How was bitcointalk attacked in Dec 2013?

Question

There was a man-in-the-middle attack on bitcointalk on Dec 2013.

News: If you used your password to login between 06:00 Dec 1 UTC and 20:00 UTC, then your password may have been captured in a man-in-the-middle attack, and you should change your password here and wherever else you used it. If you were only logged in via the "remember me" feature, then you're OK.

How was this executed? Didn't bitcointalk use SSL? Are there technical details on the attack vector?

score 3 · Answer 1 · answered Dec 03 '13 at 09:04

3

The general description has been given before me.Here are technical details on the attack vector.

Assuming the following:

The attacker got a certificate that the client will accept, via poor cert validation or other means.
The attacker knows the IP address of the server, and is in a position on the network to do things like ARP spoofing.

Ettercap includes modules for ARP, DNS and DHCP "interventions", and supports direct SSL MITM

answered Dec 03 '13 at 09:04

Meterbuchus

479
3
7

1

Do you have specific knowledge that the attackers got such a certificate, or are you speculating? – Nate Eldredge Dec 03 '13 at 13:34
I'm just stating a possibility – Meterbuchus Dec 03 '13 at 20:55

score -1 · Answer 2 · answered Dec 02 '13 at 14:43

-1

Sure. They just hacked their cloudflare account, and set different IP address for the domain bitcointalk. Therefore, every visitor was actually logging into malicious form.

answered Dec 02 '13 at 14:43

Maciej Mączko

451
2
7

1

This doesn't address the SSL question. – Nate Eldredge Dec 02 '13 at 14:57

score -1 · Answer 3 · answered Dec 02 '13 at 15:21

In cryptography and computer security Man in the Middle is a form of active eavesdropping in which the attacker makes independent connections with the victims and relays messages between them, making them believe that they are talking directly to each other over a private connection, when in fact the entire conversation is controlled by the attacker. The attacker must be able to intercept all messages going between the two victims and inject new ones, which is straightforward in many circumstances (for example, an attacker within reception range of an unencrypted Wi-Fi wireless access point, can insert himself as a man-in-the-middle).

Bitcointalk uses SSL.How they got passed it, I don't know

Yeah, I know what Man in the Middle is. The question was about the specific details of this attack, especially SSL. — ripper234, Dec 03 '13 at 06:46

How was bitcointalk attacked in Dec 2013?

3 Answers3