchanges that you can transfer bitcoins into and then out of to effectively launder money. An investigator would need the cooperation of the exchanges to track this money. The attacker will almost certainly move this money through a half dozen or more exchanges in equally many legal jurisdictions. Good luck following that trail.

$215,000 is bigger than the size of an average bank robbery ($5,000) source: http://www2.fbi.gov/ucr/cius_02/html/web/specialreport/05-SR...

This reminds me of a tangentially related incident where government servers were physically stolen by people dressed up as technicians. Even if you co-lo a dedicated server, if you store enough coins there, it becomes an attractive target for an attacker with some inside help.

This is not an average Bitcoin "robbery" either.

Aside from all the issues that plague bitcoin, what would be a more secure way of 'touching' the wallet.dat file?

Keep in mind that:

1) IO is expensive

2) the file will not be encrypted

3) the file will/should not be hosted on the same machine

4) the file will be accessed in excess of 1,000,000 times a day; maybe more.

The only thing I can think to do is do all the transactions with imaginary bitcoins until the end of the day then, at night, push all the transfers; almost like banks do.

It seems like it would be feasible to split the coins across wallets, with more hassle surrounding the wallet with most of the coins.

I can't think of any huge disadvantage to manually managing the float on the transaction server.

So I've a question about situations like this. I believe that a chain of transfers can be created with bitcoin. So couldn't a blacklist be created? That would allow users to ignore illegally obtained coins?

In theory yes, in practice no. There is nothing in the bitcoin design to allow this. The only real way to do it is to fork bitcoin and to get everyone to change to your new rolled-back block chain. Not everyone will agree (since co-ordinating all these people to change at about the same time is hard), and hence you'll have 2 different versions of bitcoin.

This also removes features of bitcoin that some view as advantages, namely that there are no chargebacks and no-one can forcibly remove your funds. In bitcoin, once you have it, no-one can take it from you (unlike, say, paypal). This has disadvantages if you're the victim of a theft. Bitcoin is also a decentralised system, so you'd have to convince everyone that you are the victim of a theft, and that these transactions are to be rolled back. Other wise someone could pay for a service in bitcoins, then try to get everyone to roll back the transaction, and hence deprive someone of the bitoins.

No dollars were actually stolen. Dollars are a real currency, the kind you can put in real banks so this kind of thing never happens to you.

Oh, traditional banks have never been hacked and dollars transferred? Somehow I'm not buying it.

Traditional banks have insurance which protects them in case money is stolen:

http://www.fdic.gov/consumers/consumer/information/fdiciorn....

Individual cash deposits are also guaranteed by governments in most countries.

Bitcoins are not controlled by any government or central bank, but neither are they backed by one. And here we see the downside of that trade-off.

That doesn't mean banks won't decide to sue you if someone electronically steals your money the bank.

http://krebsonsecurity.com/2010/01/texas-bank-sues-customer-...

Um.

In that case, the customer was demanding repayment of lost money, alleging the bank's security was negligent, and the bank was basically asking the court to say "it's not our fault somebody got his username/password".

Right. Which refutes seldo's conception that bank deposits are safe due to insurance or government guarantees.

The deposit in question exceeded that which is guaranteed by FDIC.

And your summary was flat-out disingenuous; you presented it as the bank suing the customer, when in effect it appears to be the bank seeking a court declaration that the bank's own security measures were not at fault, as a response to the customer's claims against the bank.

oof, I guess that's how terrible precedents are formed. The argument of the plantiff is all wrong - it's not that the bank failed to secure some nebulous "online account", it's that the bank performed an unauthorized transfer by whatever means. Online banking credentials aren't proof of identity, and banks have continually rejected capability security (which in this case would have taken the form of dynamically-generated secrets that enable one transfer up to $X). If they can't afford to eat ~$100k every time their mostly-reversible system gets taken advantage of, they shouldn't default to offering the ability to transfer $100k to the Internet in the first place.

(and clearly bitcoin is the polar opposite, based on capabilities and being irreversible, for now)

It protects the consumers, not the banks. Same, in this case bitcoinica is honoring all the money and is swallowing the loss themselves.

It protects both. Without the insurance, the bank would have to pay the customers what it could, and then possibly die if it can't.

I think you're nitpicking. The goods stolen had a value corresponding to the amount listed. Is converting the amounts from a transaction carried out in euros to dollars objectionable? I would argue no.

Unless someone gets your bank login/pw, transfers it out, and the bank decides that you were responsible for protecting your login/pw.

http://www.wired.com/threatlevel/2011/06/bank-ach-theft/

I see what you're doing, you're being purposefully condescending. You aren't dumb enough to actually believe that something people trade for real dollars has absolutely no value. Whether you like it or not, people do use Bitcoins and a value can be assigned the same way a super model's legs can be insured for a value. Deal with it.

Yes, he's egging the crowd on, but his comment did make me wonder what the legal ramifications of someone stealing bitcoins are. If one of the account holders tried to take Linode to court, do you think a US court would even acknowledge the value of a digital currency?

China doesn't acknowledge virtual theft, which caused some problems here:

(http://news.bbc.co.uk/1/hi/technology/4072704.stm)

But a later case said that virtual property should be protected by law:

(http://news.xinhuanet.com/english/2009-05/24/content_1142726...)

Dutch authorities arrested someone for virtual theft:

(http://news.bbc.co.uk/1/hi/7094764.stm)

Here's another Dutch case, involving real world violence, which went to their supreme court:

(http://madisonian.net/2012/02/01/dutch-supreme-court-decides...)

That last one mentions US case about domain names.

I'd be really interested to hear from previous US court cases, or from lawyers, about this.

A lot of companies that deal in 'virtual goods', e.g. World of Warcraft, don't like the idea that the bits are property, because then it's hard for them to take the bits away from people (say for cheating), or if they want to shut down the servers etc.

A guy once hacked the SecondLife auction system and they closed his account: http://en.wikipedia.org/wiki/Bragg_v._Linden_Lab

I don't recall the details, but I think there was another case (in a Starwars MMO?) where the hacker "got a way with it" and build a house for the money. His buzzer plays the games theme-music :)

Bitcoin's status as a currency may not even be relevant. Your car isn't currency, it's property. If I steal it, I will be charged with theft relative to the value of the car.

I can't see how Bitcoins would be treated any differently. They're property, and they can be readily traded at an established value, so I don't see why someone couldn't be charged for stealing them.

They did not "steal" them, they merely made a copy. The original owner still has their sequence of numbers. Snarky perhaps, but every possible argument one can make about why torrenting a video is not theft applies equally to the "theft" of bitcoins.

Wrong, actually. Read up on how bitcoin (or cryptocurrency in general) works.

I'd love to see that tried in court. I have a feeling that argument won't work very well. I have some limited experience in this area, as I worked for a bankruptcy trustee for a number of years. Debtors tried all manner of convoluted arguments to escape the spirit of the law. Judges have very little patience for that sort of thing.

The judge will make a limited effort to understand Bitcoins, but the core question will remain, "what harm was done and who was it done to?" The "owner" of the Bitcoins was, unquestionably, deprived of value.

So see it however you wish: Bitcoins as tangible property that was taken, or Bitcoins as tangible property that was irreparably damaged. Either way, the judge will ask the same question. Who was harmed and how?

Escaping the conclusion that the attacker's actions are responsible for the loss of value is impossible. You can bet that the State will consider these arguments very carefully if they catch the perp and bring charges against them. From there, it's up to the defense to find a jury so dumb that they'll buy the "Bitcoins aren't property" argument.

Regarding the arguments relative to video torrents, I believe this to be an error in logic. If I copy a video from a friend, that friend can continue to derive the original value from the video. That is, the friend can continue to watch the video and enjoy it. The act is different in that the original holder of the Bitcoins can no longer use them once they have been "copied" (to use your terms).

In this case the original numbers are totally worthless since they were transfered to someone else. The original owner has been completly deprived of the property.

"I see what you're doing, you're being purposefully condescending."

I'm pointing out the obvious. X bitcoins could be "worth" 5 cents or 500,000 in a matter of hours. Bitcoins were stolen not dollars therefore an accurate headline would say how many bitcoins were stolen and possibly the USD (or whatever) value parenthetically.

"You aren't dumb enough"

Stay classy.

"to actually believe that something people trade for real dollars has absolutely no value."

I never said it had no value. Baseball cards have value, no one pretends they are a currency and if anyone did people would rightly point out the many disadvantages like your baseball cards don't get the advantages of a real bank.

> I'm pointing out the obvious. X bitcoins could be "worth" 5 cents or 500,000 in a matter of hours.

So could your US Dollars.

A fiat currency only has value as long as other people are willing to accept it as payment for various goods and services. That willingness is based on the belief that they, in turn, will be able to exchange the currency for other goods and services at a later time.

The same principle applies to bitcoins. But a cryptographic currency like bitcoin has advantages that USDs don't. For example that massive amounts of bitcoins can't just be whipped up "out of thin air" like paper money can.

I don't understand the point you're making. If someone stole baseball card they'd be charged with theft. What's the difference here?

It is common editorial practice to express facts in a way that readers can easily understand. Imagine a US paper runs a story about a Japanese theft where 1,000,000 YEN are stolen. Let's assume I don't follow world currency markets, so I have no idea what the YEN:USD rate is. I might assume some level of equivalency and walk away with the impression that somewhere around a million USD were stolen. That would be inaccurate. The responsible editorial decision is to provide the reader some accessible basis for understanding the facts.

The reason you're being called out for condescension/trolling is because the point you're making is entirely irrelevant to the discussion. Is Bitcoin a real/valid currency? It doesn't matter in the context of this theft. What's relevant is the value of those Bitcoins at the time they were stolen. That's how matters of theft are assessed. Criminal charges are levied based on the value of the items stolen.

Another thing to consider is the thoughtlessness of discussing the relative merits of Bitcoin as a currency when someone just lost a couple hundred thousand dollars. Someone's life is sucking really hard right now, and pedantry is a great way to put people off. This just seems like a really inappropriate time and place to have that discussion.

I wish people would quit using Linode. They have a track record of having security issues, they are not PCI compliant; and unless they replace every single last BTC, I am going to just go ahead and state they never did care about their customers.

I just can only hope the attacker spends the BTC instead of burns them: burning would do far more damage to Bitcoin than just stealing them.

>I wish people would quit using Linode.

Yet another man who wants to punish honesty? They could claim that the attacker used the proper user credentials to login on the server and nobody would be able to disprove that.

>They have a track record of having security issues

Please, provide a proof-link.

>they are not PCI compliant;

No credit card credentials have been stolen. It's that bitcoin service kept the keys insecurely. Bitcoin transactions should be signed on a machine w/o public access from the Internet (1) and have a threshold for transactions which have not yet been reviewed manually (2). Having these two practices implemented they would lose not more than that threshold (say, $1k-$5k).

>and unless they replace every single last BTC, I am going to just go ahead and state they never did care about their customers.

I have not heard about such a practice in the digital world. Nobody can make a 100%-secure system. But everyone can stay honest and improve security when a vulnerability has been found.

> they are not PCI compliant

They're a VPS host. I mean, cats aren't PCI compliant either, but it doesn't say much.

You shouldn't be using a VPS for this sort of thing for many reasons, mind you.

It is possible for a VPS host to become PCI compliant. Amazon EC2 is, for example.

I ll also boycott linode, calling this an incident and repeating "Ensuring the security of our platform is our top priority" and "Security is our number one priority and has been for over eight years." is clearly not enough.

Reply on news.ycombinator.com