📅 Original date posted:2011-06-21
🗒️ Summary of this message: Dozens of MTGOX hashed passwords were disclosed on a hash cracking forum in 2011, indicating a breach earlier than the official timeline.
📝 Original message:Oh ya, forgot this tidbit. Thanks gmaxwell!:
Not mentioned here is that fact that dozens of MTGOX hashed passwords were quietly disclosed on a hash cracking forum on Fri Jun 17, 2011 5:21 am
(http://forum.insidepro.com/viewtopic.php?t=9124&postdays=0&postorder=asc&start=75&sid=1a9e31567fe815c0eea63c40c39fb707 post by "georgeclooney")
Since the overwhelming majority but not all of the hashes match the mtgox database that was posted on this forum (now deleted) and elsewhere I suspect that this post may have been generated from an earlier dump than was disclosed on the forums and everywhere else after the big event.
This appears to be significantly ahead of the prior claimed breach, and is consistent with the great many other mtgox users claiming that their accounts were robbed prior to the big event on Sunday, which I believe would have been too early to be results of the mtgox database leak according to the official timeline re: auditor compromise.
On Jun 20, 2011, at 11:17 PM, Doug Huff wrote:
> I have two independent sources claiming known SQLi vulnerabilities in MtGox.
>
> One of said SQLi vulnerabilties was confirmed to be patched on the 16th.
> The other was not patched, to anyone's knowledge, at the time of the market crash and database leak. The one that was not patched could have plausibly been used to dump the user table.
>
> The details follow in these chat logs. POC for the referenced xss+csrf is also provided. Whether or not it is still an issue is not known for sure at this time as the site cannot be accessed.
>
> It has also been found that MtGox exposes it's admin user interface even if a user does not have the admin flag set on their account. As of now it is thought that most actions attempted to be used will throw permission errors. Once again. This cannot be confirmed at this time. https://mtgox.com/app/webroot/code/admin
>
> MagicalTux, now that your claim "The site was not compromised with a SQL injection as many are reporting, so in effect the site was not hacked." Please respond. The truth this time.
>
> MagicalTux's official response at the time of this writing is also attached. It is available at:
> https://support.mtgox.com/entries/20208066-huge-bitcoin-sell-off-due-to-a-compromised-account-rollback
>
> These logs are not modified except for user's hostmasks at their request due to MagicalTux's new found policy of committing libel against his users based on login logs, since he apparently doesn't keep order book logs for orders that go through immediately, by his own admission. Classy.
>
> Mirrors:
> http://privatepaste.com/93e8a9cd64 (#bitcoin-hax log)
> http://privatepaste.com/47a50cab5b (sig)
> http://www.mediafire.com/?m7o4z3oz9nyd3v3 (#bitcoin-hax log)
> http://www.mediafire.com/?nzcpa5mwpw9ccbb (sig)
> http://privatepaste.com/e4bacfae37 (PovAddict log)
> http://privatepaste.com/9dc5daf8a0 (sig)
> http://www.mediafire.com/?bflr76anvv835ib (PovAddict log)
> http://www.mediafire.com/?rl250c2dahw7dx9 (sig)
> http://privatepaste.com/6dad3927d6 (XSS + CSRF)
> http://privatepaste.com/45e5aa0d30 (sig)
> http://www.mediafire.com/?synt5sjcbkl9zvq (XSS + CSRF)
> http://www.mediafire.com/?uv7be34198pseoo (sig)
--
Doug Huff
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 3737 bytes
Desc: not available
URL: <http://lists.linuxfoundation.org/pipermail/bitcoin-dev/attachments/20110620/11e15a1e/attachment.p7s>;
-------------- next part --------------
A non-text attachment was scrubbed...
Name: PGP.sig
Type: application/pgp-signature
Size: 881 bytes
Desc: This is a digitally signed message part
URL: <http://lists.linuxfoundation.org/pipermail/bitcoin-dev/attachments/20110620/11e15a1e/attachment.sig>;
Doug Huff [ARCHIVE] /
npub1u2…h63q3
2023-06-07 01:57:48
in reply to nevent1q…dacf
Author Public Key
npub1u2s36t2ty2ska7aswtr6kewwla57z978cdjzqpcl8zc3naadx66sah63q3Published at
2023-06-07 01:57:48Event JSON
{
"id": "e932406274817a020fc2eb9a774abc6669f612b09e4205ed10e85e7c1624b882",
"pubkey": "e2a11d2d4b22a16efbb072c7ab65ceff69e117c7c36420071f38b119f7ad36b5",
"created_at": 1686103068,
"kind": 1,
"tags": [
[
"e",
"5f33f74a7a65cd787aabc3d9184178932d5119566b0e83f840a2560c953c89e8",
"",
"reply"
],
[
"p",
"a23dbf6c6cc83e14cc3df4e56cc71845f611908084cfe620e83e40c06ccdd3d0"
]
],
"content": "📅 Original date posted:2011-06-21\n🗒️ Summary of this message: Dozens of MTGOX hashed passwords were disclosed on a hash cracking forum in 2011, indicating a breach earlier than the official timeline.\n📝 Original message:Oh ya, forgot this tidbit. Thanks gmaxwell!:\n\nNot mentioned here is that fact that dozens of MTGOX hashed passwords were quietly disclosed on a hash cracking forum on Fri Jun 17, 2011 5:21 am \n(http://forum.insidepro.com/viewtopic.php?t=9124\u0026postdays=0\u0026postorder=asc\u0026start=75\u0026sid=1a9e31567fe815c0eea63c40c39fb707 post by \"georgeclooney\")\n\nSince the overwhelming majority but not all of the hashes match the mtgox database that was posted on this forum (now deleted) and elsewhere I suspect that this post may have been generated from an earlier dump than was disclosed on the forums and everywhere else after the big event.\n\nThis appears to be significantly ahead of the prior claimed breach, and is consistent with the great many other mtgox users claiming that their accounts were robbed prior to the big event on Sunday, which I believe would have been too early to be results of the mtgox database leak according to the official timeline re: auditor compromise.\n\nOn Jun 20, 2011, at 11:17 PM, Doug Huff wrote:\n\n\u003e I have two independent sources claiming known SQLi vulnerabilities in MtGox.\n\u003e \n\u003e One of said SQLi vulnerabilties was confirmed to be patched on the 16th.\n\u003e The other was not patched, to anyone's knowledge, at the time of the market crash and database leak. The one that was not patched could have plausibly been used to dump the user table.\n\u003e \n\u003e The details follow in these chat logs. POC for the referenced xss+csrf is also provided. Whether or not it is still an issue is not known for sure at this time as the site cannot be accessed.\n\u003e \n\u003e It has also been found that MtGox exposes it's admin user interface even if a user does not have the admin flag set on their account. As of now it is thought that most actions attempted to be used will throw permission errors. Once again. This cannot be confirmed at this time. https://mtgox.com/app/webroot/code/admin\n\u003e \n\u003e MagicalTux, now that your claim \"The site was not compromised with a SQL injection as many are reporting, so in effect the site was not hacked.\" Please respond. The truth this time.\n\u003e \n\u003e MagicalTux's official response at the time of this writing is also attached. It is available at:\n\u003e https://support.mtgox.com/entries/20208066-huge-bitcoin-sell-off-due-to-a-compromised-account-rollback\n\u003e \n\u003e These logs are not modified except for user's hostmasks at their request due to MagicalTux's new found policy of committing libel against his users based on login logs, since he apparently doesn't keep order book logs for orders that go through immediately, by his own admission. Classy.\n\u003e \n\u003e Mirrors:\n\u003e http://privatepaste.com/93e8a9cd64 (#bitcoin-hax log)\n\u003e http://privatepaste.com/47a50cab5b (sig)\n\u003e http://www.mediafire.com/?m7o4z3oz9nyd3v3 (#bitcoin-hax log)\n\u003e http://www.mediafire.com/?nzcpa5mwpw9ccbb (sig)\n\u003e http://privatepaste.com/e4bacfae37 (PovAddict log)\n\u003e http://privatepaste.com/9dc5daf8a0 (sig)\n\u003e http://www.mediafire.com/?bflr76anvv835ib (PovAddict log)\n\u003e http://www.mediafire.com/?rl250c2dahw7dx9 (sig)\n\u003e http://privatepaste.com/6dad3927d6 (XSS + CSRF)\n\u003e http://privatepaste.com/45e5aa0d30 (sig)\n\u003e http://www.mediafire.com/?synt5sjcbkl9zvq (XSS + CSRF)\n\u003e http://www.mediafire.com/?uv7be34198pseoo (sig)\n\n-- \nDoug Huff\n\n\n-------------- next part --------------\nA non-text attachment was scrubbed...\nName: smime.p7s\nType: application/pkcs7-signature\nSize: 3737 bytes\nDesc: not available\nURL: \u003chttp://lists.linuxfoundation.org/pipermail/bitcoin-dev/attachments/20110620/11e15a1e/attachment.p7s\u003e\n-------------- next part --------------\nA non-text attachment was scrubbed...\nName: PGP.sig\nType: application/pgp-signature\nSize: 881 bytes\nDesc: This is a digitally signed message part\nURL: \u003chttp://lists.linuxfoundation.org/pipermail/bitcoin-dev/attachments/20110620/11e15a1e/attachment.sig\u003e",
"sig": "18a0a22803c61ded60c61aaa068664740486a324a911161535a0a47133fedbff22c8d5ff050817133c13100325fc46118b24c28cc969a44ec5a3cb1baedf2a48"
}