Bitcoins are officially donkdown

[sonatine]

oh google dorking is where you use google to dig up url contents or page contents that indicate known or potential vulnerabilities.

i did like a real simple google dork on mtgox looking for urls that were php based and a few other things and found what looked like some really, really, really sketchy programming decisions in play.

today i opened up the browser i had used and the same urls that caught my attention were now 404'ing. so someone caught them. which means someone was auditing their website.

so yeah as far as the faggots comment goes i was talking to garrett obv.

So you are saying gox's programmers had not even a most basic clue ? That you were able to tell with a little google work and URLs alone that they had some fundamental flaws?

So after years of handling transactions worth 100s of millions aggregate, they _still_ had some very serious security issues that you were able to easily find ?

Which they just now finally caught on! Jeez, what a shitty site !

Sonatine, you are God. I hope to have the level of knowledge and expertise that you do. At my age I don't think it will happen. I fake it instead but I'm not even good at that.

Keep keeping this site informed. Thank you for all you do.

yes hoser, i used an established method to discover vulnerabilities thats been used aggressively in the white and black hat community for over a decade to expose insecure coding practices (in this case physical paths leading to LFI/RFI issues as well as a indicators that arrays might not be handled correctly). you might remember the latter as the way ebay was hacked a month ago.

no?

you were too busy being a smelly junky to hear about that one?

ahhhhhhh well, we all have our gifts i suppose. and yours remains being a hyperbolic life failure who cannot stomach the thought of your betters working diligently to improve their lot in life while you major in slamming mexican tar and minor in offensive b.o.

in any case brian, if you need advice on security issues and how to spot them, im here for you.

and if we need advice on how to find a vein with a dull needle while keeping crows away from peoples pot crops for a living, its good to know we have a subject matter expert locked and loaded in you.

[monsterj]

So you are saying gox's programmers had not even a most basic clue ? That you were able to tell with a little google work and URLs alone that they had some fundamental flaws?

So after years of handling transactions worth 100s of millions aggregate, they _still_ had some very serious security issues that you were able to easily find ?

Which they just now finally caught on! Jeez, what a shitty site !

Sonatine, you are God. I hope to have the level of knowledge and expertise that you do. At my age I don't think it will happen. I fake it instead but I'm not even good at that.

Keep keeping this site informed. Thank you for all you do.

yes hoser, i used an established method to discover vulnerabilities thats been used aggressively in the white and black hat community for over a decade to expose insecure coding practices (in this case physical paths leading to LFI/RFI issues as well as a indicators that arrays might not be handled correctly). you might remember the latter as the way ebay was hacked a month ago.

no?

you were too busy being a smelly junky to hear about that one?

ahhhhhhh well, we all have our gifts i suppose. and yours remains being a hyperbolic life failure who cannot stomach the thought of your betters working diligently to improve their lot in life while you major in slamming mexican tar and minor in offensive b.o.

in any case brian, if you need advice on security issues and how to spot them, im here for you.

and if we need advice on how to find a vein with a dull needle while keeping crows away from peoples pot crops for a living, its good to know we have a subject matter expert locked and loaded in you.

is this the same hoser as the one that "worked" at IBM? Mr. Machine Learning and Data Mining expert?

[sonatine]

yes hoser, i used an established method to discover vulnerabilities thats been used aggressively in the white and black hat community for over a decade to expose insecure coding practices (in this case physical paths leading to LFI/RFI issues as well as a indicators that arrays might not be handled correctly). you might remember the latter as the way ebay was hacked a month ago.

no?

you were too busy being a smelly junky to hear about that one?

ahhhhhhh well, we all have our gifts i suppose. and yours remains being a hyperbolic life failure who cannot stomach the thought of your betters working diligently to improve their lot in life while you major in slamming mexican tar and minor in offensive b.o.

in any case brian, if you need advice on security issues and how to spot them, im here for you.

and if we need advice on how to find a vein with a dull needle while keeping crows away from peoples pot crops for a living, its good to know we have a subject matter expert locked and loaded in you.

is this the same hoser as the one that "worked" at IBM? Mr. Machine Learning and Data Mining expert?

[simpdog]

sonatine you are far too modest

don't let garrett bring you down

[Dan Druff]

So there was another crash which happened very quickly at around 3am PST.

Mtgox crashed down to exactly $500, while other exchanges fell to around $530.

This triggered an immediate recovery, and before 4am, most exchanges were over $650 again.

At the moment, things are still around $650-$670, so it's stabilized again. Wonder what caused that crash. Perhaps that's when MtGox released its statement?

https://www.mtgox.com/press_release_20140210.html

Dear MtGox Customers and Bitcoiners,

As you are aware, the MtGox team has been working hard to address an issue with the way that bitcoin withdrawals are processed. By "bitcoin withdrawal" we are referring to transactions from a MtGox bitcoin wallet to an external bitcoin address. Bitcoin transactions to any MtGox bitcoin address, and currency withdrawals (Yen, Euro, etc) are not affected by this issue.

The problem we have identified is not limited to MtGox, and affects all transactions where Bitcoins are being sent to a third party. We believe that the changes required for addressing this issue will be positive over the long term for the whole community. As a result we took the necessary action of suspending bitcoin withdrawals until this technical issue has been resolved.


Addressing Transaction Malleability
MtGox has detected unusual activity on its Bitcoin wallets and performed investigations during the past weeks. This confirmed the presence of transactions which need to be examined more closely.


Non-technical Explanation:
A bug in the bitcoin software makes it possible for someone to use the Bitcoin network to alter transaction details to make it seem like a sending of bitcoins to a bitcoin wallet did not occur when in fact it did occur. Since the transaction appears as if it has not proceeded correctly, the bitcoins may be resent. MtGox is working with the Bitcoin core development team and others to mitigate this issue.


Technical Explanation:
Bitcoin transactions are subject to a design issue that has been largely ignored, while known to at least a part of the Bitcoin core developers and mentioned on the BitcoinTalk forums. This defect, known as "transaction malleability" makes it possible for a third party to alter the hash of any freshly issued transaction without invalidating the signature, hence resulting in a similar transaction under a different hash. Of course only one of the two transactions can be validated. However, if the party who altered the transaction is fast enough, for example with a direct connection to different mining pools, or has even a small amount of mining power, it can easily cause the transaction hash alteration to be committed to the blockchain.

The bitcoin api "sendtoaddress" broadly used to send bitcoins to a given bitcoin address will return a transaction hash as a way to track the transaction's insertion in the blockchain.
Most wallet and exchange services will keep a record of this said hash in order to be able to respond to users should they inquire about their transaction. It is likely that these services will assume the transaction was not sent if it doesn't appear in the blockchain with the original hash and have currently no means to recognize the alternative transactions as theirs in an efficient way.

This means that an individual could request bitcoins from an exchange or wallet service, alter the resulting transaction's hash before inclusion in the blockchain, then contact the issuing service while claiming the transaction did not proceed. If the alteration fails, the user can simply send the bitcoins back and try again until successful.

We believe this can be addressed by using a different hash for transaction tracking purposes. While the network will continue to use the current hash for the purpose of inclusion in each block's Merkle Tree, the new hash's purpose will be to track a given transaction and can be computed and indexed by hashing the exact signed string via SHA256 (in the same way transactions are currently hashed).

This new transaction hash will allow signing parties to keep track of any transaction they have signed and can easily be computed, even for past transactions.

We have discussed this solution with the Bitcoin core developers and will allow Bitcoin withdrawals again once it has been approved and standardized.

In the meantime, exchanges and wallet services - and any service sending coins directly to third parties - should be extremely careful with anyone claiming their transaction did not go through.

Note that this will also affect any other crypto-currency using the same transaction scheme as Bitcoin.


Conclusion
To put things in perspective, it's important to remember that Bitcoin is a very new technology and still very much in its early stages. What MtGox and the Bitcoin community have experienced in the past year has been an incredible and exciting challenge, and there is still much to do to further improve.

MtGox will resume bitcoin withdrawals to outside wallets once the issue outlined above has been properly addressed in a manner that will best serve our customers.

More information on the status of this issue will be released as soon as possible.

We thank you for taking the time to read this, and especially for your patience.

Best Regards,
MtGox Team

Does anyone know when this statement came out (other than it being sometime today)?

[Dan Druff]

So basically Gox is saying there's a fundamental flaw in the entire bitcoin system that allows people to spoof an error in receiving bitcoins, when in reality they have been received. Then they can request them to be re-sent and get double-paid.

This reminds me of a trick I used to pull in the 1980s, when I was on BBSes that had an "upload/download" ratio. Basically, you had to upload a certain amount in order to be able to keep downloading. I was fine with this, except these BBSes were very particular about what you could upload, such as the age of the software (sometimes a few days old was too old) and of course you couldn't upload any duplicate stuff. So maintaining a ratio of like 1:4 was impossible, as they already had everything I had to offer.

To get around this, I used a trick called "Leech Zmodem", where your download finishes and then rewinds its pointer to back to earlier in the download and "aborts", even though I already have the entire file on my end. So to the BBS owner, it looks like I only got 13% through and aborted, and thus it didn't charge to my ratio.

This exploit existed because Zmodem had a pointer to the current state of the download that could be changed (to allow resuming of downloads that aborted), while earlier protocols were just straight sending data, and if it aborted 99% through, you had to start over.

Anyway, back to 2014.

Is Gox telling the truth, the partial truth, or lying?

"Partial truth" means that Gox is telling the truth about the bitcoin flaw, but there are other actual reasons for them not processing withdrawals.

[sonatine]

Chances are good thats most if not all of the truth.

[donkdowndonedied]

So you are saying gox's programmers had not even a most basic clue ? That you were able to tell with a little google work and URLs alone that they had some fundamental flaws?

So after years of handling transactions worth 100s of millions aggregate, they _still_ had some very serious security issues that you were able to easily find ?

Which they just now finally caught on! Jeez, what a shitty site !

Sonatine, you are God. I hope to have the level of knowledge and expertise that you do. At my age I don't think it will happen. I fake it instead but I'm not even good at that.

Keep keeping this site informed. Thank you for all you do.

yes hoser, i used an established method to discover vulnerabilities thats been used aggressively in the white and black hat community for over a decade to expose insecure coding practices (in this case physical paths leading to LFI/RFI issues as well as a indicators that arrays might not be handled correctly). you might remember the latter as the way ebay was hacked a month ago.

no?

you were too busy being a smelly junky to hear about that one?

ahhhhhhh well, we all have our gifts i suppose. and yours remains being a hyperbolic life failure who cannot stomach the thought of your betters working diligently to improve their lot in life while you major in slamming mexican tar and minor in offensive b.o.

in any case brian, if you need advice on security issues and how to spot them, im here for you.

and if we need advice on how to find a vein with a dull needle while keeping crows away from peoples pot crops for a living, its good to know we have a subject matter expert locked and loaded in you.

I was only commenting on your findings of mtgox. I have *NO* idea why you totally lost your shit and attacked me. You're making 200k+ as a security expert. I don't know much about security. I didn't even know what "google dorking" is. I was just trying to be nice and fascinated by your findings.

I was genuinely impressed that you were able to find significant progrmaming errors. Last I knew you weren't a programmer, but you can tell from URLs how they're handling arrays on the backend. Thats pretty damn cool.

I was even more surprised at how shitty Gox is to have those errors left in place. WTF gox?? Do you think those holes you found were likely exploited by people ?

Seriously, go talk to a counselor or something. I have no clue why you lost your shit and went after me 110%. I'm trying to not start fights here, thats why I'm not attacking you back. I'm not going to even defend against all the lies you're making up, because it is pointless. I could make up stuff about you. Hell, I could tell some very interesting true stuff now that I think about it. Why ? Grow up buddy. I like how you use 3 names at once with all the lies etc. It is not even an overkill, because I wasn't insulting you to begin with. Just randomly super defensive.

Anyway, just relax. I think after your response that asking for what sort of errors/urls you found would put you in orbit. Why would I ever ask you anything further when you can't seem to interact like a normal human being?

Still puzzled at why you're so damn defensive over nothing. I'm so baffled.

[Sitting Out]

I don't know if this has been stated yet, but there's an excellent joe rogan discussion on bitcoins. It helped me to clarify a lot of the mystery behind them both politically and technically.

http://podcasts.joerogan.net/podcast...s-antonopoulos
#446. Andreas Antonopoulos is a bitcoin entrepreneur, he also serves on the advisory boards of several bitcoin startups and serves as the Chief Security Officer of Blockchain.

a random comment by one of the listeners:

If you watched this and somehow have still managed to continue the same "no coherent explanation" argument for being skeptical of bitcoin... I predict their is at least a 75% chance that you are also not yet convinced that evolution is real. 3 hours ago I sat down to what I presumed would be a funny podcast with Joe hilariously dismantling some nerd with delusions of being a cyber-leprechuan, but instead I sat with my mouth wide the entire time while Andreas calmly explained the most important thing that is currently happening on the planet. I can't remember ever having been so wrong about something so important.

[donkdowndonedied]

Mr. Machine Learning and Data Mining expert?

Your memory is way off. I have never claimed to be a Machine Learn or Data Mining expert. I did work at IBM for a few years and got a feel for how things worked. I brought it up when we were talking about Watson and what I felt might really be going on. Please fella, not sure what your deal is, but relax. You don't have to make up shit. If you want to call me an expert for whatever reason, then go ahead, but please don't imply I called myself such.

[Crowe Diddly]

So basically Gox is saying there's a fundamental flaw in the entire bitcoin system that allows people to spoof an error in receiving bitcoins, when in reality they have been received. Then they can request them to be re-sent and get double-paid.

This reminds me of a trick I used to pull in the 1980s, ...

This reminds me of a trick I (and millions of others, no doubt) used to pull in the late 80's and the 90's. You'd take a fresh dollar bill, one that a vending machine would have no problems accepting, and you would use clear, wide packing tape to give the dollar bill a see-through tail of sorts. You would insert the dollar into the proper slot on a vending machine, and the dollar would get sucked into the machine, but you would hold onto the tape, and pull it right back out before it went too far in. The machine would credit you the dollar, allow a purchase, and refund any excess change. My high school had a veryfine machine that was like 65 cents a can. You could hit it up with a dollar, get a couple cans of whatever, and get enough change to get cookies or brownies or whatever in the cafeteria afterwards. Needless to say, this soon got out of hand, and the machine was gone in about a month.

[yaahello]

Two Florida men charged with money laundering for selling Bitcoins

http://rt.com/usa/bitcoin-florida-la...ng-arrest-431/

[JUSTIFIEDhomicide]

Seems like a good time to buy a bunch if you have the money and wait for th next 700-800 spike and sell out real quick, no?

[vegas1369]

About to jump on another one. Do you guys see it flattening now for a while or a possible other crash in the next 72 hours? Right now on Coinbase it sits at $683. Last night I got in at $730. Was hoping for a big drop today so I could buy in again and level out between $500-$600, but it looks like I missed that 4am boat.

[vegas1369]

Also, I saw that 4 days ago Apple decided to drop all apps that pertain to Bitcoin. That can't be good. Doubt that is going to effect the price anymore at this point though.

http://money.cnn.com/2014/02/06/tech...apple-bitcoin/

[BetCheckBet]

About to jump on another one. Do you guys see it flattening now for a while or a possible other crash in the next 72 hours? Right now on Coinbase it sits at $683. Last night I got in at $730. Was hoping for a big drop today so I could buy in again and level out between $500-$600, but it looks like I missed that 4am boat.

or did you already sell your coins?)

[vegas1369]

About to jump on another one. Do you guys see it flattening now for a while or a possible other crash in the next 72 hours? Right now on Coinbase it sits at $683. Last night I got in at $730. Was hoping for a big drop today so I could buy in again and level out between $500-$600, but it looks like I missed that 4am boat.

or did you already sell your coins?)

Did not sell. I'm looking at this as just a gamble, nothing more. I figured last night there was a good chance it would level out in the $700 range, so I bought one, but there was also a chance it could drop again. So if that happened I would hopefully buy in at the bottom and even out my first purchase with the second at a decent price, otherwise I got in on one at the $700 level, which could be close to the bottom of this crash. I figure it will go back up to the $800-$1000 range in the near future, but this is just a guess as I have nothing to back that thought up other than it's recent history. Obv there is a good chance I just threw away a few hundred bucks, and that's why I'm just looking at this as a gamble. I just got tired of watching and reading about this all the time and not have a horse running in the race.

[sonatine]

I consider the organic price of BTC to be mid 800's and I expect it will hit that within 4 days of Gox unfucking itself.

Put simply; when Gox was functional, the price was upper 800's to mid 900's.

Gox bedshits, price drops.

We have watched BTC fluctuations in the past and despite all logic it always bounces back, thanks to the efforts of a few major whales.

Put even more simply; do you think those whales are going to let the price tank?

Get in and sell at 15% profit in a week or two. The only reason I dont consider this free money is there is a chance Gox will *not* return, at which point youre looking at an organic price range of probably 325-425 once the smoke clears.

[Pooh]

or did you already sell your coins?)

Did not sell. I'm looking at this as just a gamble, nothing more. I figured last night there was a good chance it would level out in the $700 range, so I bought one, but there was also a chance it could drop again. So if that happened I would hopefully buy in at the bottom and even out my first purchase with the second at a decent price, otherwise I got in on one at the $700 level, which could be close to the bottom of this crash. I figure it will go back up to the $800-$1000 range in the near future, but this is just a guess as I have nothing to back that thought up other than it's recent history. Obv there is a good chance I just threw away a few hundred bucks, and that's why I'm just looking at this as a gamble. I just got tired of watching and reading about this all the time and not have a horse running in the race.

You bought one fucking bitcoin and are posting about it here? I suppose its better than Druff's .1 but shit.

[vegas1369]

Did not sell. I'm looking at this as just a gamble, nothing more. I figured last night there was a good chance it would level out in the $700 range, so I bought one, but there was also a chance it could drop again. So if that happened I would hopefully buy in at the bottom and even out my first purchase with the second at a decent price, otherwise I got in on one at the $700 level, which could be close to the bottom of this crash. I figure it will go back up to the $800-$1000 range in the near future, but this is just a guess as I have nothing to back that thought up other than it's recent history. Obv there is a good chance I just threw away a few hundred bucks, and that's why I'm just looking at this as a gamble. I just got tired of watching and reading about this all the time and not have a horse running in the race.

You bought one fucking bitcoin and are posting about it here? I suppose its better than Druff's .1 but shit.

Yes. Sorry if talking about a little $700 gamble is beneath you.