BTER.com hacked| 7170 BTC stolen | DON'T KEEP YOUR MONEY ON AN EXCHANGE | - page 53.

tee-rex

hero member

Activity: 742

Merit: 526

Quote from: redsn0w on February 21, 2015, 05:14:48 AM

Quote from: tee-rex on February 20, 2015, 04:44:47 PM

Quote from: redsn0w on February 20, 2015, 04:20:09 PM

Quote from: tee-rex on February 20, 2015, 01:12:20 PM

Quote from: redsn0w on February 20, 2015, 01:05:21 PM

Quote from: tee-rex on February 20, 2015, 01:00:29 PM

It seems that "this way" your cold wallet still gets effectively "connected" (even through an intermediary) to the Internet in the end. Do I still miss something?

Sorry but I've edited my thread , check the two link and if you want more info then google "how to sign a transaction offline". If they have connected on internet their cold wallet it is obvious you cannot "name" it "cold wallet" anymore .

I guess that the only possible way to really "sign a transaction offline" and be 100% sure that the keys are not compromised would be to write down all necessary TX info manually on paper and then enter it into the client connected to the Internet by hand.

When you sign the transaction offline you have only to "broadcast" it on an "online machine". So you can transfer this "transaction" through email, or .txt on an usb, etc... It is not important how will you will transfer this signed tx, the only thing is the secure signing of the TX (offline).

Perhaps, that's what the bter staff thought (and got burned). The method of transfer cannot be considered safe or "offline" if it can be used to secretly transfer your private keys as well. This way almost all means of electronic communications (email or a .txt file on an usb) should be deemed as potentially compromising and not far in effect from directly connecting a cold wallet to the net.

For example, I've generated this TX offline and it gives me this raw transaction "code" :

Code:

0100000001

So now everyone of you can "push/broadcast" it here :

- https://insight.bitpay.com/tx/send
- https://blockchain.info/it/pushtx

So it is impossible to "stole" a private key during this process (if the cold wallet is offline) . You generate the transaction and after broadcast it on another pc (connected on internet).

Wasn't I telling you the same two posts earlier? You write down or print the transaction on paper (memorize it if you are that brutal) and then enter it into the client connected to the Internet (through a site or whatever) manually.

redsn0w

legendary

Activity: 1778

Merit: 1043

#Free market

Quote from: tee-rex on February 20, 2015, 04:44:47 PM

Quote from: redsn0w on February 20, 2015, 04:20:09 PM

Quote from: tee-rex on February 20, 2015, 01:12:20 PM

Quote from: redsn0w on February 20, 2015, 01:05:21 PM

Quote from: tee-rex on February 20, 2015, 01:00:29 PM

It seems that "this way" your cold wallet still gets effectively "connected" (even through an intermediary) to the Internet in the end. Do I still miss something?

Sorry but I've edited my thread , check the two link and if you want more info then google "how to sign a transaction offline". If they have connected on internet their cold wallet it is obvious you cannot "name" it "cold wallet" anymore .

I guess that the only possible way to really "sign a transaction offline" and be 100% sure that the keys are not compromised would be to write down all necessary TX info manually on paper and then enter it into the client connected to the Internet by hand.

When you sign the transaction offline you have only to "broadcast" it on an "online machine". So you can transfer this "transaction" through email, or .txt on an usb, etc... It is not important how will you will transfer this signed tx, the only thing is the secure signing of the TX (offline).

Perhaps, that's what the bter staff thought (and got burned). The method of transfer cannot be considered safe or "offline" if it can be used to secretly transfer your private keys as well. This way almost all means of electronic communications (email or a .txt file on an usb) should be deemed as potentially compromising and not far in effect from directly connecting a cold wallet to the net.

For example, I've generated this TX offline and it gives me this raw transaction "code" :

Code:

0100000001a4b577f54ea6b888653ce068639a76ecee0eceddafa7c35efe64853d8cc05709000000008a47304402207688102fe2466c7ddd57c843639b81adcae5699c962a4cb953cee17d50e5f3b502207ea95f78891ebd056e9e1317a823b8996f4460451f31bc2d122cb828d9c0f19c0141048eb34b798d112c5c60ae88436ae4c7b86d943dfc9178ce5cae18b02cb912531b6eb6a8978f389d73cd2d31a2d70241188c86ab3b28753d2055b3064794bcd2c6ffffffff0210270000000000001976a914b6a032713d13dc7d81e68cc1e3d78e0dc0e095e988ac80380100000000001976a91409113c8d4fd73a95e945dce5592a4d5de0ce799088ac00000000

So now everyone of you can "push/broadcast" it here :

- https://insight.bitpay.com/tx/send
- https://blockchain.info/it/pushtx

So it is impossible to "stole" a private key during this process (if the cold wallet is offline) . You generate the transaction and after broadcast it on another pc (connected on internet).

Bizmark13

sr. member

Activity: 462

Merit: 250

Quote from: blueshoe on February 20, 2015, 07:39:09 AM

But there exist no decentral exchange for altcoins. the Assetsystem with nxt or bts i find to uncomfortable. we need something like a torrentsystem. but the blockchains are to slow for trading. And i dont see why i should hold altcoins without trading ...

There are decentralized exchanges in development and I think there might be some already working, but I personally think that centralized exchanges like Bter and Cryptsy are here to stay. They're simple and user friendly, they work with no technical expertise required, and you don't have to install anything on your computer to use them. And if you don't use them as banks and you're not into day trading then they're actually not that bad security-wise. Just put your coins in, swap them for some other coins, then withdraw.

Quote from: redsn0w on February 20, 2015, 04:20:09 PM

Quote from: tee-rex on February 20, 2015, 01:12:20 PM

Quote from: redsn0w on February 20, 2015, 01:05:21 PM

Quote from: tee-rex on February 20, 2015, 01:00:29 PM

It seems that "this way" your cold wallet still gets effectively "connected" (even through an intermediary) to the Internet in the end. Do I still miss something?

Sorry but I've edited my thread , check the two link and if you want more info then google "how to sign a transaction offline". If they have connected on internet their cold wallet it is obvious you cannot "name" it "cold wallet" anymore .

I guess that the only possible way to really "sign a transaction offline" and be 100% sure that the keys are not compromised would be to write down all necessary TX info manually on paper and then enter it into the client connected to the Internet by hand.

When you sign the transaction offline you have only to "broadcast" it on an "online machine". So you can transfer this "transaction" through email, or .txt on an usb, etc... It is not important how will you will transfer this signed tx, the only thing is the secure signing of the TX (offline).

That wouldn't be a cold wallet though right? I mean, if the machine containing the cold wallet is connected to the Internet, then it's not really a cold wallet. The moment a machine is connected to the Internet, it can be infected by viruses or trojans. So that rules out email. Malware can spread via USB drives too. In fact, the Iranian nuclear program had some of their centrifuges destroyed by malware that spread via USB drives:

http://en.wikipedia.org/wiki/Stuxnet

Relevant part:

Quote

Langner speculated that the infection may have spread from USB drives belonging to Russian contractors since the Iranian targets were not accessible via the internet.

tee-rex

hero member

Activity: 742

Merit: 526

Quote from: Jcga on February 20, 2015, 09:11:21 PM

From twitter.com/btercom

"We are preparing for the withdrawals. CNY, USD and NXT withdrawals will be handled first."

Smells very fishy, mildly speaking.

As I understand it, they are "preparing for the withdrawals" of those assets over which they either can't have control or which would be worthless in the hands of a small group of people. In the case of Chinese yuan and US dollar they will inevitably inflict criminal prosecution upon themselves without a single chance of escaping if they try to cash out or transfer the money. And in the case of nxt coins, as we know from the previous hack, their price would fall next to nothing if they get accumulated in a few hands (that was the reason why the thief agreed to return the stolen nxt's).

Jcga

legendary

Activity: 2590

Merit: 1089

From twitter.com/btercom

"We are preparing for the withdrawals. CNY, USD and NXT withdrawals will be handled first."

tee-rex

hero member

Activity: 742

Merit: 526

Quote from: redsn0w on February 20, 2015, 05:04:08 PM

NEWS (an article of coindesk , 99%) : http://www.coindesk.com/bter-unable-to-repay-customers-following-alleged-exchange-heist/

"This time, reimbursement of the platform’s various cryptocurrencies, including NXT and counterparty, remains uncertain. The spokesperson simply reiterated the company's earlier Twitter announcement that withdrawals would be running "soon", after BTER's wallets are declared safe."

Reimbursement?! Did other cryptocurrencies other than bitcoin get stolen too? They definitely should have taken that spokesperson hostage.

redsn0w

legendary

Activity: 1778

Merit: 1043

#Free market

NEWS (an article of coindesk , 99%) : http://www.coindesk.com/bter-unable-to-repay-customers-following-alleged-exchange-heist/

"This time, reimbursement of the platform’s various cryptocurrencies, including NXT and counterparty, remains uncertain. The spokesperson simply reiterated the company's earlier Twitter announcement that withdrawals would be running "soon", after BTER's wallets are declared safe."

tee-rex

hero member

Activity: 742

Merit: 526

Quote from: redsn0w on February 20, 2015, 04:20:09 PM

Quote from: tee-rex on February 20, 2015, 01:12:20 PM

Quote from: redsn0w on February 20, 2015, 01:05:21 PM

Quote from: tee-rex on February 20, 2015, 01:00:29 PM

It seems that "this way" your cold wallet still gets effectively "connected" (even through an intermediary) to the Internet in the end. Do I still miss something?

Sorry but I've edited my thread , check the two link and if you want more info then google "how to sign a transaction offline". If they have connected on internet their cold wallet it is obvious you cannot "name" it "cold wallet" anymore .

I guess that the only possible way to really "sign a transaction offline" and be 100% sure that the keys are not compromised would be to write down all necessary TX info manually on paper and then enter it into the client connected to the Internet by hand.

When you sign the transaction offline you have only to "broadcast" it on an "online machine". So you can transfer this "transaction" through email, or .txt on an usb, etc... It is not important how will you will transfer this signed tx, the only thing is the secure signing of the TX (offline).

Perhaps, that's what the bter staff thought (and got burned). The method of transfer cannot be considered safe or "offline" if it can be used to secretly transfer your private keys as well. This way almost all means of electronic communications (email or a .txt file on an usb) should be deemed as potentially compromising and not far in effect from directly connecting a cold wallet to the net.

redsn0w

legendary

Activity: 1778

Merit: 1043

#Free market

Quote from: tee-rex on February 20, 2015, 01:12:20 PM

Quote from: redsn0w on February 20, 2015, 01:05:21 PM

Quote from: tee-rex on February 20, 2015, 01:00:29 PM

It seems that "this way" your cold wallet still gets effectively "connected" (even through an intermediary) to the Internet in the end. Do I still miss something?

Sorry but I've edited my thread , check the two link and if you want more info then google "how to sign a transaction offline". If they have connected on internet their cold wallet it is obvious you cannot "name" it "cold wallet" anymore .

I guess that the only possible way to really "sign a transaction offline" and be 100% sure that the keys are not compromised would be to write down all necessary TX info manually on paper and then enter it into the client connected to the Internet by hand.

When you sign the transaction offline you have only to "broadcast" it on an "online machine". So you can transfer this "transaction" through email, or .txt on an usb, etc... It is not important how will you will transfer this signed tx, the only thing is the secure signing of the TX (offline).

tee-rex

hero member

Activity: 742

Merit: 526

Quote from: redsn0w on February 20, 2015, 01:05:21 PM

Quote from: tee-rex on February 20, 2015, 01:00:29 PM

It seems that "this way" your cold wallet still gets effectively "connected" (even through an intermediary) to the Internet in the end. Do I still miss something?

Sorry but I've edited my thread , check the two link and if you want more info then google "how to sign a transaction offline". If they have connected on internet their cold wallet it is obvious you cannot "name" it "cold wallet" anymore .

I guess that the only possible way to really "sign a transaction offline" and be 100% sure that the keys are not compromised would be to write down all necessary TX info manually on paper and then enter it into the client connected to the Internet by hand.

redsn0w

legendary

Activity: 1778

Merit: 1043

#Free market

Quote from: tee-rex on February 20, 2015, 01:00:29 PM

It seems that "this way" your cold wallet still gets effectively "connected" (even through an intermediary) to the Internet in the end. Do I still miss something?

Sorry but I've edited my ~~thread~~ post , check the two link and if you want more info then google "how to sign a transaction offline". If they have connected on internet their cold wallet it is obvious you cannot "name" it "cold wallet" anymore .

tee-rex

hero member

Activity: 742

Merit: 526

Quote from: redsn0w on February 20, 2015, 12:54:37 PM

Quote from: tee-rex on February 20, 2015, 12:52:43 PM

Quote from: redsn0w on February 20, 2015, 12:45:45 PM

Quote from: stdset on February 20, 2015, 06:13:17 AM

Quote from: redsn0w on February 20, 2015, 05:50:46 AM

It is most probably the first option, the hacker didn't have the access to their hot wallet, and this is demonstrate that the cold wallet it was not a real cold wallet. I think (maybe) :

1) a bad generation of the cold wallet's addresses,
2) an error/mistake of an employee, that had connected the cold wallet to "internet",
3)An inside job.

1) I think this option is the least probable among others.
2) Just connection is unlikely to be enough. They must have had a trojan in their 'cold' wallet system. What they were using their 'cold' wallet for, to get infected??? BTW if this option is really what happened, they likely were infected between Feb 2nd and Feb 14th.
3) Must be thoroughly investigated in any cold wallet theft case.

1) it depends of what wallet they have used to generate bitcoin addresses,
2) It is called "cold wallet" and it never should be never connected on internet,
3) this is the most probable "option" but we should wait some news from them.

Their weibo/twitter profile has not yet been updated.

I don't quite understand what you mean here by "it should be never connected on internet". How on earth are you going to fill hot wallets from it if it is never to be connected to the Internet?

Simple , you create/sign the transaction offline and then you "broadcast" it on another pc (connected on internet). Do you know this "technique" ?

It seems that "this way" your cold wallet still gets effectively "connected" (even through an intermediary) to the Internet in the end, though this "connection" may not be direct in terms of time. Do I still miss something?

redsn0w

legendary

Activity: 1778

Merit: 1043

#Free market

Quote from: tee-rex on February 20, 2015, 12:52:43 PM

Quote from: redsn0w on February 20, 2015, 12:45:45 PM

Quote from: stdset on February 20, 2015, 06:13:17 AM

Quote from: redsn0w on February 20, 2015, 05:50:46 AM

It is most probably the first option, the hacker didn't have the access to their hot wallet, and this is demonstrate that the cold wallet it was not a real cold wallet. I think (maybe) :

1) a bad generation of the cold wallet's addresses,
2) an error/mistake of an employee, that had connected the cold wallet to "internet",
3)An inside job.

1) I think this option is the least probable among others.
2) Just connection is unlikely to be enough. They must have had a trojan in their 'cold' wallet system. What they were using their 'cold' wallet for, to get infected??? BTW if this option is really what happened, they likely were infected between Feb 2nd and Feb 14th.
3) Must be thoroughly investigated in any cold wallet theft case.

1) it depends of what wallet they have used to generate bitcoin addresses,
2) It is called "cold wallet" and it never should be never connected on internet,
3) this is the most probable "option" but we should wait some news from them.

Their weibo/twitter profile has not yet been updated.

I don't quite understand what you mean here by "it should be never connected on internet". How on earth are you going to fill hot wallets from it if it is never to be connected to the Internet?

Simple , you create/sign the transaction offline and then you "broadcast" it on another pc (connected on internet). Do you know this "technique" ?

Here an example with "electrum" : https://electrum.org/offline_wallets.html and here a thread : https://bitcointalksearch.org/topic/m.7306076 (with bitcoind).

tee-rex

hero member

Activity: 742

Merit: 526

Quote from: redsn0w on February 20, 2015, 12:45:45 PM

Quote from: stdset on February 20, 2015, 06:13:17 AM

Quote from: redsn0w on February 20, 2015, 05:50:46 AM

It is most probably the first option, the hacker didn't have the access to their hot wallet, and this is demonstrate that the cold wallet it was not a real cold wallet. I think (maybe) :

1) a bad generation of the cold wallet's addresses,
2) an error/mistake of an employee, that had connected the cold wallet to "internet",
3)An inside job.

1) I think this option is the least probable among others.
2) Just connection is unlikely to be enough. They must have had a trojan in their 'cold' wallet system. What they were using their 'cold' wallet for, to get infected??? BTW if this option is really what happened, they likely were infected between Feb 2nd and Feb 14th.
3) Must be thoroughly investigated in any cold wallet theft case.

1) it depends of what wallet they have used to generate bitcoin addresses,
2) It is called "cold wallet" and it never should be never connected on internet,
3) this is the most probable "option" but we should wait some news from them.

Their weibo/twitter profile has not yet been updated.

I don't quite understand what you mean here by "it should be never connected on internet". How on earth are you going to fill hot wallets from it if it is never to be connected to the Internet?

They did connect it and got forfeited, but this is quite another story.

redsn0w

legendary

Activity: 1778

Merit: 1043

#Free market

Quote from: stdset on February 20, 2015, 06:13:17 AM

Quote from: redsn0w on February 20, 2015, 05:50:46 AM

It is most probably the first option, the hacker didn't have the access to their hot wallet, and this is demonstrate that the cold wallet it was not a real cold wallet. I think (maybe) :

1) a bad generation of the cold wallet's addresses,
2) an error/mistake of an employee, that had connected the cold wallet to "internet",
3)An inside job.

1) I think this option is the least probable among others.
2) Just connection is unlikely to be enough. They must have had a trojan in their 'cold' wallet system. What they were using their 'cold' wallet for, to get infected??? BTW if this option is really what happened, they likely were infected between Feb 2nd and Feb 14th.
3) Must be thoroughly investigated in any cold wallet theft case.

1) it depends of what wallet they have used to generate bitcoin addresses,
2) It is called "cold wallet" and it never should be never connected on internet,
3) this is the most probable "option" but we should wait some news from them.

Their weibo/twitter profile has not yet been updated.

Cassius

legendary

Activity: 1764

Merit: 1031

Quote from: blueshoe on February 20, 2015, 07:39:09 AM

But there exist no decentral exchange for altcoins. the Assetsystem with nxt or bts i find to uncomfortable. we need something like a torrentsystem. but the blockchains are to slow for trading. And i dont see why i should hold altcoins without trading ...

InstantDEX, any day now. Built on top of NXT AE and Multigateway, but near-realtime. Should be in beta very soon.

blueshoe

sr. member

Activity: 277

Merit: 250

You think all too complicated. The normal case is a criminal, child abduction, a ransom note. Done. More, it does not need to make an exchange office broken. There are millions of criminals who can do that.

cazkooo

legendary

Activity: 1540

Merit: 1013

Quote from: stdset on February 20, 2015, 07:41:03 AM

Quote from: stdset on February 20, 2015, 06:48:26 AM

BTW, in order to continue using their hot wallet, they must be absolutely 100% sure it's not compromised.

What would be the case if they 'hacked' themselfs.

indeed it seems like they are hacking themselves, but lets see their next action, if they intended to refund their customer then it would be seems like they are really got hacked

stdset

hero member

Activity: 572

Merit: 506

Quote from: stdset on February 20, 2015, 06:48:26 AM

BTW, in order to continue using their hot wallet, they must be absolutely 100% sure it's not compromised.

What would be the case if they 'hacked' themselfs.

blueshoe

sr. member

Activity: 277

Merit: 250

But there exist no decentral exchange for altcoins. the Assetsystem with nxt or bts i find to uncomfortable. we need something like a torrentsystem. but the blockchains are to slow for trading. And i dont see why i should hold altcoins without trading ...

Topic: BTER.com hacked| 7170 BTC stolen | DON'T KEEP YOUR MONEY ON AN EXCHANGE | - page 53. (Read 119723 times)