Quote from: Nthused on December 18, 2014, 11:56:14 PM

Quote from: MystPhysX on December 18, 2014, 09:27:15 PM

Quote from: peme on December 18, 2014, 05:05:17 PM

Quote from: MystPhysX on December 18, 2014, 04:56:01 PM

Quote from: peme on December 18, 2014, 01:00:44 PM

Hi,

I need your help regarding this post:

Quote from: Nthused on December 18, 2014, 02:27:07 AM

Does MoonCoin have the same backdoor as TIPS to steal wallets even with the private key ?

I was reading a document and you can "apparently" clone other peoples wallets and even though there is a private key you can still gain access to it by making a mould....

Maybe that is what happened.

We have stolen mooncoins from 4 different wallets and are investigating in every direction. Perhaps you could explain if the post above is true and tips had the mentioned issue. If yes, what was the problem and how did the TIPS developers solve it?

Thanks a lot for any help and best regards,
peme

We have never had any reports of coins stolen in this way but I will need proper details before I can give you anything solid. What do you mean by mould?

I don't know, the user Nthused wrote that within the mooncoin thread and because I was not able to find anything about that within fedoracoin threats I just ask now.
The mooncoin wallet hasn't been updated since months and the official compiled versions still use old SSH Version. Perhaps someone was able to use the SSH Heartbleed-Bug. But this is also just an assumption. The new mooncoin wallet with actual SSH is ready for release but it is important to know if there is perhaps something else that has to be fixed.

Nope, not possible. Even if it was an RPC issue I have told users to use their own usernames and passwords. I still do not understand what you mean by "mould" though.

I read it on the old TIPS dev invisibles post here https://bitcointalk.org/index.php?action=profile;u=193414;sa=showPosts

Ah nice find.

Code:

- Attacker can execute code on the same machine as the target (eg. attacker owns a VPS on the same machine as the targets VPS)

That makes me believe it is a non-issue. But if we want to be sure we would have to merge the upstream code from Litecoin if they fixed it.