In this story we can see BIPS got hacked, but I don't get how it was hacked when it was offline because of the DDoS.


The story links to another article which contains a little more data. Namely:

[The] company was targeted on 15th November by a massive DDoS attack. Then on 17th November, it was followed up by a subsequent attack that disabled the site and “overloaded our managed switches and disconnected the iSCSI connection to the SAN on BIPS servers”.

“Regrettably, despite several layers of protection, the attack caused vulnerability to the system, which has then enabled the attacker/s to gain access and compromise several wallets,” the company said in a written statement.

From this, we may guess that the initial DDoS was not the actual attack, but may have been a way to harass the security teams, to force them to switch to emergency systems with perhaps suboptimal protection, to serve as a diversion, or maybe to gather information on the network structure and safety procedures. A DDoS or something equally crude and brutal is often seen as part of a larger attack scheme, if only for the chaos and confusion is creates.

The sentence about an "overloaded switch" would indicate that the switch was spammed to death with fake packets, in order to demote it to hub mode, thus allowing much easier eavesdropping of packets in the network, in particular exchanges between the BIPS server and its storage system, which appears to be a remote SAN accessed through the iSCSI protocol. In effect, this would allow attackers to read and write arbitrary files on what the server sees as "its hard disk"; that vulnerabilities may follow is then unsurprising. However, all of this supposes that the attacker could already hijack another system on the same LAN, so it is pretty clear that we do not get the full picture here.

In any case, this does not seem to be a weakness in the Bitcoin protocol itself.

  • One should not tile out that the only true part of the story was the DDOS attack and the owners simply took the BTC. The price of BTC in Nov was a great deal more then it is today – Ramhound Jan 3 '14 at 22:33

This is actually a well used attack technique:

Load the victim with a DDoS or other high traffic attack, thus making it impossible to look at all the logged data, then conduct the exploit. Any failed systems may be blamed on the DDoS, at least initially, and if logs fail, the attacker may get away with it for a longer period.

Not the answer you're looking for? Browse other questions tagged or ask your own question.