Quote from: utahjohn on March 25, 2014, 01:50:00 AM

Quote from: tachyon_john on March 25, 2014, 01:47:40 AM

Quote from: comeonalready on March 24, 2014, 08:48:11 PM

Quote from: paul.miner on March 24, 2014, 08:22:45 PM

If anyone has packet captures of work packets sent after their client was hijacked, could you post or send them? I'd be curious to see what they were mining. If it's DOGE, I'm also set up to extract the payout address from the coinbase parameters. A packet should look like this (I think this was an old packet capture from Clevermining):

Code:

{"id":null,"method":"mining.notify","params":["3a61","34d9b767ab5f9e4270ca11e6f823da99af2b6da089d7cb21490c3cce4831ac63","01000000010000000000000000000000000000000000000000000000000000000000000000ffffffff2703780702062f503253482f0436221c5308","0d2f6e6f64655374726174756d2f0000000001241b6d23db1200001976a914312f0edfb1647e2f9ddbc6a0faacf3c3c8d1d21588ac00000000",["e8c40423f1291090ace9ac3a88469cf61561ad9b0f06de877f9309b846264b9b","446dea3005104d328824ae1d93b6b26d6c18c69ed6cf3d5aa8a585eeebea534a","032c4da808bf500177768605095431ee58b2773e6397db02e93eae0db86952a4","d5e6cc3bc5dc96786f97cf42a07dff996ac4b9e572844300a0065c719d9ef186","5d7d235e26d856e1bb70ea2b669fa50b6ecf3256fc26ff0ac52d2ea2de4f5c08","2ab06ed0f757226b38213aeeaca5281d013f38259cc22ae04721ab35534d83fe","f66308601f97700e503e8cea31e8d1b57f34530054a222b4bb6f99015fd462a3"],"00000002","1b33c012","531c2247",true]}

I had set up packet capture on the outside of my firewall, and was dying to get a client.reconnect message and a connection to a rogue server followed by mining.notify messages, but I never received one. If you happen to track one down, please do share what you find here as I will be reading!

It would be great to find a miner who was keeping share logs AND actually solved a block, as then we could trace it to a wallet address, perhaps seeing how much they were able to siphon and where it might ultimately have ended up.

If you could track to to a bitcoin address, it ought to be possible for the crytpocurrency community to "blacklist" an address used by thieves. Since the transactions have a complete history in the blockchain, an exchange could reject transactions that are traceable back to an address involved in theft, fraud, etc.

Whats to stop them from creating a new wallet and transferring to new wallet ...

EDIT: I'll bet the coins have been "tumbled" multiple times and are lost by now ...

They can do that as much as they want, but all transactions can be traced back to the blacklisted address because they are all in the blockchain. Any address that is only 1 or 2 hops away could be considered "tainted" by the blacklisted address...