Search content
Sort by

Showing 20 of 447 results by amspir
Post
Topic
Board Bitcoin Technical Support
Re: Need analysis on possible hack
by
amspir
on 08/03/2015, 14:55:22 UTC

Have you tried to contact kidcratedigger? Might be he thought that was a donation...

I just realized because I didn't read carefully before.   Just sent off the email.   

It is now looking a lot more like a PRNG bug than a malicious hack.
Post
Topic
Board Bitcoin Technical Support
Re: Need analysis on possible hack
by
amspir
on 08/03/2015, 11:33:32 UTC
The key was "generated" on Mar 7th.
Can you sign a message with a private key of 1Bn9ReEocMG1WEW1qYjuDrdFzEFFDCq43F to be sure that you own this private key?

Seems to me that your application has bad random number generator.


Code:
amspir owns this key.

IFLrTIFGi3t8H1zVuKhr4FScU0RUgUWU26U8dpIyCT7XMXB0HmEFJt6ouyBTwpyhOz+3WcydRU7FQauHuyBxZGg=

I think it is probable that it is a weak PRNG, but it may be that the device was compromised and altered the PRNG seed in some way.

Mostly, I am wondering if the output transactions appear "suspicious", such as going to a mixer, which would imply that the other key owner targeted this address on purpose.  The address does have a public label, not set by me, on blockchain.info of "000000"
Post
Topic
Board Bitcoin Technical Support
Re: Need analysis on possible hack
by
amspir
on 08/03/2015, 11:03:19 UTC
I used an Android wallet, which I do not want to name just yet, pending the developer's response to the situation.
With the wallet, I generated the new address  1Bn9ReEocMG1WEW1qYjuDrdFzEFFDCq43F

1) when?
2) is this your site? http://kidcratedigger.weebly.com/contact--donations.html

The key was "generated" on Mar 7th.  Not my site.  None of the transactions are mine, except for the input transaction on that date for 2.57~ btc which was initiated by myself by sending coin from localbitcoins.   I have verified that I do have the private key by signing then verifying a message with that address.


Post
Topic
Board Bitcoin Technical Support
Re: Need analysis on possible hack
by
amspir
on 08/03/2015, 03:27:43 UTC
Was the wallet you used a recent release? From a new source?

The wallet has been installed on my phone for about a year through Google Play.   The version on my phone was up-to-date when I checked it after the theft.

Post
Topic
Board Bitcoin Technical Support
Re: Need analysis on possible hack
by
amspir
on 08/03/2015, 03:17:04 UTC
Actually you should mention the app so people don't happen to lose coins if its a wallet bug.

Exactly, if there is a problem it would be good to know now so we can stop other people losing there bitcoins. It is unfortunate you lost yours but we should try to stop others losing theirs aswell if possible.

It would be irresponsible to blame the wallet app publicly if the fault lies in my phone being compromised.   I am in contact with support, and would like to give them a chance to figure out the cause and make it right, if they are to blame.  So far, they are assuming malware, since they claim they don't have reports of similar problems from other users.  If they drop the ball, they will be named. 

If it is a wallet bug, it must be due to a rare condition and not widespread.
 
Post
Topic
Board Bitcoin Technical Support
Re: Need analysis on possible hack
by
amspir
on 08/03/2015, 01:24:52 UTC
Quote
The only thing that intrigues me here is this : u generated new address and it previously had activity on it, before its creation ?
that shouldnt be possible if theres not something wrong with app.

Yes, apparently that is what happened.  It was "generated" within the wallet app a few minutes before sending money to it in the previously mentioned transaction.

It was probably was using a flawed RNG when creating the address. A huge red flag should have been the fact that there was activity on an address when you created the address, the fact that funds were spent from the address 100% means that someone else controls the private keys

When I created the address, it showed no activity -- likely due to the wallet not be immediately updated with the current block chain information.

 
Post
Topic
Board Bitcoin Technical Support
Re: Need analysis on possible hack
by
amspir
on 08/03/2015, 01:17:04 UTC
Well what kind of wallet was it already?

I'm extending the courtesy of not naming the wallet, which is popular, until I can determine if it is actually the developer's fault or if my phone has compromised.
Post
Topic
Board Bitcoin Technical Support
Re: Need analysis on possible hack
by
amspir
on 08/03/2015, 01:13:46 UTC
Generate a few addresses and check if they also have previous activity or have you already done that?

I generated 4 more addresses, and none of them had previous activity.

DEVELOPERS:  When your wallets generate new addresses, you should be putting in a trap that detects if a newly generated address has previous activity, and alert you to the problem which would indicate a weak PNR.

Post
Topic
Board Bitcoin Technical Support
Re: Need analysis on possible hack
by
amspir
on 08/03/2015, 01:09:00 UTC
Where did you use the internet when you got funds or the such? If it was in a public place there is a chance someone may have been sniffing it (I think that is correct terminology ahah) and seen your address and login info there.

Through the Verizon 3G data network.
Post
Topic
Board Bitcoin Technical Support
Re: Need analysis on possible hack
by
amspir
on 08/03/2015, 01:07:25 UTC
where did u get the wallet from ? if downloaded from unreliable source, it could have been infected, and also the more probable version is that your android device
was previously backdoored from some game/app etc.

Again, never rooted.  The phone is rather limited in memory, so I'm not in the habit installing or trying out new apps.   All the apps that I've knowingly installed come direct from the Google playstore, plus a couple of already-paid-for apps through the Amazon appstore.   Other than installing the Amazon appstore's apk file, I have not installed anything on the phone that didn't come through those app stores. 

Quote
The only thing that intrigues me here is this : u generated new address and it previously had activity on it, before its creation ?
that shouldnt be possible if theres not something wrong with app.

Yes, apparently that is what happened.  It was "generated" within the wallet app a few minutes before sending money to it in the previously mentioned transaction.
Post
Topic
Board Bitcoin Technical Support
Re: Need analysis on possible hack
by
amspir
on 08/03/2015, 00:44:14 UTC
Is your phone rooted?

Nope.  It is a Verizion prepaid Samsung SCH-I200PP currently running android 4.1.2.
 
Post
Topic
Board Bitcoin Technical Support
Need analysis on possible hack
by
amspir
on 08/03/2015, 00:36:37 UTC
I just lost over 2.5 bitcoins.

I used an Android wallet, which I do not want to name just yet, pending the developer's response to the situation.

With the wallet, I generated the new address  1Bn9ReEocMG1WEW1qYjuDrdFzEFFDCq43F then sent 2.57386667 btc from localbitcoins to that address, which is txid 47b689d108a33c05405332169d3a0eb96ded33ce711fcd498ead1ba5e2b72328.   This is the only transaction that I initiated with this address.

Later, when planning to move the money to paper wallets, I discovered that this address had previous activity on it, and that most of the money was swept from that address after my transaction confirmed.  There are several transactions afterwards which sweep the remaining money out of that address.

I suspect either that this problem is due to a collision from a poor PNR, or it was a malware attack.

Anyone with insight on tracing btc transactions want to comment?
Post
Topic
Board Economics
Re: The fatal flaw of Real Bills Doctrine
by
amspir
on 18/02/2015, 08:36:49 UTC
It is then also tempting to write out loans to people who cannot pay them necessarily back (I'm not 100% sure, but I think that the risk of default goes with the security).  That's blowing bubbles in the mortgage market, and increasing indirectly the price of housing and land.

AIG, considered "too big to fail" sold them default insurance that they weren't "big enough to honor" without the fed bailing them out.  Remember, they gave themselves bonuses for pulling off that scam after 2008.

   

Post
Topic
Board Economics
Re: The fatal flaw of Real Bills Doctrine
by
amspir
on 17/02/2015, 01:51:07 UTC
In the RBD, actually, money isn't printed "just like that", but an asset is chosen to be "monetized".  Be it land, stock, gold, whatever.  If the RBD is applied honestly, it just looks like as if that asset is taken out of the economy and "destroyed"  (stored irreversibly in vaults) in a way, and REPLACED by fiat money.  It is as if the asset itself were now enforced to be "money", but that for practical purposes, we use paper instead of physically that asset.

The state could, for instance, just declare that land is legal tender.  But it isn't practical to go to the grocery and buy vegetables with 20 cm^2 of land.  So in order to make that more practical, the central bank buys up the actual land, and issues paper instead, that is "good for so much land".

This did happen in the time period leading up to 2008.   The fed kept interest rates low, to the point where they didn't pay for inflation.  Homeowners got home equity loans (converting land to government fiat demand deposits)   With all that free-to-borrow money, a bubble formed in the real-estate market, to the point where garbage loans were backed by unrealistic bubble-inflated assets.   When the whole thing collapsed, the fed ended up "printing" nearly $4 trillion USD to prop it up.





Post
Topic
Board Economics
Re: Dirty coins
by
amspir
on 17/02/2015, 01:37:29 UTC
Would you want to know if those 7000 coins were coming from the addresses that are part of the BTER heist before you made the purchase or not???

If you say you don't care, then I think you are not being a responsible member of society. You should care and you it is easy to check, so why not do it.

I spend cash money at the grocery store all the time.   Never have they asked for the source of the cash, nor my identity, for buying groceries.     

Legally in the USA, you are not required to report a cash transaction to the government unless it exceeds $10,000.

Post
Topic
Board Economics
Re: Semantics of "fiat"
by
amspir
on 15/02/2015, 00:35:22 UTC
That's right. I am also aware that the word is used nowadays to describe paper money.

Fiat paper money and bitcoin both have no value for direct use, that is probably the connection, but bitcoin is not fiat.

Then you do realize that this is an informal and highly inaccurate use of the term, and not the technical definition used by economists.

War is peace, my friend.



No, the technical definition is what I wrote above. And war is certainly not peace, why would you say that?


The technical definition of a fiat currency is a currency with no intrinsic value, is it simply declared to be money (like US Dollars after Nixon's 1971 executive order, like bitcoin)   The use of fiat to mean "evil gubmit money" is a colloquialism used by some libertarians with roots in the US Dollar transition from a commodity-backed currency to a fiat currency.

"War is Peace" is a snarky example from the novel "1984" of what happens when words are redefined to further political rhetoric.

Post
Topic
Board Economics
Re: Semantics of "fiat"
by
amspir
on 14/02/2015, 23:41:56 UTC
That's right. I am also aware that the word is used nowadays to describe paper money.

Fiat paper money and bitcoin both have no value for direct use, that is probably the connection, but bitcoin is not fiat.

Then you do realize that this is an informal and highly inaccurate use of the term, and not the technical definition used by economists.

War is peace, my friend.

Post
Topic
Board Economics
Re: Semantics of "fiat"
by
amspir
on 13/02/2015, 22:27:22 UTC
The concept is from the days of the classical gold standard.

...

So as long as no government has declared that bitcoin is the money that should be used in the land, bitcoin is not fiat.

That is an odd way to redefine fiat.   Under that definition, a commodity-backed currency becomes fiat if the government proclaims it so.

 
Post
Topic
Board Economics
Re: Semantics of "fiat"
by
amspir
on 12/02/2015, 23:20:17 UTC
Good points Amspir, I mostly agree. 

However while we are talking semantics I will point out that the idea of "intrinsic value" is inherently flawed.  There is no such thing.  Value always depends on context, it's definition is in what you can get for it from another person. 

The reason that libertarian bitcoiners like to use the word fiat as a dirty word is that they feel that taking the dollar off the gold standard was an egregious act by government.    In my opinion, it was inevitable, because at a moment of crisis, a government would always choose to steal the gold rather than let the economy crash.  There was no way they would have let dollar holders run the bank and redeem their dollars for gold.   This is a flaw of centralized banking.

Representative commodity currencies also have a flaw in that the commodity must be guarded, and eventually, the commodity ends up in the hands of the guards or is stolen.   The gold backing Liberty Dollars was stolen by the government, thus it failed as a money system.

I think bitcoin can prove itself to be a superior form of money to either a government-issued fiat currency or a representative commodity currency, since it will be immune to direct government manipulation, and immune to theft from government or otherwise, if properly handled, because it is a better form of fiat currency.

I don't think it is necessary for money to have intrinsic value for it to work.  Obviously, US dollars currently dominate the global economy, and bitcoin is slowing gaining acceptance as a means of payment.

I just find it colloquial for libertarians to continue using the term "fiat" to differentiate bitcoin from government-issued fiat, when the original use was to differentiate gold-backed dollars from fiat dollars.




Post
Topic
Board Economics
Re: Dirty coins
by
amspir
on 12/02/2015, 03:39:10 UTC
I am talking about a service for one person not everyone. I ask for someone's originating address, i type it into my dirty coin checker. I can choose to do business or not based on the results.

It's not that easy. The person can't be forced to send from a particular address. They could show you a clean address and send from a tainted address instead, and now all your coins are tainted (if you aren't careful).

There might be ways to mitigate or prevent this, but not with a simple blacklist service.

If the sender is sending from a shared walled (like an account on an exchange) it would be difficult to comply with such a request.   If I were asked for my originating address(es) before sending a payment, I would take a pass for turning the transaction into a hassle.   As bitcoin starts being adopted by the masses, I really doubt that the average non-technical bitcoin user could even figure out how to find the originating addresses about to be used in a transaction.

When case law eventually determines if bitcoin is fungible or not, in the case of "not fungible", bitcoin will likely fail as a convenient method of exchange, since it can be legally seized if it was ever used as part of criminal activity.   If the law considers bitcoin fungible, your only legal obligation will be to prove that you acquired it in good faith and not as part of some criminal activity.