Topic: RarityCheck VIBGYOR gilded #12 swept yesterday. - page 6. (Read 4059 times)

I went ahead and removed my negative trust, because I feel bad for you, and you have had to pay dearly for this mistake.  But this sentence right here proves you should never, ever make any private keys for anyone ever again.  Full stop.  You don't need a "team" to generate keys, that's the first fuck up.  If it wasn't the well known malware you used, it would have been someone in this "team" to save the keys for later.  There was so much wrong with how you went about this, that to think you can salvage your brand and make more products is astounding.   

Let this thread be an example for anyone who wants to make their own coins.  Don't.  There is zero margin for error in this business.  And without calling out this level of incompetency, we are only encouraging others to follow in your footsteps. 

Google Chrome.

My guess the hardware was not actually airgrapped.

But out of curiosity :

Which browser have you used ?

I had a quick look at securerandom.js (I did not inspect it throughly) :

It relies on the Web Crypto API (which is supported in all modern versions of browser), but if it is not supported it will fallback to Math.random() and/or ArcFour.
Both are not cryptographically secure - it is non-cryptographic pseudo-random number generator (PRNG). I believe there is even a comment in the code about PRNG.

The first and last images are of rarity check coins, the first from one of the lost series. The last from VIBGYOR.

The second and third images are of a key I generated.


Here is the one that best represents what I am referencing as appearing to have the ink bleeding.



and before you can say it is because it is being zoomed in so much. here is a key I made almost 2 years ago with 2 pt sized font - first image is showing how small it is and the second image is me zooming in on the same. It has no ink bleeding.




and here is a key from VIBGYOR that I would not say is "crystal clear"




update images replaced.

Based on a discussion I had with the team separately earlier today, they opened the website on the computer, before removing the internet connection and generating the keys.

It does not appear that the tool was built from source.

Unfortunately, that does make it extremely hard to validate anything more - even with a date range to work with, past investigations into walletgenerator knock-offs and scams have shown some degree of sophistication in serving "Good" generators to some IPs, and bad seeds to others. Without the original page used by the team to generate the keys being saved and available, it isn't really possible to look futher.

Presumably, the backdoor took the same form as the one described in the previously linked reports in this thread - the page was seeded with bad random data which was saved by the attackers, and they've simply been biding their time for a few years before sweeping to let the pot grow. This matches the on-chain evidence as well.

First of all, we are not judging you here. We are not asking questions to understand if you made a small or a big mistake, to convict/"crucify" you later on.

We are all making mistakes. Being here answering questions & trying to find solutions is really appreciated.

What is important here, is that we need to understand exactly how this leak happened.  

Was it a mistake by your side (ie you used a compromised key gen and mistakenly the airgap computer was connected to the internet and the generated key pairs were leaked) OR you actually use the key gen in a proper way -airgap computer, compiled the key gen from github source code in you airgap computer etc. etc.- and still the priv keys were leaked? If it was the first case, then fair enough. However, if it is the second case, we REALLY need to know all the details to protect others from creating compromised key pairs.

I am not technical enough (there are many highly technical individuals here, hence please correct me if I am wrong), however the only way I can think of -in the second case- that the priv keys could be leaked from an airgap computer, is if the entropy used for generating the key pair was not random. Hence, if someone knows the exact entropy used, they could probably generate the same key pairs.

My question here is: Did you compile the key gen (on the air gaped computer) from the github source code OR you used a pre-compiled file (from the github or eleswere). If the second, could you please indicate what exactly you used?

Again, we are not asking questions to turn the answers against you. Since (as you are saying too) this has probably affected many others - even outside of the collectibles community-  we just want to protect others from falling into the same mistake. And in order to protect them, we need to work out exactly how the priv keys were leaked. (and your collaboration on that would be of crucial importance)

Lastly (and here my above quotes apply) if I understand this correctly the term "airgap" refers to hardware never connected to the internet. Hence if you connected the hardware to the internet (even for 1 second) then the term "airgap" might not still apply.

I am just trying to help here, no negativity whatsoever

Removed my negative for now, but I cannot wrap my head around why you would use some online wallet generator? Even if the source code wasn't compromised (which it must have been, otherwise, how are we here), why would you ever choose that over actual (airgappable) wallets.

This website is known to steal Bitcoins for almost as long as I can remember! That's not just a rookie mistake, it's plain negligence. A simple forum search would have brought you to Disclosure: Key generation vulnerability found on WalletGenerator.net (in 2019). Using compromised software offline doesn't make it safe.

That can only mean you didn't even search for it, otherwise you'd have found many warnings signs.

There's another paper wallet website that turned into stealing Bitcoins after the site was sold, and even offline it produces compromised keys. See this post. There's no need to use potentially compromised software, there's more than enough legit software out there.

---

---

I'm not into collectibles (for privacy, and for "verify, don't trust"), but as far as I know the value of collectibles comes from scarcity, and age. Buyers pay more than just the Bitcoin value when they buy them, which means refunding just the Bitcoin amount is less than the damage done when it got compromised. Even replacing it with a new one removes the "age" of the coin, so doesn't fully fix the value. And that's even ignoring the fact that being compromised even once makes all future coins lose their credibility.

---

---

In my country, we have these sayings:

• Trust comes on foot and goes on horseback
• A donkey doesn't hit the same stone twice

---

---

This post is my Reference link for neutral feedback.

Hi Raghav

We know you are trying to help and we will answer your questions.
But please note that most of the team are software engineers in their day job and the only mistake in this whole process is that we truly blindly trusted a compromised software.

We think the wallet generator either has a back door or someone has done an RNG attack

How we created the keys were we connected the computer via lab cable to the internet to download the client side side site from walletgenerator and the disconnected the cable
No hardware (printer) was connected to wifi.

All hardware is wiped (windows uninstalled and hard disk  wiped) after usage.

About dates that is the main reason why we took sometime. After i reached home after my day job I started looking at my personal device to check historically  when was the first time i was researching on key gen software and looking at all sales thread and when exactly it could be that we created the keys.
But unfortunately as we have no back up of any kind it is impossible to tel exactly. But we feel it might be between July and November  2022.  

This would be nice, and I look forward to seeing some nice designs 

Thanks!

Yes this is correct.
Unfortunately, we decided to sill change and hence this mishap.

I will share the pics tomorrow, I am in bed just on my phone so not on PC with the pictures.

Thank you for sharing the software. However, this does raise more questions, and it would be very helpful to have as many answers as possible.

1. Were the keys generated using the code from this specific GitHub repository on an offline computer (i.e. are you certain it was this repo and not a fork/similar looking clone?)
2. If the repo wasn't directly used and you used the website instead, are you certain it was "walletgenerator.net"? .org has been known to be a phishing site for a long time, and .net presently redirects to .com
3. Are you able to provide the exact date (or narrowest date range) when the generation was done? In the event that there is a malicious site or repo, knowing the exact time frame will assist in scouring sources such as archive.org to find more details
4. You mentioned previously that you still had the original hardware used - I would suggest quarantining it and not using it any further. On that hardware, do you still have a copy of the source code used/website listed in the browser history?

For anyone to look into this in more detail, it is imperative that we have as much information as possilbe.

Not clear and not bleeding are different things.
All VIBGYOR coins are readable . And if someone peels their coin and cannot make the key please message us we will help.


We used waterdrop waterproof paper. How can the ink be leaking ?
We are asking so we make sure this doesn’t happen again.

not spreading lies - I have shown the keys to multiple people - Polymerbit and Minerjones - both agreed they ink was bleeding.

and if they were crystal clear multiple people would not have had issues and needed help. one pk had 2 "Q" and they were not even the same size - one appeared to be either a different font or a different size if the same font.

Apologies. Just to clarify we were  saying that we were  trying different software and we only remember why we changed the software was because we were trying vanity address generation and toward the end abandon the vanity generation and in the whole process (for god knows what reason) we needed up using walletgenerator.
We really regret making the switch.
But that was the whole reason why we went away from bitaddress in the first place.

I have seen several VIBGYOR pk's that were NOT clear.

VIBGYOR coins are also crystal clear. For hole coins sometimes there can be slight doubt between 3 and J.
But we are here to help and we will try our best to help others.

We are not hiding anything.
We are sorry if something doesn’t make sense. When we were creating keys for VIBGYOR we were (don’t remember what other soft gen) but we were looking to generate 1O (1Orange) for the first coins in the series. That’s all we remember the real reason For change of key gen solution.
And moved from bitaddess to walletgenerator. That’s what we meant that we unluckily changed software.
We took. Sometime because it was 1 am last night until we were responding to messages.
 Then we woke and went to work(day job)  Then we came back and checked as much history as possible and we researched as much as possible and researched only to realized that walletgenerator is compromised.

But we are not hiding anything.

We didn’t answer because weren’t sure how this happened but as soon as possible we had time we responded.

Seavodin you have bough few coins from
Is, what does your heart say? Did we really do something intentionally ?
What does your interactions with us say? Will we hide somehting or makeup somehting ?
Do you not think we are always helpful and caring as much as possible
We are humans and yes a mistake is made for VIBGYOR series.

This is not true. During the printing itself it looks some hole coins might have not properly printed paper but we have used waterdrop water proof paper and the ink does NOT bleed. Please don’t spread lies.