In this story we can see BIPS got hacked, but I don't get how it was hacked when it was offline because of the DDoS.
closed as primarily opinion-based by Xander, TildalWave, Adi, Lucas Kauffman, this.josh Jan 3 '14 at 23:40
Many good questions generate some degree of opinion based on expert experience, but answers to this question will tend to be almost entirely based on opinions, rather than facts, references, or specific expertise. If this question can be reworded to fit the rules in the help center, please edit the question.
The story links to another article which contains a little more data. Namely:
[The] company was targeted on 15th November by a massive DDoS attack. Then on 17th November, it was followed up by a subsequent attack that disabled the site and “overloaded our managed switches and disconnected the iSCSI connection to the SAN on BIPS servers”.
“Regrettably, despite several layers of protection, the attack caused vulnerability to the system, which has then enabled the attacker/s to gain access and compromise several wallets,” the company said in a written statement.
From this, we may guess that the initial DDoS was not the actual attack, but may have been a way to harass the security teams, to force them to switch to emergency systems with perhaps suboptimal protection, to serve as a diversion, or maybe to gather information on the network structure and safety procedures. A DDoS or something equally crude and brutal is often seen as part of a larger attack scheme, if only for the chaos and confusion is creates.
The sentence about an "overloaded switch" would indicate that the switch was spammed to death with fake packets, in order to demote it to hub mode, thus allowing much easier eavesdropping of packets in the network, in particular exchanges between the BIPS server and its storage system, which appears to be a remote SAN accessed through the iSCSI protocol. In effect, this would allow attackers to read and write arbitrary files on what the server sees as "its hard disk"; that vulnerabilities may follow is then unsurprising. However, all of this supposes that the attacker could already hijack another system on the same LAN, so it is pretty clear that we do not get the full picture here.
In any case, this does not seem to be a weakness in the Bitcoin protocol itself.
This is actually a well used attack technique:
Load the victim with a DDoS or other high traffic attack, thus making it impossible to look at all the logged data, then conduct the exploit. Any failed systems may be blamed on the DDoS, at least initially, and if logs fail, the attacker may get away with it for a longer period.