The hacking of the bitcoin exchange Rails

def update
if params[:commit] == 'send_code'
send_code_phase
else
verify_code_phase
end
end

And then passing the requests on the show we send the queries directly to the update:
curl ‘http://app/verify/sms_auth’ -h ‘X-CSRF-token:ZPwrQuLJ3x7md3wolrCTE6HItxkwOiUNhlekdprdkwi=’ -h ‘cookie:_peatio_session=the jungle and WOS river –HTTP data=patch&sms_auth%5Bcountry%5D=de&sms_auth%friends 5B%5D=9123222211&commit=send_code’

curl ‘http://app/verify/sms_auth’ -h ‘X-CSRF-token:ZPwrQuLJ3x7md3wolrCTE6HItxkwOiUNhlekdprdkwi=’ -h ‘cookie:_peatio_session=the jungle and WOS river –HTTP data=patch&sms_auth%5Bcountry%5D=de&sms_auth%friends 5B%5D=9123222211&sms_auth%5Botp%5D=CODE_WE_RECEIVED’

When you connect SMS 2FA, we can receive codes to our number and withdraw bitcoins to your address.

If the victim has SMS and Authenticator
If the victim is a paranoid method to use 2FA then the work becomes a little more complicated. The system is vulnerable to brute force 2fa codes, in other words it is very easy to bypass. Unlike conventional password, where 36^8+ variants, in single code only 1 million options. Three days is enough to guess it calmly. You can count on OTP Bruteforce Calculator yourself:

Without protection from Brutus 2FA does not make sense, that's right at all. A common misconception, incidentally, that 30-second window makes bruteforce harder. In fact, there is almost no difference that 1 second that 24 hours this code is active, 3 days will be enough.

If only SMS 2FA
This looks like the most difficult option — because bruteforcing quietly fail and the victim will immediately notice a suspicious SMS on his number. However, another error in the code will help us:

def two_factor_by_type
current_user.two_factors.by_type(params[:id])
end

This method does not use scope "activated" so you can continue to bruteforcing 2FA like Google Authenticator as in the previous case, despite the fact that it was never activated, because the seed had already generated!

Attack the admin

Now that we have learned to steal and bypass 2FA for any user try to apply the resulting exploit wisely. We will not hunt for users, and immediately write a ticket to the administrator " What is wrong with my account can you please check? I.will.hack.you/now". After visiting this page, our script will hijack the admin account.

Unfortunately, it turned out that the administrator can do almost nothing. There are no functions "send all bitcoins to X" or "add bitcoins to this user". The only clue is the possibility of Fiat approval of deposits made by users. So we can create a Deposit for a lot of money and approve it ourselves:

Then we can buy all available on the orders of bitcoins and instantly withdraw them (instantly only because we are the administrator and will approve their own Withdraw request, conclusions in the exchange are made manually!). But much more profit IMHO will bring the option when we quietly drink the blood of the exchanges a week or two.

Morality:

1. Never add login through social networks to important sites. They have too many ideological flaws, so it's better not to get involved at all.
2. If we decided to do two-factor authentication, do it right from the start — clearly follow the procedure to add a new method and prevent bruteforce by locking the account after N attempts.
3. Create a separate Superadmin with the function of pouring an arbitrary number of money into the system. He should not be able to read tickets and in General this account should be stored as the Apple of his eye.

Thank you for your attention, and if you want to protect your service, you know who to contact.