×

Announcing: Slashdot Deals - Explore geek apps, games, gadgets and more. (what is this?)

Thank you!

We are sorry to see you leave - Beta is different and we value the time you took to try it out. Before you decide to go, please take a look at some value-adds for Beta and learn more about it. Thank you for reading Slashdot, and for making the site better!

DNS Hijack Leads To Bitcoin Heist

timothy posted about 2 years ago | from the don't-make-trouble-nobody-gets-hoit dept.

Bitcoin 126

First time accepted submitter FearTheFez writes "Social Engineering and poor DNS Security lead to a Bitcoin heist worth about $12000. Bitcoin broker Bitinstant was robbed after thieves managed to take over ownership of their domains. While Bitinstant claims that no customers lost any money, without 2 factor authentication all it took was a place of birth and a mothers maiden name to gain access. This looks like poor security from everyone involved."

Sorry! There are no comments related to the filter you selected.

Conviction for stealing bitcoins (-1)

Anonymous Coward | about 2 years ago | (#43124295)

I'm waiting to see whether or not someone would be convicted for stealing bit coins as no court or official government body recognizes them as being a legitimate currency. A case in this would lead to an interesting de-facto precedent being set.

Re:Conviction for stealing bitcoins (5, Insightful)

Zemran (3101) | about 2 years ago | (#43124321)

I do not think that any court or official government body recognizes your television as being a legitimate currency but I can be prosecuted for stealing it. If it has value to the owner, it can be stolen.

Re:Conviction for stealing bitcoins (0)

Anonymous Coward | about 2 years ago | (#43124359)

You can't steal data... Just like you can't steal language.

Re:Conviction for stealing bitcoins (1)

Anonymous Coward | about 2 years ago | (#43124385)

You can't steal data, but do you have the right to copy it? And can you copy bitcoin? Is bitcoin data?

Re:Conviction for stealing bitcoins (5, Informative)

TsuruchiBrian (2731979) | about 2 years ago | (#43124795)

bitcoins aren't data per se. A person's private key for their bitcoin wallet that is used to transfer ownership of bitcoins is data. It's just a long number. The proof of work used to establish a bitcoin is data. The transaction history of each bitcoin is data.

A bitcoin is more than just the data underlying it. There are may thousands of copies of each bitcoin, but at any given time only one person has the authority to transfer a bitcoin to someone else.

A bitcoin itself cannot be copied. To copy a bitcoin would mean copying it's ability to be spent (allowing it to be spent twice). This would ruin any currency. And much of the design of bitcoin is prevention of double spending.

This is similar to how xeroxing your bank statement doesn't double the amount of money you have in the bank.

Re:Conviction for stealing bitcoins (0)

Anonymous Coward | about 2 years ago | (#43125777)

Bitcoins are imaginary property. Slashdot is against imaginary property. Therefore bitcoins are bad and should be copied whenever possible. After all they are just data, and data wants to be free.

Re:Conviction for stealing bitcoins (0)

Anonymous Coward | about 2 years ago | (#43127159)

You're free to copy your bitcoins as much as you want. It just won't actually get you anywhere. You're an idiot.

Re:Conviction for stealing bitcoins (1)

Anonymous Coward | about 2 years ago | (#43125173)

No, Bitcoins aren't data, they are imaginary. What was stolen were the secret keys (data) that allow you to spent the Bitcoins. Or you could say that the ownership certificate was changed without the permission of the previous owner.

Maybe it's a bit like if I "steal" your car by convincing the world that it is legitimately mine? Or like if I convince our circle of friends that your imaginary friend hates you now and spends all his time with me so when you tell stories about your adventures with him nobody believes you any more ;)

what about MMO games where you can take stuff form (1)

Joe_Dragon (2206452) | about 2 years ago | (#43125615)

what about MMO games where you can take stuff form others as part of game play and let's say there are 3rd party sellers in game that lets you buy stuff with cash and also sell stuff for cash?

How will the courts look at that?

Some one can say Bitcoin is a game with real cash stores as part of it.

Re:what about MMO games where you can take stuff f (0)

Anonymous Coward | about 2 years ago | (#43126141)

what about MMO games where you can take stuff form others as part of game play and let's say there are 3rd party sellers in game that lets you buy stuff with cash and also sell stuff for cash?

How will the courts look at that?

Some one can say Bitcoin is a game with real cash stores as part of it.

MMO developers are adamant about retaining ownership any and all digital items in their game - you don't own the "Sword of Dragon-slaying Greatness" (or whatever..) you just have a license to access it. Selling an item that you don't own is iffy.

Re:what about MMO games where you can take stuff f (1)

Joe_Dragon (2206452) | about 2 years ago | (#43126335)

some games do have a in game store that they get a cut of the sales.

Now just saying a game maker can have all kinds of stuff in it but then what happens when that mixes with real laws out side of the game??

Let's say hacking is part of the game but let's just say the game makes messed up and you can get into people real data or a in game hack ends up taking down a sever.

Re:Conviction for stealing bitcoins (1)

Zemran (3101) | about 2 years ago | (#43126663)

A bit like the way that China is convincing everyone that they own Taiwan?

Re:Conviction for stealing bitcoins (0)

Anonymous Coward | about 2 years ago | (#43124483)

You can't steal data... Just like you can't steal language.

  • Copyright, patents, DRM
  • Copyright, trademark, plagiarism

Slashdot - full of sophists, meme chanters, and semantic pedants, but sadly it hasn't been a forum for intelligent opinion for sometime.

Re:Conviction for stealing bitcoins (1)

Anonymous Coward | about 2 years ago | (#43124673)

Eh. There's plenty of intelligence here: but these days, it mostly comes in the ossified form of Clarke's elderly scientist:

"If an elderly but distinguished scientist says that something is possible he is almost certainly right, but if he says that it is impossible he is very probably wrong."

Bitcoin, Climate Change, etc. /. got old...

Capcha: compost. heh...

Re:Conviction for stealing bitcoins (1)

TsuruchiBrian (2731979) | about 2 years ago | (#43124733)

You can absolutely steal data. If you steal someone's debit card and buy a bunch of stuff with it, you have stolen data that allowed you to gain access to their bank account. Someone else ends up losing the stolen dollars you used.

You can't steal language because nobody is trying to keep language a secret. It's public domain. It doesn't belong to anyone.

Re:Conviction for stealing bitcoins (2)

osu-neko (2604) | about 2 years ago | (#43124985)

If someone steals your car in the night, you find no car in your driveway in the morning. If someone steals your television, you have nothing to watch this evening. If someone steals anything, the stolen item is no longer in your possession: that's what stealing is.

In your example, the money was stolen. The data, however, was not.

Re:Conviction for stealing bitcoins (1)

oztiks (921504) | about 2 years ago | (#43126113)

In your example, the money was stolen. The data, however, was not.

When was the last time you visited the bank and asked them to actually show you your money?

Last time I checked my bank balance it was via a NetBank screen, so I suppose that amount is nothing more than a database variable right?

Wait, did I just make bank robbery legal? Hold on ...

It's a bit of a strawman... (3, Insightful)

denzacar (181829) | about 2 years ago | (#43125853)

It is not the data that is being stolen. Data is just bits and bytes, kilobytes etc. of ones and zeroes.

What APPEARS AS being stolen is the information encoded within the data.
What is actually happening is UNAUTHORIZED ACCESS. Possibly unauthorized dissemination of information, revealing of trade and other secrets etc. IF the information is relayed to a third party.

It helps if you think of it as a case of early 20th century spying.
A spy intercepts and reads an enciphered radio transmission - he has the data but no information. Information gets to its intended recipient, clearly not stolen.

A spy deciphers the transmission - he has access to what he was actually after. The information.
Information still gets to its intended recipient, still not stolen, BUT - the spy above has also had access to information.

So far, all that the spy is guilty of is unauthorized access.
If and when he delivers the information to the third party, then he is guilty of various other things. None of them being stealing.

You can absolutely steal data. If you steal someone's debit card and buy a bunch of stuff with it, you have stolen data that allowed you to gain access to their bank account. Someone else ends up losing the stolen dollars you used.

That is not stealing data.
That is stealing a physical object, a debit card, THEN using it without authorization to gain access to the bank account, THEN stealing the money from the account.
No data was stolen. No, not even when the money was stolen in the end.
Data on the card was USED to access the bank account but it was not stolen - the CARD was stolen. And the money.

Same way you are not stealing the position of the teeth on a key used to open a safe - you are stealing a key.

Now, making a copy of the card or key - that's unauthorized copying OR just making a copy.
When you bring a "borrowed" key to a key copying store, the employee is not copying a key without authorization. He is just making a copy.
YOU are doing the unauthorized copying, but only if there is a specific rule prohibiting access to that key or making copies of it.

Same with the card.
Making a copy is unauthorized copying, accessing the account is unauthorized access, stealing money is stealing - but the card or the data were not stolen.
Money was.

Re:It's a bit of a strawman... (1)

brokenin2 (103006) | about 2 years ago | (#43127001)

...but the money *is* data.. USD or BTC.. the money is just data.

Re:Conviction for stealing bitcoins (1)

Zemran (3101) | about 2 years ago | (#43126649)

You can steal anything that has value if you intend to permanently deprive the owner of said property. There is no requirement in law to show a physical object, only the property has value.

Re:Conviction for stealing bitcoins (3, Informative)

HairyNevus (992803) | about 2 years ago | (#43124329)

Lamps, dog food, and records aren't currency, but if someone broke in your house stole them from you it would still be a crime.

Re:Conviction for stealing bitcoins (4, Insightful)

aztracker1 (702135) | about 2 years ago | (#43124657)

It's wire fraud. Nobody needs to recognize the currency to prosecute for that.

Re:Conviction for stealing bitcoins (4, Informative)

Troed (102527) | about 2 years ago | (#43124677)

The court ruled that:

*) Virtual items have value in virtual of the effort and time invested in obtaining them
*) The value in Virtual items is recognised by those that play the game (including the defendents who went to the trouble to take them)
*) The Virtual items were under the exclusive control of the player – who was relieved of this control

The court made reference to cases of electricity theft which is a similar intangible good but certainly has properties of power and control, and consequently can be stolen.

http://www.virtualpolicy.net/runescape-theft-dutch-supreme-court-decision.html [virtualpolicy.net]

Re:Conviction for stealing bitcoins (3, Insightful)

MrL0G1C (867445) | about 2 years ago | (#43125171)

I think the court got it wrong, The value inherent in virtual goods is in the price that people are willing to pay for them or would be willing were they on the market. Supply and demand dictates value.

Re:Conviction for stealing bitcoins (2)

raymorris (2726007) | about 2 years ago | (#43125419)

Supply and demand dictates value.

The court's 1) is supply and 2) is demand.

Re:Conviction for stealing bitcoins (0)

Anonymous Coward | about 2 years ago | (#43125503)

Crying bull on that one. That means that my precious family photos have zero value. It's the value they have to the possessor, not the value to others. My collection of digital photos on a drive, if erased maliciously, by your standards would have zero harm. The drive I'm paying for "in the cloud" is still there... in fact, from the market's perspective, the thief did me a favor by freeing up storage, thereby increasing the utility of the service. Ahem, yes, but data that _I_ value is gone, and nobody will care what the market would have paid. To test this, remote wipe 10 iPads in your organization, and then tell them you did them a favor by increasing the utility of their iPad, and that the market wouldn't have paid for the photos, so therefore there was no value destroyed, so no harm.

Re:Conviction for stealing bitcoins (1)

brokenin2 (103006) | about 2 years ago | (#43127031)

Zero value for criminal prosecution.. The loss of family photos would end up in civil court I believe, and could possibly bring in millions depending on "harm" determined there..

Family photos that were stolen in a criminal case would probably have the same value any other random photo's fair market value (not much).

The most likely suspect is... (5, Funny)

Anonymous Coward | about 2 years ago | (#43124297)

Bitinstant's mother. She knows both her maiden name and his birthdate, probably.

Nerdcoin (-1)

Anonymous Coward | about 2 years ago | (#43124327)

DO NOT WANT!

Of course no one lost any money! (-1)

Anonymous Coward | about 2 years ago | (#43124333)

All they lost were bitcoins!

Re:Of course no one lost any money! (1)

philip.paradis (2580427) | about 2 years ago | (#43124605)

Current BTC exchange rates [palegray.net] and trading volumes offer quite a different view.

Non story (3, Insightful)

Zemran (3101) | about 2 years ago | (#43124339)

If a standard currency exchange was robbed for $12,000 we would not even read the story. This is a trivial crime and of little interest. It serves more as a warning rather than as a bank robbery story. I hope that those that are concerned learn from this but if this is the crime of the century in the Bitcoin world then they are doing really well.

Re:Non story (2)

Anonymous Coward | about 2 years ago | (#43124365)

On the other hand, if standard banking websites were created by rube PHP coderz and buttards who can't secure their domain, it would be major news.

Bitcoin is stil mostly underground, and therefore the community is full of incompetents, phonies, and scammers. Goes with the territory.

captcha: superego

Re:Non story (3, Insightful)

ArsenneLupin (766289) | about 2 years ago | (#43124491)

Part of the hack was to exploit the unsecure procedures at the DNS registrar to add a new e-mail address for administering the victim's domain.

Any other company at the same registrar could fall victim for this, even a bank! And actually many registrars are this unsecure: not so long ago, it was possible to do similar things with just a faxed request with a (faked) signature. Not even necessary to know birth town and mother maiden name.

So, blaming this on lack of PHP (or other) coding skills of the victim is silly. Blame the insecure DNS registrar.

What would protect a brick and mortar bank against a similar hack would not be its coding skills, but rather its notoriety: a DNS registrar would hesitate if suddenly somebody asked to add a hotmail e-mail address to a well-known bank's registry information, and would try to confirm this by phoning back the bank during business hours before doing such change.

Re:Non story (2, Interesting)

IamTheRealMike (537420) | about 2 years ago | (#43125845)

The DNS registrar actually spoke about this incident publicly - it turns out that there was no social engineering, BitInstant just selected dumb security questions/answers when they registered the domain name. It's poor security on BitInstants part, no more or less.

Re:Non story (2)

rvw (755107) | about 2 years ago | (#43126639)

Part of the hack was to exploit the unsecure procedures at the DNS registrar to add a new e-mail address for administering the victim's domain.

Any other company at the same registrar could fall victim for this, even a bank! And actually many registrars are this unsecure: not so long ago, it was possible to do similar things with just a faxed request with a (faked) signature. Not even necessary to know birth town and mother maiden name.

We had this at our company last year. Someone hacked into our account at the DNS provider, changed the DNS for the mail of one domain, then used that to request a new password for our Amazon EC2 account, which had two-factor login. They called Amazon, which disabled the two-factor login, after which they could take over the Amazon account. It took us two days to gain full control back over the account, as Amazon was unable to log the out. The DNS provider didn't give any good explanation about how this was possible. Amazon said they would discuss it and change policy, but did they? I don't know.

Re:Non story (5, Interesting)

mkraft (200694) | about 2 years ago | (#43124381)

If a standard currency exchange was robbed for $12,000 we would not even read the story. This is a trivial crime and of little interest. It serves more as a warning rather than as a bank robbery story. I hope that those that are concerned learn from this but if this is the crime of the century in the Bitcoin world then they are doing really well.

No, the Bitcoin crime of the century was last year when the same server was hacked twice, to a tune of several hundred thousand dollars, as mentioned in TFA. Bitcoin hacks are becoming more and more common, so it's only a matter of time before that amount is surpassed.

Personally I don't see the point of bitcoins. I don't pay for everything in cash in the real world because it lacks the protections that other payment methods have. I don't see a reason to use a digital equivalent of cash in the online world. Bitcoins' anonymity might be it's biggest strength, but it's also it's biggest weakness.

Re:Non story (2, Insightful)

Pentium100 (1240090) | about 2 years ago | (#43124573)

I pay for everything in cash or debit card, but the card is only for convenience - my salary is wired to the bank account, so to have cash I have to go to an ATM and take it. Also, since I also buy stuff online, I have to have money in my bank account (since I can't pay an online store in cash).

Bitcoin has some problems though. When I pay in cash, I am physically in the store, I can inspect the item etc and if the store does something wrong, I know where it is and can complain to the authorities. Online purchases are quite risky, since I am not there (maybe not even in the country where the seller is) when I pay - the seller might ship the wrong item or not ship at all and without the added protection of paypal and similar services it would be impossible to prove that the seller did something wrong or reverse the transaction.

I do lie the anonymity though.

Re:Non story (4, Informative)

philip.paradis (2580427) | about 2 years ago | (#43124611)

There's nothing stopping you from conducting a Bitcoin transaction in person, aside from the other party needing to hold and/or be able to receive BTC as well. For the holding part, new solutions providers such as Coinbase [coinbase.com] are starting to focus on merchant gateway style solutions. Progress is being made.

Re:Non story (4, Insightful)

Pentium100 (1240090) | about 2 years ago | (#43124665)

There's nothing stopping you from conducting a Bitcoin transaction in person, aside from the other party needing to hold and/or be able to receive BTC as well.

Yes, but if the transaction is in person, I might as well use cash. Neither me nor him would need an internet connected device to send/receive money and no need to wait for confirmations.

One day Bitcoin may be really convenient, but right now it is too much like cash for online use and too much like a wire transfer (or paypal) for in person use.

Re:Non story (3, Informative)

philip.paradis (2580427) | about 2 years ago | (#43124769)

I think you're missing some of the benefits of BTC-based transactions. First, they're rather difficult to forge by virtue of reliance upon math for integrity verification. The same can't be said of cash, and the average man on the street would be hard pressed to discern half decent counterfeit paper currency from the real deal. While this particular example may represent a corner case for some, I happen to know two people who have been defrauded with counterfeit currency.

Second, Internet connected devices are everywhere. It's getting rather hard to find people without basic web access via a smart-ish phone in many areas, and full fledged BTC apps are popping up for those with anything fairly modern in terms of radio handsets. I wouldn't be terribly shocked to find devices that cater to simple apps and BTC transactions popping up in developing areas in the near future either.

With respect to waiting for confirmation, most transactions are verified on the BTC network within one hour. If you're willing to pay a small transaction fee to the network, verification can come more quickly. As a side effect of this state of affairs, you might just gain the benefit of meeting up with your transactional counterpart at a coffee house and having a tasty beverage. I call that an excuse to take a break, and welcome it.

Re:Non story (4, Insightful)

athmanb (100367) | about 2 years ago | (#43125039)

One hour? If "ease of use" means to have to wait a full hour for confirmation whether the purchase of your coffee went through or not I think I'd rather use cash...

Re:Non story (2)

philip.paradis (2580427) | about 2 years ago | (#43125109)

Depending of course upon the physical stage for the transaction, the verification period may indeed be a rote formality, more importantly if you've dealt with the other party to the transaction before and most importantly if you plan on dealing with that party again (which represents the very foundation of "credit" ala reputation in economic systems). Again, it's also easy to drastically accelerate the verification time by paying a small transaction fee to the network for processing it. I'd also encourage you to think in more flexible terms such as stored value purchase devices; to use a common example, Starbucks cards let you buy goods from Starbucks. The retailer can set an arbitrary minimum balance on the retail stored value account, at which point verification time means nothing. Especially coupled with additional fiscal and social rewards for utilizing such payments vehicles, the transaction verification time to load the stored value device with credits is removed as a significant factor in the relationship.

Re:Non story (1)

Anonymous Coward | about 2 years ago | (#43125239)

So you'd have to have a gift card ahead of time to the place you want to go... that sounds practical for every day use.

So I'm on a trip, vacation, whatever. I get a flat tire and need to buy a replacement. I either hopefully purchased a gift card to what happens to be the closest tire shop, or I get to sit an EXTRA HOUR waiting for the transaction to process.

Same with gas, or any other impulse buy or anything needed in a hurry.

It's just not practical at all.

Re:Non story (-1)

Anonymous Coward | about 2 years ago | (#43125121)

You taking risks with cash too. If you had to authenticate cash it would take more than an hour.

Re:Non story (-1)

Anonymous Coward | about 2 years ago | (#43126167)

YOU and the rest of the ppl on this thread are idiots. How do you think your credit card wotks? Why can you overdraft or go over your balance? Because your card has been authorized, but not verified. An hour is 23-47 hours FASTER than your bank.

Again read up on that previous comment on coinbase.

Fools

Re:Non story (1)

brokenin2 (103006) | about 2 years ago | (#43127141)

Bitcoin's version of confirmation means that the transaction is set in stone. It's virtually impossible to conceive of a way that the transaction could ever be undone under any circumstances.

When you use your debit card at the store, this is not what you're doing or getting.

If you just want to know that someone had funds available, and has sent them to you, then you will find that out in a couple of seconds.. It's still theoretically possible (but pretty darn difficult) they they could also spend those funds elsewhere, and then you don't know if you're really going to get paid in the end or not. Not the kind of effort someone is going to go through to steal a coffee.

If you've purchased/sold a house, or maybe a car, then you probably want to hang out for a couple of confirmations.. I'd still say though that after two confirmations (somewhere from 10-20 minutes usually) you're probably pretty safe, even if you transferred a couple of million dollars.

Re:Non story (0)

Anonymous Coward | about 2 years ago | (#43126309)

But then you have all that change in your pocket to deal with.

Re:Non story (1)

IamTheRealMike (537420) | about 2 years ago | (#43125855)

The Bitcoin protocol has support for dispute mediation in it (actually, 2-of-3 signing for coins). Unfortunately the surrounding ecosystem does not exist ... the features aren't exposed via GUIs and there are no dispute mediators who support it. But probably it will come in future. Right now there doesn't seem to be much demand, many sellers have been able to build a trustworthy reputation.

Re:Non story (2)

Sam H (3979) | about 2 years ago | (#43124759)

Oh, so you don’t believe the Bitcoin crime of the century was pirateat40’s BS&T going away with 500,000 BTC, that are now valued at about 20 million dollars?

Re:Non story (1)

TheRaven64 (641858) | about 2 years ago | (#43124817)

Personally I don't see the point of bitcoins

It's a very volatile market that has no regulation. Or, to put it another way, it's a completely unregulated online casino. If you can't see the market for this, you haven't been paying attention for the last few years...

Re:Non story (2)

TsuruchiBrian (2731979) | about 2 years ago | (#43124845)

If you are talking about credit cards, that is completely different. You still have to pay of your credit card somehow.

If you are talking about something linked to a bank account (e.g. like a debit card), then it is similar to paying with bitcoin.

The difference is not in how you pay but how the money is stored. If your money is stored in a US bank account, it can be taken easily be seized by anyone with enough authority. The US government freezes people's bank accounts regularly. If you bury US dollars in your back yard, the US government can just create more US dollars and devaluing your money without your consent.

Bitcoin is like the digital version of gold. The US government can't arbitrarily decide to print more gold. Gold actually requires resources to find, and it's getting harder to find every day. There is a finite amount of gold on the earth. Unlike gold, bitcoin is easy to manage, through digital transactions.

Re:Non story (1)

bill_mcgonigle (4333) | about 2 years ago | (#43125857)

Personally I don't see the point of bitcoins. I don't pay for everything in cash in the real world because it lacks the protections that other payment methods have.

But the problems are symmetrical. If you're an American, you're using a different digital currency (USD) that lacks the cryptographic and non-inflationary benefits of Bitcoin. But, over time many groups of people have created systems to allow you to use that currency in a more safe manner than storing large anonymous bits of it yourself. For that safety and convenience, they take a cut.

These systems will evolve too for Bitcoin, but it's true that they're not quite here yet.

Re:Non story (1)

DanielRavenNest (107550) | about 2 years ago | (#43127153)

> Personally I don't see the point of bitcoins.

That's because you are not a merchant. Credit card fraud is 3% of all credit card transactions, and usually it is the merchant who loses. Credit card processing for legitimate transactions is another couple of percent in fees. A low fee solution with no possibility of charge backs is very attractive relative to this.

Re:Non story (1)

philip.paradis (2580427) | about 2 years ago | (#43124693)

Please bear in mind that one of the more interesting aspects of this story is the fact that there is no standard set of currency exchanges for BTC. In fact, it's rather trivial to set one up. For well recognized exchanges, there are various actors in the market, each with varying codebases driving their infrastructure.

This is a fairly direct example of one of the strengths of Bitcoin as a currency, and speaks volumes to the advantages that can be gained by network users who utilize as many distributed exchange mechanisms as possible. The best part of all is the fact that such endeavors are trivially implemented in simple software constructs on the part of other actors. Avoiding being tied to a very limited set of transaction authorities can be a very good thing, especially for actors who aren't sensitive to short term fluctuation in currency valuation and can leverage gains in various ways.

Welcome to the digital currency equivalent of the "sexy side" of insurance businesses, sans a few of the standard issue problems, at least for modestly capitalized players.

Re:Non story (0)

Anonymous Coward | about 2 years ago | (#43124887)

Stealing the bitcoin is the story. It's a first.

Re:Non story (0)

Anonymous Coward | about 2 years ago | (#43124983)

They should have copyrighted the Private Key then the Feds could get involved and raid/extradite the baddies.

Serial numbers? (0)

Anonymous Coward | about 2 years ago | (#43124357)

I don't know how bitcoins work; but don't they have serial numbers? Isn't there some way for the original owners to say something like, "153545FDCEAB-35353ABD-01 is hot" and publish that to a public list?

Re:Serial numbers? (1)

lister king of smeg (2481612) | about 2 years ago | (#43124387)

they don't have serial numbers because they are themselves nothing more than a number. as such they don't need globally unique identifier as they are already all unique numbers

Re:Serial numbers? (2)

icebraining (1313345) | about 2 years ago | (#43125099)

Not exactly; Bitcoins themselves don't have or are numbers, they're just an amount.

The Bitcoin protocol is essentially a ledger. In order to take some bitcoins from an account, you need to identify where did they come from (previous transaction crediting that account).

So, transactions have hashes, but coins themselves don't; they're just amounts that get transferred.

Re:Serial numbers? (1)

IamTheRealMike (537420) | about 2 years ago | (#43125305)

Yes, you could do that, and in fact they did. However it doesn't really help because there's no supporting infrastructure for people to download lists of tainted outputs and trigger alerts when a transaction rooted on that output shows up in your wallet, and if there was, it isn't clear what you would do about it, and even if it was, it isn't clear how you'd stop people gaming the system by claiming coins as stolen when they actually were not. But it's technically feasible.

Level Three Attack (-1, Offtopic)

Anonymous Coward | about 2 years ago | (#43124369)

On my ranking site (Gibson Index), I rated this a Level Three Attack [gibsonindex.org] , but I think the submitter is wrong to say there was poor security. By all accounts, if they were any less secure, they would have lost tens of thousands more. It just happened that *one* of their exchange accounts did not have 2FA, because they weren't aware that that vendor had added support for it.

BitInstant's full blog post has more details: http://blog.bitinstant.com/blog/2013/3/4/events-of-friday-bitinstant-back-online.html [bitinstant.com]

Re:Level Three Attack (-1)

Anonymous Coward | about 2 years ago | (#43124901)

thank you for rating it as a level 3 attack.

WTF is a level 3 and why do I care about your spergtastic rating of somebody losing their autism kroners?

... and nothing of value was lost (0)

Anonymous Coward | about 2 years ago | (#43124467)

See subject.

Nothing to see here. Move along.

Re:... and nothing of value was lost (0)

Anonymous Coward | about 2 years ago | (#43124503)

Until they do a some other nifty trick with the hijack like stealing/redirecting traffic (might even be an interesting way to DOS attack, Joe Blow's tiny company site suddenly gets traffic intended for some large social media site) or doing some really fancy spear phishing to people that didn't typo or are otherwise mislead to the fake site.

Also if you can hijack enough DNS servers and you might also have a "nuclear option" in terms of presenting media to the public in a manner similar to the high-level spear phishing attack. Stuff like whistleblower sites are so "meh" when nobody pays attention to them, may as well put that info on a fake mainstream media frontpage. Zombies ahead folks... Zombies ahead.

But yeah, bitcoins... Who cares?

So what can you buy with bitcoins? (2)

Seumas (6865) | about 2 years ago | (#43124469)

I've heard a few people with bitcoins complaining about how they can't do anything with them and they're locked in. Apparently there's an online store that catalogs all the stuff you can buy all over the place, with bitcoins . . . and it looked to me like the kind of shitty collection of stuff you'd expect at a flea market. High priced low-end windows laptops and speaker wire and shampoo and shit.

Re:So what can you buy with bitcoins? (1)

maxwell demon (590494) | about 2 years ago | (#43124593)

You are not locked in because one of the things you can buy with bitcoins are dollars. And those dollars can then be used to buy about anything that can be bought at all.

Re:So what can you buy with bitcoins? (0)

Anonymous Coward | about 2 years ago | (#43124603)

you can buy money with them.

also a free tip: NEVER USER MOTHERS MAIDEN NAME EVEN IF THE SITE ASKS FOR IT FOR AUTHENTICATION!!!!!!!!!!! IT'S FUCKING STUPID!!!!!!! BEYOND STUPID! USER YOUR CAR MODEL, YOUR OS NAME, YOUR FUCKING DOMAIN NAME! ANYTHING BUT !

yelling filter blablablabla but the point is, you can buy money with it so it's worth stealing. you can also buy drugs with it - though wouldn't recommend it. you can buy hosting with it too.

Re:So what can you buy with bitcoins? (3, Interesting)

Anonymous Coward | about 2 years ago | (#43124669)

yelling filter blablablabla but the point is,

The point is that anyone who answers stereotypical "security" questions with factual information is a complete and utter moron.

My mother's maiden name is Banana. My favorite color is Jupiter Capitolinus. My first car was Abraham Lincoln. Come at me, Facebook Data Scrapers.

Pretend you're Orson Welles, put his mother's maid (1)

raymorris (2726007) | about 2 years ago | (#43125459)

One way of doing it is to use somebody else's info for password reset so you can remember what you entered. Maybe you pick John Kennedy. You'd enter Kennedy's mother's maiden name, Kennedy's dog's name, etc. That way anyone impersonating you by entering your data doesn't get in, but you don't have to remember nonsense answers.

Re:Pretend you're Orson Welles, put his mother's m (1)

Time_Ngler (564671) | about 2 years ago | (#43126355)

But if you use the same person's data for every site you still have the problem of a hacker being able to use the information from one of the sites to get into all of the others.

what, only 300 BTC ? (3, Interesting)

Janek Kozicki (722688) | about 2 years ago | (#43124595)

You talk here about theft worth only 300 BTCs or 12 000$

Well, I can only conclude that overall BTC security maybe has improved. Recall previous thefts worth of 25 000 BTC or 500 000$ [bitcointalk.org] (at that time) or 18 547 BTC or 87 000$ [slashdot.org] (at that time).

Why such conclusion? Well, if those evil people started to go after such low-profile target, it *can* mean that all high profile targets have adequate security.

Re:what, only 300 BTC ? (0)

Anonymous Coward | about 2 years ago | (#43124873)

Or adequate obscurity for the time being.

Re:what, only 300 BTC ? (1)

wvmarle (1070040) | about 2 years ago | (#43125013)

And it being a digital currency, any way to disable the stolen coins to make them worthless? Would be interesting, especially in light of the limited number of bitcoin that can exist.

Re:what, only 300 BTC ? (1)

icebraining (1313345) | about 2 years ago | (#43125151)

The coins themselves aren't identifiable; you could refuse to process the transactions coming from the thieve's addresses, but:

1.) Since the system is decentralized, you'd need to get all miners to agree to it (not likely).

2.) The thieves often send some of the coins to other people's addresses, to make it harder to identify them.

Re:what, only 300 BTC ? (0)

Anonymous Coward | about 2 years ago | (#43125161)

This is an extremely stupid and dangerous notion. Who decides which coins were "stolen"? How do we prove this? Why would we *want* to prove this?

Re:what, only 300 BTC ? (2)

Janek Kozicki (722688) | about 2 years ago | (#43126225)

bitcoin is in much more aspects like gold, than you would initially expect.

How would you "disable" stolen gold bars? Theoretically there are ways to mark gold using rare gold isotopes, so that even smelting will not destroy the signature. But this is not practical - it would require isotope detector at every place that trades even smallest amounts of gold.

With bitcoin it is similar. In fact all bitcoins are already marked separately, and can be precisely tracked, but tracking only stolen ones (even if we reach an agreement how to decide if they are indeed stolen) is simply not practical - everyone using bitcoins would need to download (and update frequently) a centralized blacklist of stolen bitcoins and refuse to process them. Sounds familiar? So this approach would clearly break one of main strengths of bitcoin: decentralization.

Re:what, only 300 BTC ? (1)

Time_Ngler (564671) | about 2 years ago | (#43126395)

The problem is that can transactions can happen faster than the information that fraud occurred. If the coins are marked hot after the thieves already traded them, then the merchants they traded with are out of luck. This would cause merchants in general to be wary of accepting bitcoins, and bring up all the same problems we have with credit cards and other financial instruments today.

Re:what, only 300 BTC ? (0)

Anonymous Coward | about 2 years ago | (#43126245)

Dear Janek Kozicki,

I not trying to be rude, but why are you putting the United States Dollar sign at the end of the number? I am used to seeing $500,000.00 and $87,000.00. I never seen monetary amounts in the United States of America written as 500,000$. Just saying

Very funny. (-1)

Anonymous Coward | about 2 years ago | (#43124749)

Social Engineering and poor DNS Security lead to a Bitcoin heist worth about $12000.

Bitcoins have a number of fundamental problems, such as determining in advance there are only going to be a finite number and naming that number to begin with guarantees the currency will be worthless. The amount of currency in an economy needs to be able to increase or deflation makes the currency so valuable that it becomes impossible to buy anything, and the common people won't have any money. Imagine if today, the government required everyone to turn in their cash, and they started issuing only $10,000 bills...

Customer: How much is that loaf of bread?

Clerk: Two ninety five.

Customer: The smallest thing I have is a $10,000 bill. Can you break it?

Clerk: No. The ten-gee note is the smallest thing there is.

Customer: So why are you open, there's nothing in the store that is anywhere near $10,000?

Clerk: That's a good point. Get out, we're closed. Or fuck it, stay. I quit, since I'm not getting paid anyway...

If you're having trouble understanding this, go try to buy a single piece of spaghetti. Or try to buy 1mL of plain drinking water. Instead of a box of them, try to buy one Cheerio. You can't, because in the first place, they're not for sale individually, and in the second, either would be about a tenth or a hundredth of a cent, and the smallest unit of modern American hard currency is the penny, $0.01. Bitcoins (if they were really worth anything,) would have the same problem with real-world products.

Also, weren't Bitcoins supposed to be resistant to the problems of that... ugh... real-money? Seems they're really not, are they.

It is a fun idea in theory, but it the real world, it's just not practical or sensible to have some random schmuck just make up his own currency, without it being exchangeable for some valuable commodity, or a service of some kind.

It's so quaint when people pretend Bitcoins are actually worth something. Mod me down, but what I've written will still true. It's a made up, bullshit, nonexistent currency - might as well be Angelbucks or Devildollars. It's not worth shit.

Of course you could make the same argument (and many have) about US Dollars, since they're "not based on or backed by anything," but the difference is that for starters, you can pay your tax-bill in dollars. Got a speeding ticket? Try paying that shit with Bitcoins. Just try it. Drop me a line from jail, let me know how it goes. The US dollar is coin of the realm (in the US and a few other places) and THAT'S why it's worth something, because people will accept it; you can buy stuff with them. Some countries have experienced runaway inflation where you needed a trillion units of it to buy a loaf of bread, and it has to be redenominated and re-redenominated, and it still descends into worthlessness. It can be argued that THAT currency is worthless, but shit, man, it's still legal tender in that country. Wrangle enough of them together and you can buy something. It might take a wheel-barrow full of them to buy a loaf of bread, but you can still buy a loaf of bread.

Anyone with any brains would accept payment for a job in fucking Trident Layers (TM) before accepting Bitcoins. It's not trolling if what you say is true, anymore than it would be mean to tell Mitt Romney he's not president because too many people thought he was a rich, arrogant, fucking robotic asshole from another planet. It might not be nice, but damn it, it's the truth!

Re:Very funny. (1)

philip.paradis (2580427) | about 2 years ago | (#43124821)

BTC is divisible into smaller units [wikipedia.org] . To quote the link:

In trade, one bitcoin is subdivided into 100-million smaller units called satoshis, defined by eight decimal places.

Your entire argument is therefore invalid. Perhaps you shouldn't have wasted so much time typing it.

Re:Very funny. (0)

Anonymous Coward | about 2 years ago | (#43124897)

If you had studied the subject for even 10% of the time it took to write that, you would have realized the problems you describe only exist in your head.

Bitcoin is a very cool idea. Just because it's not _exactly_ like some existing idea (like state-backed currency) does not make it stupid.

Robbery (0)

Anonymous Coward | about 2 years ago | (#43124807)

Robbery is using violence or intimidation to take anothers property.

Social Engineering plus stealing is not robbery.

Every year the Internet (0)

Anonymous Coward | about 2 years ago | (#43124881)

gets more like a Charlie Stross novel. Sigh.

what the? (0)

Anonymous Coward | about 2 years ago | (#43125073)

Do people really use this stuff in place of real money? I'll keep my real cash thanks... And as the world's currencies (particularly the dollar) are being intentionally devalued, I'll hang on to my precious metals.

Re:what the? (2)

Chrisq (894406) | about 2 years ago | (#43125101)

Do people really use this stuff in place of real money? I'll keep my real cash thanks... And as the world's currencies (particularly the dollar) are being intentionally devalued, I'll hang on to my precious metals.

Hey is that you Ebenezer Scrooge?

Stengthen your security. (4, Insightful)

MrL0G1C (867445) | about 2 years ago | (#43125103)

Mothers maiden name: 9zimu8sj4q99uf
Place of birth: wj9awitkj4girc

If you use real details, you're a fool.

Re:Stengthen your security. (1)

Dan541 (1032000) | about 2 years ago | (#43125149)

I've always wondered if putting "Don't you fucking dare reset that password" as a secret question.

Re:Stengthen your security. (0)

Anonymous Coward | about 2 years ago | (#43125249)

care to finish your thought.... ?

Re:Stengthen your security. (1)

bill_mcgonigle (4333) | about 2 years ago | (#43125889)

and the LastPass browser extension makes this fairly trivial to implement.

whut you say (1)

hraponssi (1939850) | about 2 years ago | (#43125227)

what actually happens in this type of incident? from what i read, the bitcoin is supposed to be tied to your secret keys and whatnot. so what do they actually steal from the "broker"?

Re:whut you say (0)

Anonymous Coward | about 2 years ago | (#43125475)

what do they actually steal from the "broker"

Those secret keys and whatnot.

Re:whut you say (1)

hraponssi (1939850) | about 2 years ago | (#43126109)

thanks for the info. so when the article says

"With control of the DNS, the bad guys also had control over Bitinstant’s email. They then did an online password reset at a Bitcoin exchange called VirWox and started emptying Bitinstant’s account. The total haul: $12,480"

does that mean you use the exchange to store your keys, which are associated to some set of transactions, and the bad people got the keys that enabled them to grab the loot in terms of using some chain of hashing or what? so what was stolen was the keys, which enabled use of the coins?

yeah, i am just generally clueless, thanks.

crime doesn't pay (4, Funny)

PopeRatzo (965947) | about 2 years ago | (#43125245)

One of the thieves was later seen at the racetrack, trying to put down 1024 bitcoins on a horse in the third race.

He was apprehended and later sentenced to 10 years of ridicule without possibility of parole.

Poor security from everyone? (1)

Fnord666 (889225) | about 2 years ago | (#43125303)

This looks like poor security from everyone involved.

This is perhaps arguable in the case of VirWox, the exchange used to move the money out of the account. According to the article, VirWox has offered two factor authentication since September of last year. The fact that BitInstant didn't use it allowed the attackers to succeed with the heist. I say arguable because two factor authentication should probably be mandatory for anything that involves monetary transactions.

That's only... (1)

WhackAttack (2672021) | about 2 years ago | (#43125499)

Believe it or not that was only approximately 266 bitcoins.

Not my problem! (0)

Anonymous Coward | about 2 years ago | (#43125697)

This is not a problem of Bitcoin, but of the site that got robbed. They should increase their security! Begin using Bitcoins here - http://thebitcoinmaster.blogspot.com

This just in... (1)

Jawnn (445279) | about 2 years ago | (#43126093)

Amateur bankers hustled by trivial attack. Film at eleven.
Load More Comments
Slashdot Login

Need an Account?

Forgot your password?