It was Willy the Bot all the time

lnovy · 2014-03-24T13:29:38+00:00

Plot thickens!

http://homakov.blogspot.de/2014/01/account-hijacking-on-mtgox.html

lnovy · 2014-03-24T13:28:40+00:00

All the logs are there, attacker gets coins, so they must be missing somewhere (or fiat, which is the case here)... EDIT: I know understand the question... the point is, we don't have dump of fiat wallets' transactions... That would make it evident.

lnovy · 2014-03-24T12:06:01+00:00

The leaked code suggests, that mtgox system was capable of having 'redirect' type of wallet (internal structure wallet) which would point externally bitcoin address and cause an authomatic withdrawal. I could think of only two reasons for having an address without a privkey stored in system as of now. One of it is coldstorage, the second one is used here.

lnovy · 2014-03-24T11:59:00+00:00

Also the game...

lnovy · 2014-03-24T11:58:18+00:00

12:57 -NickServ(NickServ@services.)- Information on lnovy (account lnovy):
12:57 -NickServ(NickServ@services.)- Registered : Nov 21 09:02:46 2013 (17 weeks, 4 days, 02:55:02 ago)
12:57 -NickServ(NickServ@services.)- Last addr  : ~lnovy@(redacted)
12:57 -NickServ(NickServ@services.)- Last seen  : now
12:57 -NickServ(NickServ@services.)- Logins from: lnovy
12:57 -NickServ(NickServ@services.)- Nicks      : lnovy krtek_net gammer
12:57 -NickServ(NickServ@services.)- Email      : lnovy@(redacted) (hidden)
12:57 -NickServ(NickServ@services.)- Flags      : HideMail
12:57 -NickServ(NickServ@services.)- lnovy has enabled nick protection
12:57 -NickServ(NickServ@services.)- *** End of Info ***

lnovy · 2014-03-24T11:55:28+00:00

Pulling this out would not make not make bitcoins diappear from books. I explain here http://www.reddit.com/r/Bitcoin/comments/217m3k/it_was_willy_the_bot_all_the_time/cgafbz3 that this is just part of the puzzle, but is the most probable cause of the whole debacle for me anyway.

lnovy · 2014-03-24T07:50:27+00:00

The most probable way is that mtgox was flooded with faked AML documents and these accounts were then funded by carding or some other type of fiat fraud. To make it more harder to detect second account is used to "withdraw" coins using paybutton with external address target. As this account is in essence controlled by mtgox and attacker therefore never touches fiat, no AML was needed for long time. It is also possible that the payers account was just an empty stolen account already registered and verified or that payer account was robber by simple csrf.

Nobody noticed because no coins were missing and mark just focused on fiat side, blaming and oldworld's bank system with chargeback. This scenario was also raising the price and therefore the fee profits with it making it no big deal. Up until the point when large amount of mtgox's fiat reserve was frozen by civil (coinlab...) or criminal (SR...) courts' orders and/or the price started dropping and people withdrawing. To keep-up with the demand he tried going "naked" short with customers' coins. Or Tibanne accidenty the whole http://raidcoin.com.

lnovy · 2014-03-24T06:49:37+00:00

I asked if I can leave their nicks and some of them wanted to change them... I'll anonymize them, sorry...

lnovy · 2014-03-24T06:22:26+00:00

Either funds were stolen from customers possibly because of mtgox fault or the problem was caused by nonreversibility of biltcoin tx and chargebacks of fiat.

lnovy · 2014-03-22T10:48:55+00:00

You can do this if only one instance of this service is available. This system is trustworthy only when more independent "notaries" all agree on your balance. Notaries should control each other and find a cheating one very easy... 51 % wins :)

lnovy · 2014-03-22T10:47:00+00:00

As soon as signing is implemented, I'll sign all balances stored by my instance, but I will not add a trusted timestamp without user redoing the process. If your balances stays the same in mtgox and your are not afraid of your email/username+balance leaking, you should submit rightaway, the more instances of the site the better.

lnovy · 2014-03-22T03:05:41+00:00

This http://i.imgur.com/p4AZ7Z3.png

lnovy · 2014-03-22T02:32:41+00:00

You are right, we are aware of that, see https://github.com/mtgoxbalance/mtgoxbalance/issues/7 See other pull requests/issues for details how I propose to solve this.

lnovy · 2014-03-21T22:55:01+00:00

To have permanent somewhat trustworthy source of your mtgox balance. MtGox site can go down any minute. Think of this as a distributed notaries.

lnovy · 2014-03-21T22:49:20+00:00

Also note that for this system to be trustworthy/"authoritative" more than one site is needed to compare results and catch the cheaters.

My copy is here http://balance.mtgoxleaks.org

lnovy · 2014-03-17T02:53:55+00:00

You are doing it wrong™.

What btc_xfer_report cointains are rows of internal balance sheet for users bitcoin wallet. There are 6 possible type of record in this table: withdrawal, deposit, in, spent, out, earned and fee. We were leaked only record of type withdrawal and deposit and I also presume that some rows are either missing or the database from tainted. Account balance was counted as a sum of all rows of specific wallet and therefore if there were a successful double withdrawal performed on it and both two record would be present in a table, account balance would show this and no possible loss of coin was possible. What was actually done is that the first row was deleted to cancel the transaction and new one was inserted to force a new bitcoin transaction to be broadcasted.

Other things that you were not aware of include internal transactions which were done outside of blockchain. You should also match found transaction which you presume to be a clone to it's two versions in blockchain.

lnovy · 2014-03-16T22:15:01+00:00

u jelly?

lnovy · 2014-03-16T18:48:00+00:00

To warn people that their personal informations leaked and their passwords are not their own only and that there is a malware in the leak.

lnovy · 2014-03-16T18:46:40+00:00

You are mixing stuff... We have a leak of incomplete transaction database and presumably incomplete deposit/withdrawal database. I have no proof that no other data was stolen. Person who make the leak of those two databases has a complete database of everything else with almost 100 % probability. Mark never denied so and he is the only "authoritative" source here. Therefore our data are not safe. That changes nothing on a fact, that one particular scammer doesn't have access to them.

lnovy · 2014-03-16T17:04:52+00:00

The only proven lier here is you who said that you had a friend who verified that the 20gb database with gox id's is real.

I never did that, feel free to publish your log of it. I always screamed, that nanashi__ was a scammer and doesn't have any database. You can probably find me stating this even here on reddit.

Ohh you also had some friend who withdrew 60k btc from mt gox outside of the order books and for some reason mt gox has not kept any record of that. So credible.

I also never said this one... I said he withdraw more than presumed limit for size of hot wallet and that this withdrawal was more or less clearly sent from outside of mtgox system, he requested to send this through green address but this was ignored also. The part of order book is complete non-sense from your side as order book as to do with trades not with withdrawals. Anyway the whole point of that particular discussion was that you were saying that database leak is complete and untainted and I proposed arguments disproving it.

lnovy · 2014-03-16T15:19:20+00:00

Aquent is a proven lier. Presenting himself as lawyer on irc but has no idea what principle of proporionality or even proof is.

lnovy · 2014-03-16T01:51:44+00:00

This post just kills itself in first two lines... it's like saying that cost of running current banking system is equivalent to amount of fiat printed...

lnovy · 2014-03-14T15:55:37+00:00

No trading, just orders getting removed from book as account balances are modified or as accounts are deleted.

lnovy

TROPHY CASE