Doug Huff [ARCHIVE] / is on Nostr

⚠️ This account is not associated with a real person. It's an archival account for mailing list messages.
🗓️ Active from 2011-06-15 to 2011-06-28
💬 Posted a total of 8 messages
📚 Participated in the following categories: Bitcoin-development
🔇 Please do not DM this user as it's used for archive purposes only.

Last Notes

2023-06-07 03:58:58

- reply

📅 Original date posted:2011-06-28
🗒️ Summary of this message: Doug Huff reported a live trade matching bug on mtgox.com to the Bitcoin Development mailing list, which was deemed irrelevant to core Bitcoin development.
📝 Original message:Begin forwarded message:
> From: Doug Huff <dhuff at jrbobdobbs.org>
> Date: June 27, 2011 11:28:28 PM CDT
> To: Gavin Andresen <gavinandresen at gmail.com>
> Subject: Re: [Bitcoin-development] Fwd: Live mtgox.com trade matching bug.
>
> Already talked to Jeff and agreed to stop posting them here. There is just currently no other forum for such reports. I think he was going to talk to you about starting a bitcoin-vendor-sec or similar list.
>
> I agree it does not belong there.
>
> On Jun 27, 2011, at 11:22 PM, Gavin Andresen wrote:
>
>> The bitcoin-development list is for discussion of core bitcoin
>> development, not about Mt.Gox or other sites or software that uses
>> bitcoin.
>>
>> --
>> --
>> Gavin Andresen
>
> --
> Doug Huff
>
>
--
Doug Huff
On Jun 28, 2011, at 1:35 AM, Mike Hearn wrote:
> Hi Doug,
>
> Could we keep the Mt Gox related stuff off bitcoin-development please?
> It's not related to the core software.
>
> On Tue, Jun 28, 2011 at 4:48 AM, Doug Huff <dhuff at jrbobdobbs.org> wrote:
>>
>>
>> Begin forwarded message:
>>
>>> From: Doug Huff <mith at jrbobdobbs.org>
>>> Date: June 27, 2011 9:46:13 PM CDT
>>> To: full-disclosure at lists.grok.org.uk, "Mt.Gox" <info at mtgox.com>
>>> Cc: Bitcoin Dev Development <bitcoin-development at lists.sourceforge.net>
>>> Subject: Live mtgox.com trade matching bug.
>>>
>>> Step 1: Have USD available for spending on mtgox.com.
>>> Step 2: Put in a buy order large enough to drain your account. Low enough under the current trading price that it will not execute immediately.
>>> Step 3: Withdraw all USD funds.
>>> Step 4: Wait for market to fall enough to meet your order.
>>> Step 5: ...(self explanatory)...
>>>
>>> There's a bit of luck in being able to take advantage, obviously.
>>>
>>> I would suggest you take the site down asap until this is corrected or publicly show how this order will never execute:
>>>
>>> ==========
>>> Welcome <username removed> 0.00000000 ฿TC 424.44901
>>> Buying 138468.901 0.01 Active 1384.69 06/26 15:27 cancel
>>> ==========
>>>
>>> I cannot guarantee this order will execute but from everything I've observed about the new trade matching code I have no reason to believe it will not.
>>>
>>> At the very least this could be used to influence market conditions if it is only a display bug.
>>>
>>> --
>>> Douglas Huff
>>>
>>>
>>
>> --
>> Doug Huff
>>
>>
>>
>> ------------------------------------------------------------------------------
>> All of the data generated in your IT infrastructure is seriously valuable.
>> Why? It contains a definitive record of application performance, security
>> threats, fraudulent activity, and more. Splunk takes this data and makes
>> sense of it. IT sense. And common sense.
>> http://p.sf.net/sfu/splunk-d2d-c2
>> _______________________________________________
>> Bitcoin-development mailing list
>> Bitcoin-development at lists.sourceforge.net
>> https://lists.sourceforge.net/lists/listinfo/bitcoin-development
>>
>>
--
Doug Huff
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 3737 bytes
Desc: not available
URL: <http://lists.linuxfoundation.org/pipermail/bitcoin-dev/attachments/20110628/1d39d1a3/attachment.p7s>

2023-06-07 03:58:32

- reply

📅 Original date posted:2011-06-27
🗒️ Summary of this message: A brief email exchange discussing the licensing of an Info.plist and BitcoinAppIcon.icns for inclusion in an upstream source repository.
📝 Original message:Begin forwarded message:
> From: solar <laszlo.hanyecz at heliacal.net>
> Date: June 27, 2011 5:09:12 PM CDT
> To: Doug Huff <dhuff at jrbobdobbs.org>
> Subject: Re: Bitcoin app bundle inclusion
>
> That's fine, I actually wanted to check it but wasn't sure where it belonged. There isn't any license, it's just public domain.
>
> Thanks,
> Laszlo
>
>
>
> On Jun 27, 2011, at 3:36 PM, Doug Huff wrote:
>
>> Hey Laszlo,
>>
>> We're just wanting to make sure that it's ok to include your Info.plist and BitcoinAppIcon.icns into the upstream source repository so that osx build can be automated without needing external source requirements (outside of lib deps).
>>
>> Is this licensed under MIT or similar or would you be willing to put it in the Public Domain or other compatible license.
>>
>> --
>> Doug Huff
>>
>>
>
--
Doug Huff
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 3737 bytes
Desc: not available
URL: <http://lists.linuxfoundation.org/pipermail/bitcoin-dev/attachments/20110627/ce64e496/attachment.p7s>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: PGP.sig
Type: application/pgp-signature
Size: 881 bytes
Desc: This is a digitally signed message part
URL: <http://lists.linuxfoundation.org/pipermail/bitcoin-dev/attachments/20110627/ce64e496/attachment.sig>

2023-06-07 03:22:32

- reply

📅 Original date posted:2011-06-21
🗒️ Summary of this message: Dozens of MTGOX hashed passwords were disclosed on a hash cracking forum in 2011, indicating a breach earlier than the official timeline.
📝 Original message:Oh ya, forgot this tidbit. Thanks gmaxwell!:
Not mentioned here is that fact that dozens of MTGOX hashed passwords were quietly disclosed on a hash cracking forum on Fri Jun 17, 2011 5:21 am
(http://forum.insidepro.com/viewtopic.php?t=9124&postdays=0&postorder=asc&start=75&sid=1a9e31567fe815c0eea63c40c39fb707 post by "georgeclooney")
Since the overwhelming majority but not all of the hashes match the mtgox database that was posted on this forum (now deleted) and elsewhere I suspect that this post may have been generated from an earlier dump than was disclosed on the forums and everywhere else after the big event.
This appears to be significantly ahead of the prior claimed breach, and is consistent with the great many other mtgox users claiming that their accounts were robbed prior to the big event on Sunday, which I believe would have been too early to be results of the mtgox database leak according to the official timeline re: auditor compromise.
On Jun 20, 2011, at 11:17 PM, Doug Huff wrote:
> I have two independent sources claiming known SQLi vulnerabilities in MtGox.
>
> One of said SQLi vulnerabilties was confirmed to be patched on the 16th.
> The other was not patched, to anyone's knowledge, at the time of the market crash and database leak. The one that was not patched could have plausibly been used to dump the user table.
>
> The details follow in these chat logs. POC for the referenced xss+csrf is also provided. Whether or not it is still an issue is not known for sure at this time as the site cannot be accessed.
>
> It has also been found that MtGox exposes it's admin user interface even if a user does not have the admin flag set on their account. As of now it is thought that most actions attempted to be used will throw permission errors. Once again. This cannot be confirmed at this time. https://mtgox.com/app/webroot/code/admin
>
> MagicalTux, now that your claim "The site was not compromised with a SQL injection as many are reporting, so in effect the site was not hacked." Please respond. The truth this time.
>
> MagicalTux's official response at the time of this writing is also attached. It is available at:
> https://support.mtgox.com/entries/20208066-huge-bitcoin-sell-off-due-to-a-compromised-account-rollback
>
> These logs are not modified except for user's hostmasks at their request due to MagicalTux's new found policy of committing libel against his users based on login logs, since he apparently doesn't keep order book logs for orders that go through immediately, by his own admission. Classy.
>
> Mirrors:
> http://privatepaste.com/93e8a9cd64 (#bitcoin-hax log)
> http://privatepaste.com/47a50cab5b (sig)
> http://www.mediafire.com/?m7o4z3oz9nyd3v3 (#bitcoin-hax log)
> http://www.mediafire.com/?nzcpa5mwpw9ccbb (sig)
> http://privatepaste.com/e4bacfae37 (PovAddict log)
> http://privatepaste.com/9dc5daf8a0 (sig)
> http://www.mediafire.com/?bflr76anvv835ib (PovAddict log)
> http://www.mediafire.com/?rl250c2dahw7dx9 (sig)
> http://privatepaste.com/6dad3927d6 (XSS + CSRF)
> http://privatepaste.com/45e5aa0d30 (sig)
> http://www.mediafire.com/?synt5sjcbkl9zvq (XSS + CSRF)
> http://www.mediafire.com/?uv7be34198pseoo (sig)
--
Doug Huff
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 3737 bytes
Desc: not available
URL: <http://lists.linuxfoundation.org/pipermail/bitcoin-dev/attachments/20110620/11e15a1e/attachment.p7s>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: PGP.sig
Type: application/pgp-signature
Size: 881 bytes
Desc: This is a digitally signed message part
URL: <http://lists.linuxfoundation.org/pipermail/bitcoin-dev/attachments/20110620/11e15a1e/attachment.sig>