NXT :: descendant of Bitcoin - Updated Information - page 1955.

Passion_ltc

hero member

Activity: 714

Merit: 500

Crypti Community Manager

Quote from: Come-from-Beyond on January 01, 2014, 05:25:17 PM

Quote from: Meizirkki on January 01, 2014, 05:22:09 PM

About transparent mining.. is it possible for an attacker to see which node is going to forge the next block, and DDoS attack it down? Maybe move on to the next one and then the next one and go on so long that the transparent mining becomes useless?

It's not possible yet. Later, when we switch from 4.25 tps to 1000 tps, forging nodes will be announcing gateways for incoming transactions. Anyway, these gateways will have ddos protection, so I don't think it's a big issue.

What do you mean with 4.25 tps to 1000 tps?

smartwart

full member

Activity: 171

Merit: 100

Quote from: xyzzyx on January 01, 2014, 02:18:20 PM

Quote from: Come-from-Beyond on January 01, 2014, 02:13:59 PM

Password or this didn't happen.

One of my accounts was hacked: 2980315497189667873

Totally, absolutely, cross-my-fingers randomly generated password: boobs

Of course, I think it is hilarious he had to send in 1 NXT to spend the 1 NXT that was there. I was saving that to register the alias 2girls1cup.

Edit: all joking aside, a great article, one which opened my eyes, is How the Bible and YouTube are fueling the next frontier of password cracking at Ars Technica

(-; - you made my day - ;-)

Meizirkki

hero member

Activity: 616

Merit: 500

Quote from: Meizirkki on January 01, 2014, 05:22:09 PM

EDIT: If transparent mining reveals the node's ability to forge, there's also the incentive to bring down large holders to improve your own forging income.

how about this?

Come-from-Beyond

legendary

Activity: 2142

Merit: 1010

Newbie

Quote from: Meizirkki on January 01, 2014, 05:22:09 PM

About transparent mining.. is it possible for an attacker to see which node is going to forge the next block, and DDoS attack it down? Maybe move on to the next one and then the next one and go on so long that the transparent mining becomes useless?

It's not possible yet. Later, when we switch from 4.25 tps to 1000 tps, forging nodes will be announcing gateways for incoming transactions. Anyway, these gateways will have ddos protection, so I don't think it's a big issue.

BloodyRookie

hero member

Activity: 687

Merit: 500

Quote from: Meizirkki on January 01, 2014, 05:22:09 PM

About transparent mining.. is it possible for an attacker to see which node is going to forge the next block, and DDoS attack it down? Maybe move on to the next one and then the next one and go on so long that the transparent mining becomes useless?

Yes he can predict the node which is going to forge the next block.

Meizirkki

hero member

Activity: 616

Merit: 500

About transparent mining.. is it possible for an attacker to see which node is going to forge the next block, and DDoS attack it down? Maybe move on to the next one and then the next one and go on so long that the transparent mining becomes useless?

EDIT: If transparent mining reveals the node's ability to forge, there's also the incentive to bring down large holders to improve your own forging income.

Come-from-Beyond

legendary

Activity: 2142

Merit: 1010

Newbie

Quote from: marcus03 on January 01, 2014, 05:14:49 PM

Quote from: opticalcarrier on January 01, 2014, 03:57:20 PM

Maybe the announcement for new client releases can be in this thread with the sha256 checksum and a link to those 3 downloads, then someone at admin/forums/www can then update the sites with the sha256 info?

What about putting the sha256 checksum into the block chain? The NXT software could then update itself.

It's already on the blockchain. Jean-Luc updates alias that contains version and checksum. I don't remember its name though.

marcus03

full member

Activity: 224

Merit: 100

Quote from: opticalcarrier on January 01, 2014, 03:57:20 PM

Maybe the announcement for new client releases can be in this thread with the sha256 checksum and a link to those 3 downloads, then someone at admin/forums/www can then update the sites with the sha256 info?

What about putting the sha256 checksum into the block chain? The NXT software could then update itself.

laowai80

member

Activity: 98

Merit: 10

Quote from: Come-from-Beyond on January 01, 2014, 05:02:13 PM

96.236.149.74 leeched more than 18 GiB of data... Anyone sees this zombie in their active peers? What r the numbers?

nope, apparently your bandwidth tastes the best to that zombie )

Come-from-Beyond

legendary

Activity: 2142

Merit: 1010

Newbie

96.236.149.74 leeched more than 18 GiB of data... Anyone sees this zombie in their active peers? What r the numbers?

Passion_ltc

hero member

Activity: 714

Merit: 500

Crypti Community Manager

https://nextcoin.org/index.php/topic,1959.0.html

Please say what service you want to see!

laowai80

member

Activity: 98

Merit: 10

Quote from: S3MKi on January 01, 2014, 04:51:32 PM

Hack account spoils nxt's release Angry

No, it doesn't.
There'll be many more theft cases, just like in bitcoin, just like in banks, just like in anything in life.
Human factor is usually the weakest link in any best designed system, and is accountable for 90-ish% of all crime cases.

S3MKi

legendary

Activity: 1540

Merit: 1016

Quote from: ?? on ??

Quote from: S3MKi on January 01, 2014, 04:51:32 PM

Hack account spoils nxt's release Angry

NOT in my eyes! Wink

what about new investors?

swartzfeger

full member

Activity: 350

Merit: 100

Quote from: bitcoinpaul on January 01, 2014, 04:35:35 PM

Quote from: bitcoinpaul on January 01, 2014, 03:21:43 PM

Quote from: utopianfuture on January 01, 2014, 02:46:13 PM

Quote from: Come-from-Beyond on January 01, 2014, 02:43:09 PM

I've got PaulyC's password. It's uncrackable and matches the account. If he is not trolling then we have 4 explanations:

- Someone cracked SHA256 and Curve25519 (why then multi-million accounts not hacked?)
- Someone distributes modified NRS (someone should decompile PaulyC's software)
- Keylogger
- He used online node that records entered passphrases

While I may give PaulyC the benefit of doubt, it can't be ruled out that it is a legit transaction authorized by PaulyC himself.

What about this?

Nobody?

I don't understand why more isn't being made of this. Sorry, that came off wrong... it's the new year, we're all busy, etc.

I grok 1% of the technicals of NXT. And no distrust intended for PaulyC, but Occam's Razer tells me "PaulyC- xfer-->new account".

What's stopping me from coming in here crying "all 7091 of my NXT have been **HACKED**! Here's the address it went to." We have no way of knowing if I have the passphrase for the second account. Right?

edit: am I missing part of the story/salient data here?

S3MKi

legendary

Activity: 1540

Merit: 1016

Hack account spoils nxt's release Angry

NxtChg

hero member

Activity: 840

Merit: 1002

Simcoin Developer

Also, some detailed logging should probably be implemented, precisely to quickly check this sort of thing.

User says money stolen - ask to send his log.

Come-from-Beyond

legendary

Activity: 2142

Merit: 1010

Newbie

Quote from: NxtChg on January 01, 2014, 04:42:39 PM

Quote from: Jean-Luc on January 01, 2014, 04:35:09 PM

Yes. But PaulyC was not running a big account with a well-known and hallmarked IP, right?

As I understand, this applies to all machines, not only big, hallmarked nodes, right?

And since exploits usually depend on a particular environment, they might not work in all cases.

So some bot scans the network and tries this exploit on every machine it can find.
In some particular combination of OS/soft it works. Boom, money stolen.

Let's just ask PaulyC if his computer was accessible from the Internet (no NAT, ports r open). PaulyC?

NxtChg

hero member

Activity: 840

Merit: 1002

Simcoin Developer

Quote from: Jean-Luc on January 01, 2014, 04:35:09 PM

Yes. But PaulyC was not running a big account with a well-known and hallmarked IP, right?

As I understand, this applies to all machines, not only big, hallmarked nodes, right?

And since exploits usually depend on a particular environment, they might not work in all cases.

So some bot scans the network and tries this exploit on every machine it can find.
In some particular combination of OS/soft it works. Boom, money stolen.

bitcoinpaul

hero member

Activity: 910

Merit: 1000

Quote from: bitcoinpaul on January 01, 2014, 03:21:43 PM

Quote from: utopianfuture on January 01, 2014, 02:46:13 PM

Quote from: Come-from-Beyond on January 01, 2014, 02:43:09 PM

I've got PaulyC's password. It's uncrackable and matches the account. If he is not trolling then we have 4 explanations:

- Someone cracked SHA256 and Curve25519 (why then multi-million accounts not hacked?)
- Someone distributes modified NRS (someone should decompile PaulyC's software)
- Keylogger
- He used online node that records entered passphrases

While I may give PaulyC the benefit of doubt, it can't be ruled out that it is a legit transaction authorized by PaulyC himself.

What about this?

Nobody?

Jean-Luc

sr. member

Activity: 392

Merit: 250

Quote from: NxtChg on January 01, 2014, 04:25:02 PM

Quote from: Jean-Luc on January 01, 2014, 04:06:05 PM

The server (the java process) stores the user secret phrase for as long as your account is unlocked. But there is no API request that you can make to force it to use that phrase for sending money, unless you also send the secret phrase in the request again.

That's what I thought. So if there is a bug or an exploit it is quite possible that the client can be instructed to send money. Not via API, but via some exploitable hole.

And again, since it's open to the world and its IP is well known, this is scary.

So to be sure a big account has to be locked most of the time, but this means it won't generate any blocks and won't get any fees, correct?

Yes. But PaulyC was not running a big account with a well-known and hallmarked IP, right?

We should focus on finding out how his account was hacked. It is not likely to be a remote exploitable hole exactly because it was not a big public node. I mine on a machine with a public IP that is on almost all the time with an account of a few million, why wasn't I attacked? I just don't think it is a remote exploit at work here. More likely something in his browser or computer. A javascript cross-site scripting exploit? Was he browsing any other sites at the moment, possibly Nxt - related?

Topic: NXT :: descendant of Bitcoin - Updated Information - page 1955. (Read 2761645 times)