Quote from: andyatcrux on June 28, 2016, 01:04:43 PM

Quote from: king_pin on June 28, 2016, 06:41:00 AM

Quote from: Taek on June 27, 2016, 09:42:53 PM

Quote from: king_pin on June 27, 2016, 04:17:09 PM

when I got my first block stolen a few days back I was mining over the internet

The attacker is able to continue stealing because they were able to get your wallet seed. The only way to protect your coins is to create a new wallet with a new seed and to transfer all of your old coins to that wallet.

Quote from: king_pin on June 27, 2016, 04:17:09 PM

The weird thing is (PLEASE EXPLAIN THIS) is why the hacker transaction gets displayed with a red $ instead of a red heart in the GUI wallet?

You are using the old GUI, which has a few bugs with regards to the way it displays the transaction. I'm not sure why it distinguishes them that way, as the person who wrote our GUI is gone. My best advice is that you shouldn't use v0.5.2 GUI and instead stick to the command line. The v1.0.0 GUI will be out sometime tomorrow barring some major incident.

----------------------------

I cannot verify that your internal connection is secure. I know that miners using only localhost have not been having problems. If the attacker is able to get past your firewall in any way, that may be enough for them to get access to your wallet api. I am not sure. If you exposing your api port over anything other than localhost, you are putting yourself at risk. Some people know enough about network security to do this safely, but if you can't say with certainty that you know how to expose your api in a secure way, you should not be doing it.

We're looking at ways to make things more secure out-of-the-box, but security is very difficult and it's not something we can clean up in just a few days. There are a few things we can do but a sufficiently good attacker has a lot of tools to break into an exposed api. Simply adding a password may not be sufficient, and there are some significant issues with implementing TLS into the api - namely, you need a way to give both sides a key, and simply using Diffie-Helman isn't good enough because you have to distinguish between an attacker and your own client. Websites don't have this issue because they have user accounts.

On the bright side, a few miners have reported that the weird transactions listed in the v0.5.2 GUI were not actually stolen transactions. On the less bright side, miners who are CLI-only have reported stolen coins. Yours might be in the former category.

As you probably later read I did create new installs of my wallet yet the attacked managed to get to them too.
Maybe once compromised my local network remains vulnerable to the attacker IDK too.
When I set my wallet to localhost I can only mine with the local rig, other rigs on the same network can not find the wallet on the rig that it is installed... IDK why I have to bind it to the physical local address 192.168...:port instead of localhost:port Sad

Also I get different balances and transactions when running the same wallet on different computers and get some weird transactions of -0.03 SIA or 0.00 SIA even on not compromised wallets... wtf?

You should address those issues, basically your coin is not mineable except on localhost, when using SSL tuneling or when lucky. If I can be of any assistance (mainly with more info PM me)

You are using the official miner software directly from Nebulous Labs github repo? Or did you compile the gominer yourself? What miner software are you specifically using? A lot of us have been mining SC for a year now with no loss of coins, so it is perplexing you are having this issue. There is of course plenty of malicious software out there that could compromise your system. Namely, untrusted binaries of the various available mining software.

+1 - no issues for me too.

But i dont mind price plummeting, i need a bigger piece of the pie.