+- Hack Forums (https://hackforums.net)
+-- Forum: Money (https://hackforums.net/forumdisplay.php?fid=241)
+--- Forum: Crypto Currency (https://hackforums.net/forumdisplay.php?fid=380)
+--- Thread: Huge vulnerability found in AllCrypt.com (/showthread.php?tid=4643658)
Huge vulnerability found in AllCrypt.com - Abraham Lincoln - Jan 18, 2015
EDIT: They still haven't fixed the issue. 3 months and the site is still vulnerable. I'd recommend you pull out all your coins from them.
So back in early December I was messing around on AllCrypt.com, working on some automation methods to save myself time, and I came across a huge vulnerability in their system. Essentially it would allow me to withdraw as much of any coin as I wanted from their hot wallet. I would estimate that to easily be in the 5+ digits USD wise.
I immediately contacted their support and reported the issue to them. They respond within a few hours and I communicated with them closely for the next day giving them information. In a few days they had it patched up. There was just one catch that surprised me, they locked my AllCrypt account, put my coin balances on hold, and stopped responding to my support inquiries. I messaged them asking for my BTC back.
39 days and 4 messages later, they finally responded with this: (I've edited it to remove any hints as to what the vulnerability was)
Quote:It took us forever to clean up the mess. Don't get snippy with "and I want [my BTC and OMC] back" - you were violating the terms and conditions of the site by [what you did]. By the terms you agreed to by your usage of the site, we have every right to leave it on lockdown. So you'll excuse us if we have other matters to attend to and repairing your account isn't top priority.
The balance has been restored. We added safeguards to protect against that sort of thing again. Don't go [doing what you did]. They will be flagged in the future and might result in an auto-IP ban from the intrusion detection system.
It seemed quite odd to me that they would treat someone who found, did not abuse, and reported such a major bug in this manner. To make it even more unusual a couple of months before I had been messing around and found a mysql bug in their system. Even though it was a tiny, completely safe bug, they gave me a decent bounty and thanked me for finding it. But now it seems everything has changed and suddenly I'm on the wrong moral ground. What is up with that?
Now, let me clarify some things:
I was in violation of their TOS. They had every right to do what they did. I do not deserve anything, no do I expect to be given a reward.
I am not complaining about the fact that I didn't receive a bounty.
I am simply posting this as I thought it would be fun to share.
No, I'm not going to give any details of this attack out. Don't bother asking.
tl;dr: I could have stolen a bunch of the money from AllCrypt.com, but reported the bug instead. They then blocked me from the system and ignored me, which seemed odd to me, considering my actions.
* - Doctor Blue - Jan 18, 2015
This is one of those cases where you wish they'd get mad before you actually did it. Then you'd probably just have publicized it ^^
* - Weeping Angel - Jan 18, 2015
Well it seems quite odd that they would punish you for telling them an issue to fix.
My old school did crap like that. Like.. if you found some kind of weird method that someone could use to get into the teacher's files or something and immediately went and told them, they'd get you put in detention for days for "hacking".
* - Chief - Jan 18, 2015
That's fucked on their part. You could've easily stolen a lot of money, but you didn't.
* - Fʀᴀɴᴋɪᴇ - Jan 18, 2015
They should be a bit more understanding and compassionate with you. You literally had access to their money and didn't take it.
They sound like (judging from the response) arrogant pricks.
Also: Congrats on finding the exploit.
* - Illuminati - Jan 18, 2015
That's what you get for helping someone nowadays.
You should have just withdrew a lot of money and bailed.
This is beyond fucked up.
* - Supreme - Jan 18, 2015
Eh, this is one of the outcomes for doing a good deed. At least you reported the vulnerability.
* - webdev77 - Jan 18, 2015
I think I'm done with allcrypt for good. Their site hasn't improved any since I started using it and it's kind of unreliable.
* - VRUMM - Jan 18, 2015
Seems odd they would do that, but something tells me someone took advantage of the exploit you found already.
(Jan 18, 2015 09:16 PM)webdev77 Wrote: I think I'm done with allcrypt for good. Their site hasn't improved any since I started using it and it's kind of unreliable.
I couldn't find any realiable alt-coins exchange except for btc-e
* - NiktoKan - Jan 18, 2015
Locking members' account who warn them is a bad practice. Who will help them next time?
Few months back there is a white hat hacker who exploit a vulnerable exchange but return back money later on. Maybe next time you can do the same way.
Since AllCrypt.com is not good, maybe we should find other exchange for OMC.
* - Abraham Lincoln - Jan 18, 2015
(Jan 18, 2015 09:29 PM)NiktoKan Wrote: Locking members' account who warn them is a bad practice. Who will help them next time?
Few months back there is a white hat hacker who exploit a vulnerable exchange but return back money later on. Maybe next time you can do the same way.
Since AllCrypt.com is not good, maybe we should find other exchange for OMC.
I would really like to get it on Cryptsy.com. From what I've heard it's a pretty good exchange for altcoins.
* - Raoul Duke - Jan 18, 2015
There is one thing I hate from Allcrypt: withdrawals fee change very often without any warnings from them. Sometimes my BTC's get stuck because I'm under the "minimum withdrawal amount" and the next day it's ok ...
* - Fudster - Jan 18, 2015
Thats sooo stupid. Why would they restrict your account and then respond to you like that? They should be thankful that you didn't take their $$$.
Also about the other exchange comment.
https://bleutrade.com/ Maybe?
* - adampelletgun - Jan 18, 2015
That's a dick move by them.
Congrats on finding the vuln though.
* - Vigor - Jan 18, 2015
Dude seriously? Fucking post it. Don't let people treat you like your their little bitch. Show them that YOU'RE THE ONE IN CONTROL.