Security Comparison of Bitcoin-Denominated Instruments Exchanges
Monday, 27 August, Year 4 d.Tr. | Author: Mircea Popescu
| I. Interference with the client-server relationship. | |
| I.1. Dictionary attack. | |
| MPEx | A dictionary attack has not yet been deployed successfully against GPG. |
| GLBSE | Recent user account compromise through dictionary attack (could also have been user error). Mitigation includes reCaptcha, a system which was defeated in the field (notably by 4chan in the moot on Time 100 incident) and optionally Security token (Yubikey). |
| Cryptostocks | No mitigation. |
| icbit | No mitigation. |
| I.2. Session stealing. | |
| MPEx | No sessions to steal. |
| GLBSE | Theoretically possible. |
| Cryptostocks | Theoretically possible. |
| icbit | Theoretically possible. |
| I.3. Man in the middle attack. | |
| MPEx | As strong as GPG (successful attack never demonstrated so far). |
| GLBSE | As strong as https (at least one particular form of successful attack demonstrated at Blackhat Conference 2009). |
| Cryptostocks | As strong as https (-"-). |
| icbit | As strong as https (-"-). |
| I.4. Data leakage. | |
| MPEx | No foreign properties embedded on page. |
| GLBSE | Leaks user details through Google Analytics javascript and Twitter image embed. |
| Cryptostocks | Leaks user details through Google Analytics javascript. |
| icbit | Leaks user details through Google Analytics javascript. |
| II. Interference with the server. | |
| II.1. Server rooted. | |
| MPEx | List of user keyids and assets exposed. No emails (other than embedded in signature). No passwords. Server does not run bitcoin client. |
| GLBSE | Emails (salted & hashed ?), user passwords (presumably bcrypted ?) and assets exposed. Hot wallet (unknown limits). |
| Cryptostocks | Emails (hashed ?) and user passwords (presumably bcrypted ?) and assets exposed. Hot wallet ? |
| icbit | -"- |
| II.2. DNS poisoning / stealing. | |
| MPEx | Maintains its own DNS servers. |
| GLBSE | Uses CloudFlare (4chan was recently defaced by UGNazi through partial attack on CloudFlare using flaws in Google Auth). |
| Cryptostocks | Godaddy DNS servers. |
| icbit | DNS by nic.ru |
| II.3. Server uptime. | |
| MPEx | 100% past 30 days. |
| GLBSE | ~98% past 30 days. |
| Cryptostocks | 100% past 30 days. |
| icbit | 100% past 30 days. |
| III. Non-technical threats. | |
| III.1. Legal. | |
| MPEx | Unregistered. Public face seems to be a Romanian national located in Romania (EU). |
| GLBSE | Unregistered. Public face seems to be an English national located in China. Either the exchange itself, the public face or both may be identified at a later date as Does in the Cartmell - Bitcoinica lawsuit. Holds personally indentifying information of users without a license (an offense in the EU). |
| Cryptostocks | Unregistered. Seems to be subsidiary of Vircurex (BTC exchange, ~150 BTC monthly volume). |
| icbit | Unregistered. Owner unknown. |
| III.2. Inheritance of assets. | |
| MPEx | Can suspend activity cleanly by providing asset owners with list of holders' signatures and shareholders signed/encrypted lists of their own assets. |
| GLBSE | Suspension of activity would likely include an account claiming procedure, similar to Bitcoinica's. |
| Cryptostocks | -"- |
| icbit | -"- |
| III.3. Fraudulent assets. | |
| MPEx | Theoretically possible. No self-serve procedure for asset creation by users. No self-serve procedure for share creation by asset owners. Detailed, GPG signed contracts. |
| GLBSE | Over half of assets listed historically turned fraudulent. Changes in asset creating process might have reduced but are unlikely to have completely eliminated the listing of such. Few assets have actual contracts associated. The rights of shareholders are not protected against arbitrary contract modifications. Asset creators have the ability to create more shares and thus to dillute any asset. |
| Cryptostocks | No actual assets. |
| icbit | No actual assets. |
Category: Meta psihoza
Monday, 3 September 2012
Problem is three fold. First, 2FA enabled does not require 2FA for every action, you have to click ALL the boxes to do this. Second, there is no 2FA option for buying/selling, only transferring assets between GLBSE accounts and withdrawing BTC and password changing and logging in, thus flash crashes using your assets is still possible. Third, GLBSE can (but doesn't) set cookies for session only, which means closing the browser clears the session cookies, but you should manually log out anyhow so this is the least problematic of the three.
I have brought this up with nefario before, he has not fixed it yet.
Via.
Saturday, 6 October 2012
Aaaand... it's gone.