[ANN][XCP] Counterparty - Pioneering Peer-to-Peer Finance - Official Thread - page 293.

baddw

hero member

Activity: 700

Merit: 500

Quote from: ddink7 on April 23, 2014, 11:27:18 PM

Quote from: Anotheranonlol on April 23, 2014, 07:08:49 PM

Quote from: porqupine on April 23, 2014, 06:27:17 PM

Is it just my version or did everyone's say Beta on the top too?
I don't think there even needed to be a reimbursement.

despite that, the positive PR from a swift refund would be worth more than 7BTC to counterparty as a whole

Quote from: Matt Y on April 23, 2014, 05:10:24 PM

http://www.reddit.com/r/CryptoCurrency/comments/23szud/issue_smart_property_with_counterparty/

/x/post to /r/bitcoinmarkets might be good too

Where does the 7 BTC figure come from? I know that I had just over 12.5 BTC stolen from my account alone.

I'll concede that while Counterparty itself is in beta mode, this bug allowed others to discover private keys to bitcoin addresses, and empty those accounts of bitcoins as well, not just of XCP. In fact, I was actually using Counterwallet to sell my last XCP. How could I have reasonably expected that a Counterparty-related bug would result in the loss of $6,000 worth of a totally different currency (bitcoin)? Nor did I have any reason to follow the Counterparty thread, including announcement of the security breach, because I no longer owned any XCP. Why would I follow the "news" of a crypto I no longer have holdings of?

I think reimbursement for lost funds--lost due to a flaw in the counterwallet software--is vital. It would be one thing if the loss was merely XCP--a "beta" level cryptocurrency--but losing BTC is a whole different ballgame. Additionally, what do you all think would happen to Counterparty if the Bitcoin devs decided it was a risk to the main blockchain (the BITCOIN blockchain)? Sure, it's tolerated and even accepted now--but only so long as it doesn't interfere with the integrity and performance of its "host."

Still waiting to hear on my reimbursement request from devs. Will keep everyone updated.

Personally, I'm wondering why anybody would transfer that much BTC to a Counterparty wallet address. Sure, the Counterparty wallet can handle BTC, but standalone Bitcoin clients are generally going to be safer than anything still under active development. Transfer enough BTC to pay the transaction fees to send your XCP, but 12BTC is surely overkill for all but the most active Counterparty users. JMHO.

@devs: If it's not already instituted, it probably wouldn't be a bad idea to have a warning not to import much BTC (say more than 0.5BTC?) into the XCP wallet. Users can always replenish with more later, if necessary. Maybe even a hard limit in the Counterparty web wallet that won't allow people to sweep more than 0.5BTC at a time. For the time being, at least.... it seems like a better idea than paying out of pocket to reimburse people every time a new flaw is discovered.

cityglut

full member

Activity: 216

Merit: 100

Quote from: ddink7 on April 23, 2014, 11:27:18 PM

Quote from: Anotheranonlol on April 23, 2014, 07:08:49 PM

Quote from: porqupine on April 23, 2014, 06:27:17 PM

Is it just my version or did everyone's say Beta on the top too?
I don't think there even needed to be a reimbursement.

despite that, the positive PR from a swift refund would be worth more than 7BTC to counterparty as a whole

Quote from: Matt Y on April 23, 2014, 05:10:24 PM

http://www.reddit.com/r/CryptoCurrency/comments/23szud/issue_smart_property_with_counterparty/

/x/post to /r/bitcoinmarkets might be good too

Where does the 7 BTC figure come from? I know that I had just over 12.5 BTC stolen from my account alone.

I'll concede that while Counterparty itself is in beta mode, this bug allowed others to discover private keys to bitcoin addresses, and empty those accounts of bitcoins as well, not just of XCP. In fact, I was actually using Counterwallet to sell my last XCP. How could I have reasonably expected that a Counterparty-related bug would result in the loss of $6,000 worth of a totally different currency (bitcoin)? Nor did I have any reason to follow the Counterparty thread, including announcement of the security breach, because I no longer owned any XCP. Why would I follow the "news" of a crypto I no longer have holdings of?

I think reimbursement for lost funds--lost due to a flaw in the counterwallet software--is vital. It would be one thing if the loss was merely XCP--a "beta" level cryptocurrency--but losing BTC is a whole different ballgame. Additionally, what do you all think would happen to Counterparty if the Bitcoin devs decided it was a risk to the main blockchain (the BITCOIN blockchain)? Sure, it's tolerated and even accepted now--but only so long as it doesn't interfere with the integrity and performance of its "host."

Still waiting to hear on my reimbursement request from devs. Will keep everyone updated.

The delay in sending the funds is due to the fact that we are trying to be quite sure of our accounting, as we want to make sure we don't send funds to the affected addresses. We appreciate your patience.

romerun

legendary

Activity: 1078

Merit: 1002

Bitcoin is new, makes sense to hodl.

Quote from: ddink7 on April 23, 2014, 11:27:18 PM

Where does the 7 BTC figure come from? I know that I had just over 12.5 BTC stolen from my account alone.

It came from this tx https://blockchain.info/tx/474cce51a9c4b265d4da0257acb21a554563fd41200970996e2b8914dc6f1d68

ddink7

legendary

Activity: 1120

Merit: 1000

Quote from: Anotheranonlol on April 23, 2014, 07:08:49 PM

Quote from: porqupine on April 23, 2014, 06:27:17 PM

Is it just my version or did everyone's say Beta on the top too?
I don't think there even needed to be a reimbursement.

despite that, the positive PR from a swift refund would be worth more than 7BTC to counterparty as a whole

Quote from: Matt Y on April 23, 2014, 05:10:24 PM

http://www.reddit.com/r/CryptoCurrency/comments/23szud/issue_smart_property_with_counterparty/

/x/post to /r/bitcoinmarkets might be good too

Where does the 7 BTC figure come from? I know that I had just over 12.5 BTC stolen from my account alone.

I'll concede that while Counterparty itself is in beta mode, this bug allowed others to discover private keys to bitcoin addresses, and empty those accounts of bitcoins as well, not just of XCP. In fact, I was actually using Counterwallet to sell my last XCP. How could I have reasonably expected that a Counterparty-related bug would result in the loss of $6,000 worth of a totally different currency (bitcoin)? Nor did I have any reason to follow the Counterparty thread, including announcement of the security breach, because I no longer owned any XCP. Why would I follow the "news" of a crypto I no longer have holdings of?

I think reimbursement for lost funds--lost due to a flaw in the counterwallet software--is vital. It would be one thing if the loss was merely XCP--a "beta" level cryptocurrency--but losing BTC is a whole different ballgame. Additionally, what do you all think would happen to Counterparty if the Bitcoin devs decided it was a risk to the main blockchain (the BITCOIN blockchain)? Sure, it's tolerated and even accepted now--but only so long as it doesn't interfere with the integrity and performance of its "host."

Still waiting to hear on my reimbursement request from devs. Will keep everyone updated.

Matt Y

hero member

Activity: 647

Merit: 510

Counterpartying

Sending 20 XCP to help with reimbursement.

frozen123

member

Activity: 74

Merit: 10

Agree with the reimbursement plan .

The Counterparty team shows the great responsibility.

I represent coingifts sent a donation (30XCP) to the Counterparty Team.

Chang Hum

hero member

Activity: 714

Merit: 502

Quote from: Anotheranonlol on April 23, 2014, 08:35:28 PM

Quote from: Chang Hum on April 23, 2014, 07:57:03 PM

When I go to the Blockscan.com page I get redirected to google! is it just me? It's weird as it's a new laptop I bought purposely to never download anything on or ever use sites with Iframe on so I don't believe it can be a virus.

Quote from: Chang Hum on April 23, 2014, 08:24:05 PM

Thanks for reply, yes it's windows 8 I think it's got to be from an exploit I'm really careful about what I download and will even only watch youtube. I've been looking at every site relating to mastercoin (but haven't clicked on a single executable from any of their stuff) and counterwallet + blockscan that's about it.

maybe mastercoin foundation hackers managed to compromise counterparty mainframe by uploading malicous file: mastercoin-wallet-preview.jpg.exe. once first stage was complete and they breached the firewall defense system they whipped up a quick visual basic gui to gain a list of targets (counterparty supporters) which they are now selectively redirecting to google as a subtle yet genius form of pyschological warfare

alright, alright get your point lol

Have been extremely careful with this computer in the 6 weeks I've had it so can't understand how I've got a virus unless its an exploit from a site.

Anotheranonlol

hero member

Activity: 588

Merit: 504

Quote from: Chang Hum on April 23, 2014, 07:57:03 PM

When I go to the Blockscan.com page I get redirected to google! is it just me? It's weird as it's a new laptop I bought purposely to never download anything on or ever use sites with Iframe on so I don't believe it can be a virus.

Quote from: Chang Hum on April 23, 2014, 08:24:05 PM

Thanks for reply, yes it's windows 8 I think it's got to be from an exploit I'm really careful about what I download and will even only watch youtube. I've been looking at every site relating to mastercoin (but haven't clicked on a single executable from any of their stuff) and counterwallet + blockscan that's about it.

maybe mastercoin foundation hackers managed to compromise counterparty mainframe by uploading malicous file: mastercoin-wallet-preview.jpg.exe. once first stage was complete and they breached the firewall defense system they whipped up a quick visual basic gui to gain a list of targets (counterparty supporters) which they are now selectively redirecting to google as a subtle yet genius form of pyschological warfare

Chang Hum

hero member

Activity: 714

Merit: 502

Thanks for reply, yes it's windows 8 I think it's got to be from an exploit I'm really careful about what I download and will even only watch youtube. I've been looking at every site relating to mastercoin (but haven't clicked on a single executable from any of their stuff) and counterwallet + blockscan that's about it.

Porqupine are you on the list I'm wondering if its related that's all? also if anyone else on the list could say if they're having this issue.

Quote from: porqupine on April 23, 2014, 08:09:26 PM

It's definitely unique to you - there are viruses that will redirect your browser though why they would work in such an obvious fashion is beyond me, are you using windows?

porqupine

full member

Activity: 214

Merit: 101

It's definitely unique to you - there are viruses that will redirect your browser though why they would work in such an obvious fashion is beyond me, are you using windows?

Chang Hum

hero member

Activity: 714

Merit: 502

When I go to the Blockscan.com page I get redirected to google! is it just me? It's weird as it's a new laptop I bought purposely to never download anything on or ever use sites with Iframe on so I don't believe it can be a virus.

udecker

full member

Activity: 142

Merit: 252

Quote from: BitcoinTangibleTrust on April 23, 2014, 02:36:26 PM

Quote from: mtbitcoin on April 23, 2014, 02:37:00 AM

To Xnova, PP and Cityglut:

I think this is big, for the core counterparty founders to come out of the dark. My thoughts are given the current environment, for a platform like counterparty to be taken seriously by the "business" community the need to put a face(s) behind the project is essential. Now that the core founders can come out openly and talk about the project, there is an increased accountability and the potential for more exposure (i.e via talk, interviews, conferences, etc)

May I be the first to say, thank you Robby, Adam and Evan (of the counterparty founders)

Cheers

Yes. Thank you Counterparty Team and best wishes for continued growth and success. Inside Bitcoins HK looks like an excellent opportunity!

These guys are extremely talented, and have built some impressive technology. Glad y’all came out, and we wish you all the best!

Craig

Anotheranonlol

hero member

Activity: 588

Merit: 504

Quote from: porqupine on April 23, 2014, 06:27:17 PM

Is it just my version or did everyone's say Beta on the top too?
I don't think there even needed to be a reimbursement.

despite that, the positive PR from a swift refund would be worth more than 7BTC to counterparty as a whole

Quote from: Matt Y on April 23, 2014, 05:10:24 PM

http://www.reddit.com/r/CryptoCurrency/comments/23szud/issue_smart_property_with_counterparty/

/x/post to /r/bitcoinmarkets might be good too

porqupine

full member

Activity: 214

Merit: 101

Is it just my version or did everyone's say Beta on the top too?
I don't think there even needed to be a reimbursement.

prophetx

legendary

Activity: 1666

Merit: 1010

he who has the gold makes the rules

fyi new coin ranking site

http://www.coingecko.com/

matt looks like you need to start bringing up those social metrics

Matt Y

hero member

Activity: 647

Merit: 510

Counterpartying

http://www.reddit.com/r/CryptoCurrency/comments/23szud/issue_smart_property_with_counterparty/

PhantomPhreak

sr. member

Activity: 476

Merit: 300

Counterparty Chief Scientist and Co-Founder

Quote from: Chang Hum on April 23, 2014, 03:41:17 PM

Yeah publish a donation address, 1 bitcoin might be a lot to me or I might wing most of it! let's see how today go's! Huh

Quote from: freedomfighter on April 23, 2014, 02:57:06 PM

Quote from: PhantomPhreak on April 23, 2014, 11:21:50 AM

Quote from: xnova on April 23, 2014, 08:11:50 AM

4/23 - URGENT SECURITY NOTICE

With our focus on maximizing the security of Counterwallet, we now have two experts (a bitcoinjslib expert, and a web application security expert) in the process of reviewing the codebase.

What Happened
Due in part to this process, we have been notified of a security bug in bitcoinjs-lib (the bitcoin javascript library counterwallet uses) that was internally disclosed to us by the bitcoinjs-lib team yesterday evening. We worked with them on applying a fix, which was made live late last night and this security notice was drafted pending confirmation from the team. However it appears the bug has already been exploited in the wild to take BTC.

A list of these addresses is available here: https://blockchain.info/tx/474cce51a9c4b265d4da0257acb21a554563fd41200970996e2b8914dc6f1d68
(if you were a counterwallet user that was affected whose address is NOT on this list, please email [email protected] let us know)

Who is affected?
This bug affected The new counterwallet.co wallet (the old.counterwallet.co seems to be unaffected, and counterpartyd users / BootleXCP users are NOT affected). Also, the bug only affects addresses that have made two or more transactions from a given address, and then, will only affect that address. At this point, it appears only BTC was taken with a subset of counterwallet users.

What do I do?

To be safe, we are wanting ALL users with a wallet created on counterwallet.co to immediately go through the following procedure:

1. Log into your existing wallet account
2. Retrieve any copy down the private key for each address in your wallet (for each address, click on Address Actions, then Show Private Key, and copy that down)
3. Log out of the site, and then click Create New Wallet, and then log in with that new passphrase
4. Utilize the Import Funds feature to move the assets over.Here you

Alternatively (if having problems with sweep), one can create the new wallet, then log into the old wallet and manually send the funds over. Please send over ALL funds, including XCP and other Counterparty assets.

I lost BTC. Can I get it back?
~~The Counterparty team is preparing a reimbursement program for people impacted by this bug. More details will be posted shortly.~~

EDIT: After creating your new wallet and transferring the funds over, send an email to [email protected] including:

a new address to which to send the reimbursed BTC funds
the passphrase of the compromised wallet (i.e. the one with the address from which the funds were stolen). Please only send this passphrase after you have moved all of the funds out of this wallet. Unfortunately, we need this passphrase to prove that you are the actual owner of the address in this situation, as signing a message from the compromised address is not enough here, as the hacker could do that, as well.
Please keep in mind that the Counterparty team will never ask for the passphrase of a wallet which holds funds

Thanks guys for working with us to get counterwallet (and bitcoinjs-lib) through this beta period. We remain committed to security of the web wallet, and will be continuing to make improvements on this front and work with our partners to do so.

Note that this bug was not a problem with the Counterparty Protocol or with counterpartyd, which were previously audited by Sergio Lerner. This was a bug that was very similar to the Android wallet one from a while back, and was with bitcoinjs-lib and Counterwallet, which (as stated above) are being audited right now.

Please publish an address for donations so that we could help out with damage recovery.

:

Donations for reimbursement due to recent bug in bitcoinjs-lib: 135FfhStvz2tuhxH8Y616GwGv2fJDE4bbC

We deeply appreciate any and all contributions to this fund. Except for what is given here, all reimbursement funds will come out of our own pockets.

Anotheranonlol

hero member

Activity: 588

Merit: 504

new IPO on counterparty, crosspost from securities section:

https://bitcointalksearch.org/topic/xcp-adeally-ipo-monday-april-28-581995

Chang Hum

hero member

Activity: 714

Merit: 502

Yeah publish a donation address, 1 bitcoin might be a lot to me or I might wing most of it! let's see how today go's! Huh

dzarmush

legendary

Activity: 1806

Merit: 1001

I've got around 0.03 btc stolen. I was lucky because all my XCP was set on sale.

Not asking for recovery though, there were plenty notifications about possible danger.

Topic: [ANN][XCP] Counterparty - Pioneering Peer-to-Peer Finance - Official Thread - page 293. (Read 1276936 times)