![]() -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 09/19/14 Fellow Onionshop Community, About 2 days ago we suffered a hack of our database. The hacker replaced addresses in our BTC-Pool and managed to snatch payments for 3 orders with a total of 700$. Fortunately we had some extra security mechanisms in place that were able to prevent further damages and left most orders unaffected. After noticing that our system has been compromised, we instantly moved to a new server and changed up everything security related. We also changed our sourcecode to assign BTCs to orders directly from electrum MPKs, without storing them in a pool before. Additionally we introduced a different server where customers can doublecheck if their assigned BTC address is legit. At first, we suspected a vulnerability in our image upload script. The script checks various characteristics of files that are being uploaded and is supposed to allow only real JPG files. We noticed that somebody has managed to upload a file with a different extension shortly before the hack, so we assumed to have found the problem. The upload script was removed on the new server and planned to be replaced. Today the hacker has contacted us, stating that he still has access to our db and that the vulnerability he was exploiting is still in place. We hoped it is a weak attempt to get more BTC after losing access to our db - but he could prove us wrong and indeed, still had access. He tried to blackmail us paying 15 BTC to get info on the vulnerability. We dont see this as an option for many reasons. So here we are, searching for a needle in a 30k lines of code-haystack. Even though the hacker will have a hard time stealing any more coins with the latest changes to our BTC handling (probably the reason he offered to sell us info on the bug in the first place), he still has access to our db. and there still is a vulnerability that can enable others to get there too. The safety of our vendors, customers, and ourselves of course has always been top priority for us. Thus the only acceptable consequence for us is to take the whole site offline for an unknown amount of time. Fixing and improving various parts of the code and relaunching in a few days would work, but doesnt meet the high demands we have towards our OPSEC. In order to reopen, we have to inspect our whole code, rewrite fundamental parts of it and do a lot of security and penetration testing. As of today, we are not sure yet on which path we will take from here exactly. We will need some time evaluating everything before we can announce a plan on how we move forward. Most likely we will develop a new version of Onionshop, preferably OpenBazaar-based, if this should become an option soon. We will keep running this domain and keep you updated here. Every order that has been placed will be shipped regularly. We leave the vendors area accessible so that any unfinished business can be taken care of: onionshopkue7sxr.onion/vendorlogin If you are a customer, please contact your vendor through another market, the Hub, or any other form of communication they provide. Below this text we provide a link to a list of our vendors and where to contact them. If you need something from your User-area which cannot be provided by the vendor, please contact us directly on the Hub (thehub7dnl5nmcz5.onion, username Onionshop) and we will look into it for you. Unlike 6 months ago when we launched Onionshop, there is a wide range of good and promising marketplaces nowadays where you can go to alternatively. Check out the marketlist of Deepdotweb.com for example. From our own experience, we recommend using Evolution (http://k5zq47j6wd3wdvjq.onion) or Cloud9 (http://bviaqyj6obc54vhn.onion). We are not related to them, nor do we vouch for them, just a good feeling there. Be careful if you use traditional escrow, only deposit funds you need for a purchase. Vendors should withdraw everything immediately after having orders finalized. We are sorry to put everybody through this hassle, but we hope the majority will agree with us, that in consideration of the situation, this is the only way to go. We thank all our loyal vendors and customers for putting trust in us and choosing Onionshop to roll with. Special shout-out goes to the people we have been working with, especially our 2 developers and our graphic designer. Please contact us through the hub! Rest assured, we will not disappear, nor do we break any agreement we have made. We stay right where we are and will do anything possible to support our userbase through these tumultuous times. There wont be another sheep on our watch, Take Care, Onionshop -----BEGIN PGP SIGNATURE----- Version: BCPG v1.47 iQE+BAEBAgAoBQJUHLxXIRxPbmlvbnNob3AgPG9uaW9uc2hvcEBub21haWwuY29t PgAKCRBp3g3EZKASh5aAB/oDVYkTw51N/uuoCnvT1q7JHchQk4f+9drEVsPIWGrs LiA6RG7xSuy4LBRMOou6p5Mz3oGI/jM0DGa/xmWCnWks74msph/+nfc9x/Ls9Osu /UFgrC1W9S2I2tA50LAJxrnm9DAeVh4Zi3QEo5QIixnxBpYZb+L2URvKn42SrdWJ JbdueGY+4btz7+8SPX28rlC0xBWXzMhlrmSSffLl0pXEuq9FYYTdj0aavFf3oAGl 85Y4XsyDf4jKD+J8inDVnBwu5THTVFDjjfKMgeDk95i60Si5zYAWsSr3CiMAQGYw 0A8knKKkBcRKNN5xCHkztfywd5DYiVDQj/VE+uTb8kAP =gxLc -----END PGP SIGNATURE----- Where can I reach my vendor now? we have set up a list here Our PGP: -----BEGIN PGP PUBLIC KEY BLOCK----- Version: GnuPG v2.0.22 (GNU/Linux) mQENBFNKKIgBCAChSJUWJVbTNjbdx3H0MhvoXLNJI9ip4YSROOsZGndPXHSOBkHv 5mOaLTq6x4w773F52n9aeexvhwBDxTOezy5DajCPRFKiBWK9zn0ZgeXFzkSfja92 V6bDz/mpkuGDL4fGcP+XH3lBMK9oKizxX/slnxtDv/Nw+t1Uh5tsqR4SeNYP3BOn ThmAFE4Y+XA85u2Hq97u+HMan0LCtuMo/C+eFn9EI4OLm9lS3uvnTa/i61PDFYPy 2kyQae1ICNi6b5srCvnpZYsg0f4MDy9n78QbqHFMyxcaRj7BaU2W1eiUadfHhMle c/gk3Ymj2e0CieEPxCpHd7yfGmP9FT0lF+lnABEBAAG0IE9uaW9uc2hvcCA8b25p b25zaG9wQG5vbWFpbC5jb20+iQE5BBMBAgAjBQJTSiiIAhsPBwsJCAcDAgEGFQgC CQoLBBYCAwECHgECF4AACgkQad4NxGSgEocOHQf+JIpibh+/QIoMbvFDosAr4Hq3 2eqH52lR5D4dQRaiXENRkYnqo1y6rf/QHwF9VpZHnDuxpcn6KoHrGOJHZxS9vms7 qbvXDUAMMdVVWCeWJEiktpEE3yoiSqrGAXG3nhI1E6ykkP9vR2lUycKYUaSkbSOi LJ7k1QPLi7NcpvgD+fxaL0JMxzeTnWCIeYVsbqALDx8mai+gaRNHP0xHJ5pKS8Yr Uff/1f38Znj022qPMV1pAmMA0N3ELSuLeQ7CCzaCzI65MNaN3vIUJlGAU0o0BvUg 1vsip9EIjQ5yuVXCcfa6z3+m9ymAhb13cmVubiZsf98uYLQeyX3Wq8YI1R3zxA== =y3Id -----END PGP PUBLIC KEY BLOCK----- |