Topic: http://ecrypto.net/ is down - No surprises (Read 4690 times)

_https://www.facebook.com/smagik

Blur scammer back to life .

CURRENT CITY AND HOMETOWN

Victoria, British Columbia
Current city

Halifax, Nova Scotia (former city)
Hometown

We never forget to fuck you 

Classic hallmark of a scammer....

He claims it was only was only 11 BTC, but he also promised to pay everyone back 150% of what they lost, which he never did.

We only have his word on how much he made off with, and he lied about paying everyone back.

How much did he make off with?

Ah old Brucey boy...how could we forget... 

No, but every time a service turned out to be a scam, like hashie or mintpal lately, I remeber of this.

This was the first time i was scammed by someone.
I will Never forgive, never forget.

Bump

I don't suppose anyone's got their money back yet?

never forget

bump

you still around brucey?

we're still waiting 

How we going with the payback plan Brucey boy?

Since many scammed people do know his identity, i'm really scared that someone will threat him in real life if he don't give any feedback soon.
Of course i'll never do that, but i bet that some bad people would be glad to pay a little extra to someone to see him beaten or worst. you'll not see again you money, but it's cheaper than a legal
In italy you usually get a shoot in your knees for a thing like that.. it's not lethal, but you'll need a baton for the rest of your life.

How do you treat scammers in your countries?

We do not Forgive.
We do not Forget.

yep, we are not going to let this go forgotten..

Yep, i lost 0.5 BTC there. I have not forgot!

Bump.


I still didn't forget.

Are there more scammed people?

Any news?

http://ecrypto.net/

DOWN.

My coin still with them 

that was quick, down forever?

I emailed Bruce some Q's, answers here: https://bitcointalksearch.org/topic/m.4256049

Anyway I've send an email to him for my coins. I have nothing but hope

Yes, either that, or crying "hacked". Plausible deniability; we have no real way of proving if the site ever got hacked at all. Only his word.

Yes I am assuming the person who claimed there is no GET sanitisation injected into the sql to test his hypothesis, otherwise it would make no sense since there's literally a million ways to penetrate a server.

It is v basic php security which you'll learn in any beginner's book on php. This is why I posed OP the question, to ascertain how much of a php noob he is. Unfortunately the fact his site got hacked so damn quickly suggests in itself it was a basic security hole he left uncovered and not some sophisticated hack attempt.

LOL

There's no way to check for GET sanitation on the front end of the site that I'm aware of, as it happens on the server after it retrieves the input. An SQL query is just a string, like any data. If you're coding a website that processes financial transactions and don't know how to prevent SQL injection, then you shouldn't be coding financial websites period. I cannot express how basic knowledge that is in secure web development.

If this is what caused the hack, then I'm sorry, but I wouldn't put a single Dimecoin on Ecrypto.

Someone specifically said the GET variables were not being sanitised. I didn't check myself at the time. If that is the case then it's almost certainly how the hacker gained entrance so easily. A single un-escaped input gives the hacker complete control over the server.

He says he'll be relaunching the site with better security and paying people anything that was taken with interest. That's what he's stated, anyway.

I'm still have 243 earth coin at there, how to retrieve back ? Any help ? .

Well, we've got a response. He's told us what's supposedly happened, so all we can do is wait to see if he keeps his word. As long as this is not somehow some way to placate people, and the site will be coming back, and people will be reimbursed, then that is something. I'm willing to give anyone the benefit of the doubt, but the wall of silence has been worrying a lot of people.

The cynic in me would say that it's strange how we've now heard an update now that all his personal details have been revealed, but hey, I'm just suspicious like that. Benefit of the doubt. Everybody should get it at least once.


I believe I mentioned SQL injection as a possibility in the original thread on ecrypto. It's basic security 101 for SQL and user input though.

Thanks for the update. The old posting pof dating profile trick usually works   Tbh it looks like you're only updating because you're realised you can't just run away from this without consequences. Why has it taken you so many days to issue *any* kind of statement?


Someone suggested you was not sanitising user input on your GET variables? Is this true? Because it would leave the doors to your database wide open for anyone to walk in via SQL injection.

UPDATE!!

Explanation for loss of service and plans for recovery and repayment.

From the day Ecrypto started operating it was under attack. Many attempts to penetrate the servers occured and attempts to hack my personal accounts were constant. Unfortunatly on the morning of December 28 the attacker was successful in gaining entry to the wallet servers. Things were operating normally when I noticed the wallet balance had gone to -11 BTC. A few minutes later the wallet servers stopped responding completly, and access to them through the command line became impossible. Digital Ocean began to investigate the problem and after some time sent this response.

Greetings,

I appreciate your patience. After loading your droplet's into a recovery environment, it appears that someone has compromised both of your droplet's, and stolen your bitcoin from the `W2` droplet. This is confirmed from the `.bash_history` file, which the attack did not effectively remove. In an attempt to cover their tracks, they attempted to wipe out your droplets filesystem with `rm -rf /`, but mistakenly left the `/root` folder, which left some of the data for the blocks you had found.

On the `W1` droplet, it is not apparent if there were any *coin's transferred, as the .bash_history folder over there was effectively wiped out prior to the `rm -rf /` on that droplet.

For your reference, both droplets remain in the recovery environment right now, and have the drives mounted. I've taken a few screenshots of the console and pulled of the transfer of your 11 bitcoin on blockchain.info to confirm the theft:
http://screencast.com/t/Ba7Mvgh6md0
http://screencast.com/t/1eKtogngnw
https://blockchain.info/address/19Xn6GPjMoj8FMLMWg77Wq7PNiFSUsZxSV

Given the nature of bitcoin, this theft is effectively irreversible. Unfortunately, even if the data of your droplet's did remain intact, the theft would remain irreversible.

I would certainly be quite suspicious of this compromise, as if these bitcoin were just transferred last night, it would seem someone associated with you, or the other party, is well aware of your two mining droplets, or may have had access to the droplet's prior.

Unfortunately, there is truly nothing more that we are able to do for you at this point.

Regards,
Russell Mitchell | Support Team

There is noone with access to the account information hare so clearly this was a pure hack. I made great efforts to make the servers impossible to hack, however the hacker simply walked right in and stole everything. The coins they did not steal, they deleted. Since the attack I have just been sick to my stomach. Ecrypto has taken 6 months of 16 hour days to build, and anyone suggesting this was a theft by me is a complete fool. The total stolen was only 11 BTC which is not a huge amount. If the hacker had waited, they would have been able to steal a significant amount more, but it is obviously just an impatient child. I am currently reworking the entire setup, making significant changes that will make it impossible to penetrate. The wallet servers will have NO communications with the website server at all, and gaining access to them should be impossible. The weak point will be the weak passwords that Digital Ocean automatically generates for servers, but since the wallet server will have no connection with the website, even finding the server will be nearly impossible. I will also change the location of the wallet server at least once a week, and transfer the majority of BTC and LTC in the wallets into cold storage for additional security.

So the next question is, when will you get the coins you lost back? We have backup images of the wallet balances at the time of the attack. When the site comes back up, 100% of fees collected by the site will go to pay back lost coins. Not only will you receive the coins you lost, you will receive a 50% bonus. So for every 2 coins you had at the time of the attack - you will receive 3 coins as repayment.

Unfortunatly this is the best I can do for now. I personally suffered a large loss as well which makes it impossible to repay the lost coins faster than the plan.

When will the service resume operations? I am thinking a month or so. I need to make the servers bulletproof, and that will take time. If you feel the need to rant or call me names you can email [email protected]. Reasonable emails will be responded to ASAP.

This guy wasn't too smart, was he? There's going to be a lot of angry people who want answers.

Updated
He removed his facebook face  , sure scam .
https://www.facebook.com/smagik

I will start a bounty to make him pay with his bl^^d   
 

Amazing he can get one localbitcoin just very recently yet can not update us here?

Ah well, lesson learned. I normally give people the benefit of the doubt, because most people are good people, but guys like this ruin it for the rest. Of course I used caution due to the site being new so I only lost around 1 mil lotto coins....days worth of mining then and was worth a lot more then than now but stilll...  Kinda wished once I saw the site having issues I would have pulled them if I could have.

Now every legit startup exchange is going to have a problem doing just that, starting up, due to assholes like this that burned many people and lost tons of money.

This is his plenty of fish dating profile: http://www.pof.com/viewprofile.aspx?profile_id=25769873

I learned about Bruce that he is "a walking miracle - I am a 1 in 25 million survivor." Also, "there was a time in my life when I was a star athlete and an artist"



This appears to be his localbitcoins profile: https://localbitcoins.com/accounts/profile/smagik/ Last active 1 day ago. Verified phone number.

We need to hire some killer and let him pay by his blood ,silkroad2 coming service .

If he had good intentions and was hacked he should release a statement.

  ahahahahah

I am in Canada I have no problem taking actions for people outside of Canada, PM me if you have any ideas

i wish i lived in canada...

no way to set up a legal action? I didn't lost so much money, but i would be glad to applicate to a collective action...

Anyone here living in BC, Canada able to go pay this guy a visit?



Experience
Recreation and Tourism Alumni Event Coordinator at Vancouver Island University
Professional Driver at AC Taxi
Coder at Coastal Webmasters (Self-employed)
Assistant Manager at Agape Ministry
Manager at Edmonton Restaurant Slowpitch League, Edmonton, AB
Coder at Coastal Webmasters (Self-employed)



(From Linkedin) Experience

CEO
Ecrypto
October 2013 – Present (3 months)Vancouver, Canada Area
Ecrypto is developing the worlds most advanced cryptocurrency trading platform. Ecrypto is currently in Alpha development with an expected Beta release date of December 1, 2013.
http://www.Ecrypto.net

Projects

Understanding Bitcoin
March 2013
I suspect Bitcoin is a game changer much like windows was. It is hard not to love it once you understand it. The growth of Bitcoin is unprecedented and surprisingly the percentage growth of the alternate digital currency called Litecoin has been even higher. Many millionaires have been created by this and for the rest of us, well we missed the boat - this time.

I see understanding Bitcoin as...more
HeartofGoldProject.ca(Link)



Simon Fraser University
Urban Planning Certificate, Urban Planning
2013 – 2014 (expected)
RFABC
Masters certificate, facility management
2012 – 2013
I have been doing the courses for the past year and a half. I currently need 1 course to complete my certificate, however the course has not been offered - ever. Will complete it ASAP

Ecrypto's back up!! New front login page aswell...Cant log in to my account tho..

Ok, I am seeing my Tips going to a different address:

http://fedorachain.info/tx/611a2ea5dad1cdfa90f219d876448ff2aed1208281bfa36ca22328ef8a8ef868#i9

We've looked up the person behind Ecrypto:

https://www.facebook.com/smagik

More info here:
https://bitcointalksearch.org/topic/ecryptonet-exchange-never-forget-the-scam-387786

30+ hours ago I´ve sended there 1000 EAC, traded them for 0.0024 BTC (by some strange flaw it happened 2 times in a row, so I sold 2000 EAC for 0.0047 BTC) and tried to withdraw BTC. First time I´ve clicked on the link in confirmation email it gets me to the front page of exchange site (with no message), second and any further clicks gives me "Transaction Failed 0.0047 was not sent to ....". That 0.0047 BTC was already deducted from my acc, but never hit blockchain. And as far as there is no contact form nor email adress on ecrypto site, I believe its SCAM.

I'am blind!
Where can I deposit/windraw coins on ecrypto???
I dont find/see it!

Is there a direct link like "ecrypto.net/index.php?action=history" for "Trades"?

Plz help! Thx!!!

Okay found it!!! 

https://bitcointalksearch.org/topic/m.4161431

i feel like they stole my money now... and they have no support!

 

dez... bit harsh! There are no REAL scam reports so far just speculation,  a friend has used it and it was fine - after reading the introduction they clearly have some fresh ideas and for that reason I think these guys will go far.

trade safe!

So dude thinking it was going to be a modest growth rate, did not expect to see as many people as he did. With as many wanting out of a unnamed exchange, plus carrys a few coins that are not listed there....

Really, a day old and people bitch. These are the same people who bitch when they can not drive up to the driveup window at a fast food place and not get the food handed to them right away as soon as they come to a stop.

ERROR: Can't connect to local MySQL server through socket '/var/run/mysqld/mysqld.sock' (2)

Absolute pro..

Finally i got an email confirmation using safari, but it didn't work... and now the site is again offline

 

dudes, you're not doing it right

Also with explorer, seems impossible to me to withdraw right now

not a new thing for new exchange.

for someone it was working only in internet explorer, try this

It amazes me how quickly people put faith in such a new and untested website.

i cannot withdraw my btc... the "send" button remains red and is followed by an "X". anyone have the same issue?

btw deposits and withdrawals are much faster than on craptsy 

With many people looking for an out of the unnamed site, there most likely was a huge influx of people. Being the first day I do not think that was expected. Pretty hard to judge on the first day IMO, I still would only put small sums of BTC in, but other wise, lets just do a wait and see.

I got mine back without withdrawal fee, it still loads sometimes  

Its working ok here albeit its a bit slow. Apparently he had a huge influx of new signups today so the site is experiencing a bit of downtime. There's a message on the site advises he's added extra RAM to the server to help with the load but work is ongoing.

Give it time, they're a brand new site aren't they?

New sites have bugs sometimes, especially when they don't expect to get the volume of new people signing up like they are getting lol

No wallets, poor load times, no contact info.

Poor prick couldn't even prop up his own scam