* baritus (~baritus@unaffiliated/baritus) has joined #digitalcoin
* ChanServ gives channel operator status to baritus
* PirateKitteh (PirateKitt@gateway/shell/bnc4free/x-wxybiuzggocxfzpv) has joined #digitalcoin
* wesleyh has quit (Ping timeout: 252 seconds)
* wesleyh ([email protected]) has joined #digitalcoin
<baritus> hey
<ThinkThrough> Hey
<ThinkThrough> how goes
<baritus> through some PHP bug(I'm guessing) or some trojan that's going around, some hacker was able to reset password on c ave
<baritus> for a few users
<baritus> not sure how it's possible since I already looked at all my code and it doesn't allow for it ever
<baritus> and the other odd things is, they were able to get the verification email codes
<baritus> from the user's email accounts
<baritus> which I am not sure of how they did it either
<baritus> good news is, I had detection kick in that locked out those accounts
<baritus> so I still have everyone's funds
<baritus> but the bad news is, someone has a trojan embedded in a lot of crypto community or some unknown bug in PHP makes it completely insecure
<Eli0t> :(
* Takuza (803d7964@gateway/web/cgi-irc/kiwiirc.com/ip.128.61.121.100) has joined #digitalcoin
<Mikey2011> So what is the plan?
<Eli0t> trawl the logs i guess
<baritus> well I already did that
<baritus> legit requests were sent
<baritus> to the actual emails
<baritus> and were somehow verified through the code that was sent to the user
<delete> !dgc
<DGCBot> DGC Prices (Cryptsy) - BTC: 0.000082025 USD: $0.05. Difficulty: 7.167. Hashrate: 367.07 Mh/s
<baritus> only high value accounts were targeted
<baritus> so someone already had the email, username, pin of the users
<Eli0t> thats quite disturbing
<Takuza> @ . @
<baritus> very easy to create a trojan, embed it into a new "coin", and infect anyone who installs it with full access
<Eli0t> implies the abilty to read the database
<Eli0t> if they can pick high value targets
<baritus> database can't be read
<baritus> fully encrypted
<baritus> I don't even store usernames just a hash of them
* infojunkie ([email protected]) has joined #digitalcoin
<baritus> so that's not possible.
<samson_> good morning
<Eli0t> salted i guess
<baritus> I use bcrypt and yeah
<baritus> that's not how
<baritus> they went through the full recovery process
<baritus> including sending the mail and clicking the link in it
<Eli0t> wonder what recent coins techbytes and mobgod where mining
<delete> maybe they captured the email in some smtp relay?
<baritus> I use google servers to directly send mail
<samson_> So this is no script kiddie attack - it's someone who wants to take the exchange out
<ThinkThrough> then either its a trojan on the user's end
<baritus> yeah there are no bugs in the code
<ThinkThrough> how can you be sure that they got the verifaction mail
<baritus> so there must be in the language
<baritus> or the users