18 Best Bitcoin Trading Bots (2019 User Guide)

Bitcoin, Tor and Botnets - Creating a New Market

Bitcoin, Tor and Botnets - Creating a New Market submitted by Cryptofortune to Bitcoin [link] [comments]

Bitcoin, Tor and Botnets - Creating a New Market

Bitcoin, Tor and Botnets - Creating a New Market submitted by BitcoinAllBot to BitcoinAll [link] [comments]

[More Bad Ubuntu / Open Source News] Malware Found in the Ubuntu Snat StoreThe account // [email protected] tried to create a bitcoin mining botnet out of ubuntu users

[More Bad Ubuntu / Open Source News] Malware Found in the Ubuntu Snat StoreThe account // Myfirstferrari@protonmail.com tried to create a bitcoin mining botnet out of ubuntu users submitted by 911bodysnatchers322 to TruthLeaks [link] [comments]

Creating a Bitcoin-Mining Botnet at No Cost

Creating a Bitcoin-Mining Botnet at No Cost submitted by cryptocurrencylive to CryptoCurrencyLive [link] [comments]

GSG 9 arrested two people in Germany for using a Botnet to create Bitcoins

http://www.golem.de/news/botnet-festnahmen-von-bitcoin-betruegern-in-deutschland-1312-103153.html
http://www.presseportal.de/polizeipresse/pm/7/2613588/bka-festnahmen-wegen-gewerbsmaessigen-computerbetrugs-und-sicherung-von-bitcoins-im-wert-von-700 ( More information )
Two people farmed 700.000 EUR worth Bitcoins through a botnet. GSG 9 and BKA arrested them in the night between 2.11 and 3.11..
submitted by TimJungle to Bitcoin [link] [comments]

Crypto Weekly News

What important crypto events happened last week?
Cryptocurrencies
Monero Presents New Legal Framework In Defense Of Privacy Coins
Riccardo Spagni presented the result of more than a year's work. A whitepaper titled "Anti-Money Laundering Regulation of Privacy-Enabling Cryptocurrencies" has been published. The document was conceived as a new legal framework to protect confidential coins such as Monero, Zcash, Dash, Komodo, and others.
Tether Is Moving 1 Billion More USDT Coins From TRON To Ethereum Blockchain
The total supply of coins will not change. The company carried out the swap on September 15, coordinating its actions "with a third party". In recent weeks, this is the second such stablecoin transfer between blockchains — on August 20, the issuer also moved USDT 1 billion from Tron to Ethereum. Another piece of news about Tether: USDT capitalization exceeded $15 billion, having increased by $3 billion in just a month.
Projects and Updates
Kraken Receives Licence To Establish First U.S Digital Assets Bank
The Kraken Bitcoin exchange was the first in the United States to receive the status of a special purpose depository institution (SPDI), giving it the functions of a traditional financial institution. The corresponding application of the Californian company was approved by the Wyoming Banking Council. This will allow Kraken to opt-out of third-party vendors to perform certain banking functions on its own.
Official Ethereum Proof-of-Stake Algorithm Proposal Published
Ethereum Foundation Lead Developer Danny Ryan has published the official proposal EIP-2982, which suggests the launch of Ethereum 2.0 and the transition from the Proof-of-Work consensus algorithm to Proof-of-Stake. If approved by other leading developers, it will be possible to launch Serenity, Ethereum 2.0 phase zero. Within its framework, the Beacon Chain will be activated, which will use Proof-of-Stake.
Uniswap Provides All Its Users With $1.200
Leading decentralized exchange (DEX) Uniswap has released the UNI governance token. It was listed on the Binance exchange almost immediately. About 13000 Uniswap users have already requested tokens.
Regulations
New Draft Law Suggests The European Union Is Set To Regulate Cryptocurrencies
The European Commission proposed to establish a legal framework for cryptocurrencies, security tokens, and stablecoins by analogy with the requirements for traditional financial instruments. This is stated in the Cryptocurrency Asset Markets Bill. The bill proposes to treat cryptocurrency assets like any other financial instrument. According to the European Commission, this will provide legal clarity.
Digital Assets Recognized As Securities In Nigeria
The regulator clarified that cryptocurrencies offer public alternative investment opportunities. Digital assets can be used as a medium of exchange, settlement, and accumulation. In order to protect investors from risks and not violate the integrity of the market, crypto assets must be controlled on an equal basis with securities. The main task of regulation is not to discourage the development of new technologies, but to ensure fair market competition and adherence to ethical standards.
Hacking
Japanese Crypto Exchange Sues Binance for Role in $63 Million Bitcoin Hack
The Japanese company Fisco Cryptocurrency Exchange, Inc has filed a US lawsuit against Binance Holdings Ltd., accusing it of providing a service to launder cryptocurrency stolen from the Zaif exchange in 2018. Fisco acquired Zaif in 2018 shortly after the hack. Over $9 million in stolen assets could have been funneled through Binance. The company notes that analysts were able to track the movement of all stolen $63 million to one bitcoin address. Subsequently, 1,451.7 BTC were sent from it to Binance addresses.
New Virus Attacks Microsoft SQL Database Servers For Monero Mining
Tencent's cybersecurity division has discovered a new miner virus called MrbMiner. The tactics of the virus are quite simple — the botnet scans the available IP addresses in search of Microsoft SQL servers, and if it detects such, it tries to log in under the administrator account using a brute-force password. If successful, the virus downloads the assm.exe file, which implements a reboot mechanism and creates a special account for hackers to access the server. After that, MrbMiner downloads a miner for mining the anonymous cryptocurrency Monero (XMR).
Mass adoption
Bahamas Geared to Launch Central Bank Digital Currency
The Bahamas wants to be the first country in the world to roll out a government-backed virtual currency nationwide and announced they will launch a central bank-issued cryptocurrency (CBDC) in October. The digital currency, dubbed "sand dollar", is designed to increase the financial availability of remote islands within the archipelago state.
Alibaba On Track To Be The Largest Blockchain Patent Holder By End Of 2020
Computer giant IBM risks losing the title of the largest blockchain patent holder to the Chinese corporation Alibaba. Since the beginning of the year, Alibaba has published ten times more patents than its closest competitor, IBM. According to analysts, if the pace is maintained, the Chinese corporation will become the largest patent holder by the end of the year.
France Begins Central Bank Digital Currency Testing
Société Générale — one of the largest financial conglomerates in Europe — will test the central bank digital currency (CBDC) on the Tezos blockchain. The Bank of France, as a result of the selection of partners, chose the Forge blockchain platform to test CBDC for interbank settlements. As part of the experiment, the feasibility of digitizing financial securities and the possibility of settlements on them using CBDC will be studied. In addition to Nomadic Labs, several technology service providers and consultants will participate in the testing.
Kazakhstan Will Develop A Blockchain Service For Ensuring The Security Of Personal Data
It will allow citizens of the country to control the use of their personal data. The service is planned to be introduced by the end of this year.
People
Kiss Rock Group Member Is Ready To Buy Bitcoin
Gene Simmons supported Cameron Winklevoss's request to use bank accounts to buy Bitcoin and Ether. The co-founder of Gemini tweeted that people who do not have access to banking services find it difficult to become the owners of cryptocurrency and that they need to take advantage of the benefits. The musician commented as follows: "I will. I am." For this moment, the most common opinion on Twitter is that Simmons is already buying cryptocurrency and will continue to increase the amount of Bitcoin he owns.
That’s all for now! For more details follow us on Twitter, subscribe to our YouTube channel, join our Telegram.
submitted by CoinjoyAssistant to CryptoCurrencies [link] [comments]

[RF] Just another quiet Friday night

"You're fucking crazy John," the man in the black T-Shirt announced. "Seriously, you want to pretend to be a paedo, so you can lure in the FBI and fuck with them? That is some next level warped shit."
"Chill out dude. That was just an example. Doesn't have to be a paedo."
"I don't give a fuck. Anything that's gonna make them zero-day you is some dark shit that you can't just laugh off. And what if they chain the sploits? They'll bounce out of your sandbox and be kicking the door down in minutes."
"No, no, it's ok. Really. I bought these laptops from a heroin addict in another city. Totally untraceable. I've had the lid off and de-soldered the camera, microphone and wireless."
"That's no use, we've got to get online somehow. And when their payload fires they'll trace us through a ToR bypass."
"That's why we need three laptops. Physical separation. This one," he tapped the metallic blue case, "is the bait. It's a regular laptop, but it's only connection is a single wired Ethernet. The only route to the Internet is via this one," tap tap, "which is running hardened Kali and only connects via ToR."
"Seriously, you're going to actually do this?"
"Come on dude, I've always wanted to try. Live a little."
"What's the third one for?"
"It's hardened Kali too. We proxy everything from the bait browser through here. When they deliver their exploit we'll catch it here, do some reverse engineering, and get ready for the fun bit!"
"What the hell. But you're crazy man. And we never speak of this."
"Of course. Goes without saying."
"How do we start?"
"You get a proxy running on that. I'll get the ToR connection set up. I got a 4G dongle off the same guy."
John removed a small ethernet hub from his bag, connected its power but held off from plugging in the laptops. He connected the 4G dongle, started the ToR service and watch its status update. With the connection active he configured the iptables firewall so outbound traffic was permitted only through ToR. Cal started the intercepting proxy, exposed its listener and looked at John. "Ready" They both plugged into the hub, and Cal watched as John connected the bait laptop, accessed the proxy settings and linked it to the listener.
He accessed a non-descript site to check the setup. It loaded a little slowly, while the series of requests popped up on the intercepting proxy. "Are we sure it's going through ToR?" Cal asked. "Don't worry". "Seriously, show me a packet trace." John started a sniffer, gestured to Cal to refresh the bait browser, while a series of packets scrolled up the screen, all safely encrypted by ToR.
"So what now?" a pause "And definitely no paedo stuff. That's too dark to mess about with."
"Old school," John replied, "I guess it's a bit of a cliche. We go on the dark net and try to order a murder for BitCoin. We'll make it an American prosecutor, that'll get the FBI going."
Cal stared at him. But that didn't stop him typing and Cal watched with grim fascination as he navigated around dark net markets, registering accounts, searching vendors and sending onimous enquiries. Cal monitored the proxy, configuring ever more intricate filters to weed out the mundane.
They'd crossed a line of no return and complicit Cal joined in, weaving convincing tales in their messages, striking the right tone to complete their deception. This went on for hours, with no sign of any incoming exploits. Until the browser popped up with "Do you want to allow this site to access WebGL?"
"That's it," John smiled, "there's no way that site really uses WebGL. This is an exploit. Stands to reason too, we always knews that had huge attack surface." He was about to permit it, but Cal stopped him. "No, don't allow it. If we allow it, we'll just get a lame zero day that requires WebGL. Deny it and carry on. They'll send a better exploit soon enough."
The intensity increased, Cal identified the malicious code that had tried to access WebGL. But it was just a stager - no exploit there. John carried on his ruse, until he noticed the browser stutter. He grabbed Cal's arm, "this is it!" Fear in the room intensified. This was serious now, some hacker - be it FBI or otherwise - had control of the laptop right in front of them. "Carry on with the messaging Cal. If we stop now they'll know our game."
Cal typed into the bait laptop while John began to investigate the exploit delivery. He identified the malware quickly enough, and a lingering connection that could be to the command and control server. Alarmingly, it was transferring a lot of data in both directions, a detail he decided not to share with Cal. He loaded the malware into a binary analysis tool and begun the painstaking process of unpicking its workings. 20 minutes in he told Cal to stop. "That'll do. Sign off naturally and shut it down."
Cal joined him with the binary anaysis and gradually they formed a picture of its armory. "It's not like one I've seen before," Cal said, "it's tighter coded than a typical rootkit. Really could be FBI." John nodded. "You can see it repeatedly copying this string. That's gotta be a heap spray. And it looks like self-decrypting machine code. Yeah, that's the payload for sure. We can just plug our own in here."
"What if the exploit's been watermarked?" Cal interjected, "We don't know where they could have hidden one."
"Who cares? We're gonna deliver it anonymously anyway."
They worked industriously to decouple the exploit and payload, build a delivery mechanism, and soon they were ready to test it. They watched in delight as a fully-patched browser accessed their delivery site, churned the laptop's CPU, then registered a ping back on the console.
The next step was to incorporate a real payload.
"So what's it gonna do John?"
"Persist itself to disk, then sit quietly and await further instructions. I've got the C&C software figured out already, it was a fun project from long ago. What I need you to do is use BitCoin to rent a couple of dozen virtual servers in different data centres around the world."
As Cal started registering the servers, John used the third laptop to generate a public/private key pair. One by one, the servers came online, and John installed the C&C software, configuring each to only respond to instructions signed by their private key. On the 20th he told Cal to stop.
There was a sparkle in his eyes. "We're nearly there! Everything's in place."
"How are we going to deliver it?"
"That's why we had to do this today. I found something earlier. A cache poisoning vulnerability on a major site."
Cal stared at him. The chain was complete. This was not real.
They completed their final maneouvers. Scripted a mechanism to dynamically generate payloads containing a random sample of C&C servers. Uploaded the exploit delivery mechanism into the control cloud, and generated a list of exploit URLs. John accessed the vulnerable major site, saved the HTML code locally, and modified it to include an exploit URL. Then he exploited the cache poisoning flaw, so that every visitor - at least every visitor coming through that particular cache cluster - would receive not the legitimate site but his malicious modificiations.
They watched the C&C management console. Around the world, thousands of unsuspecting web users experienced an annoying pause while their web pages loaded. Each time, under the hood, the zero day exploit fired, the payload persisted itself to disk, and made a connection to their C&C network to receive further instructions. Each time a new node joined their botnet, a line was logged to their console, and soon the screen was scrolling uncontrollably.
John was elated, Cal terrified. Cal watched in horror as John repeated the cache poison process across multiple clusters in different data centres. The rate of scrolling on the C&C console exploded. John cancelled it with a smile.
"Lets just look at the numbers"
Running a grep count on the log showed over 900,000 payload activations. And their malware had been live for barely 15 minutes.
"What are you going to do with it?"
"That's for another day. Now, we cover our tracks."
John removed two USB drives from his bag. He created an encrypted container, and into it put his decoy. Some nudes of an office chick that had been circulating. Incriminating enough, but not the crown jewels. He then created a hidden container within the free space of the first container, using a very strong password. Into this hidden container he copied the private key for the C&C network. This key put him in control. The only way to control the botnot was having both the USB drive, and his strong password. He repeated the process for Cal, inviting him to choose his own passwords. When he handed over the drive, Cal held it like it was on fire.
He shut down the bait laptop, gesturing Cal to do the same with the proxy. Removed the hard drive and connected it via USB to the ToR relay. The ToR relay was unlikely to have been compromised that night, a trustworthy system he could use to erase the others. After a secure erase of both drives, then of the ToR relay itself, John started putting everything in a bag.
They left the hotel room in silence. Bag on the rear seat and John drove. Cal was acutely aware of the USB drive in his pocket, the angled corners pressing into his leg. He went out of town, down lanes Cal didn't recognise, and stopped by a chain link fence. They both got out, John retrieved the bag, and with a big hurl, launched it over the fence into the landfill.
Back home, John smoked a large joint of double zero hash and fell fast asleep. He awoke a few hours later. It almost felt like a dream. But he ran his fingers along the USB drive and remembered the sheer power it contained.
submitted by netsecwarrior to shortstories [link] [comments]

Crypto Weekly News

What important crypto events happened last week?
Cryptocurrencies
Monero Presents New Legal Framework In Defense Of Privacy Coins
Riccardo Spagni presented the result of more than a year's work. A whitepaper titled "Anti-Money Laundering Regulation of Privacy-Enabling Cryptocurrencies" has been published. The document was conceived as a new legal framework to protect confidential coins such as Monero, Zcash, Dash, Komodo, and others.
Tether Is Moving 1 Billion More USDT Coins From TRON To Ethereum Blockchain
The total supply of coins will not change. The company carried out the swap on September 15, coordinating its actions "with a third party". In recent weeks, this is the second such stablecoin transfer between blockchains — on August 20, the issuer also moved USDT 1 billion from Tron to Ethereum. Another piece of news about Tether: USDT capitalization exceeded $15 billion, having increased by $3 billion in just a month.
Projects and Updates
Kraken Receives Licence To Establish First U.S Digital Assets Bank
The Kraken Bitcoin exchange was the first in the United States to receive the status of a special purpose depository institution (SPDI), giving it the functions of a traditional financial institution. The corresponding application of the Californian company was approved by the Wyoming Banking Council. This will allow Kraken to opt-out of third-party vendors to perform certain banking functions on its own.
Official Ethereum Proof-of-Stake Algorithm Proposal Published
Ethereum Foundation Lead Developer Danny Ryan has published the official proposal EIP-2982, which suggests the launch of Ethereum 2.0 and the transition from the Proof-of-Work consensus algorithm to Proof-of-Stake. If approved by other leading developers, it will be possible to launch Serenity, Ethereum 2.0 phase zero. Within its framework, the Beacon Chain will be activated, which will use Proof-of-Stake.
Uniswap Provides All Its Users With $1.200
Leading decentralized exchange (DEX) Uniswap has released the UNI governance token. It was listed on the Binance exchange almost immediately. About 13000 Uniswap users have already requested tokens.
Regulations
New Draft Law Suggests The European Union Is Set To Regulate Cryptocurrencies
The European Commission proposed to establish a legal framework for cryptocurrencies, security tokens, and stablecoins by analogy with the requirements for traditional financial instruments. This is stated in the Cryptocurrency Asset Markets Bill. The bill proposes to treat cryptocurrency assets like any other financial instrument. According to the European Commission, this will provide legal clarity.
Digital Assets Recognized As Securities In Nigeria
The regulator clarified that cryptocurrencies offer public alternative investment opportunities. Digital assets can be used as a medium of exchange, settlement, and accumulation. In order to protect investors from risks and not violate the integrity of the market, crypto assets must be controlled on an equal basis with securities. The main task of regulation is not to discourage the development of new technologies, but to ensure fair market competition and adherence to ethical standards.
Hacking
Japanese Crypto Exchange Sues Binance for Role in $63 Million Bitcoin Hack
The Japanese company Fisco Cryptocurrency Exchange, Inc has filed a US lawsuit against Binance Holdings Ltd., accusing it of providing a service to launder cryptocurrency stolen from the Zaif exchange in 2018. Fisco acquired Zaif in 2018 shortly after the hack. Over $9 million in stolen assets could have been funneled through Binance. The company notes that analysts were able to track the movement of all stolen $63 million to one bitcoin address. Subsequently, 1,451.7 BTC were sent from it to Binance addresses.
New Virus Attacks Microsoft SQL Database Servers For Monero Mining
Tencent's cybersecurity division has discovered a new miner virus called MrbMiner. The tactics of the virus are quite simple — the botnet scans the available IP addresses in search of Microsoft SQL servers, and if it detects such, it tries to log in under the administrator account using a brute-force password. If successful, the virus downloads the assm.exe file, which implements a reboot mechanism and creates a special account for hackers to access the server. After that, MrbMiner downloads a miner for mining the anonymous cryptocurrency Monero (XMR).
Mass adoption
Bahamas Geared to Launch Central Bank Digital Currency
The Bahamas wants to be the first country in the world to roll out a government-backed virtual currency nationwide and announced they will launch a central bank-issued cryptocurrency (CBDC) in October. The digital currency, dubbed "sand dollar", is designed to increase the financial availability of remote islands within the archipelago state.
Alibaba On Track To Be The Largest Blockchain Patent Holder By End Of 2020
Computer giant IBM risks losing the title of the largest blockchain patent holder to the Chinese corporation Alibaba. Since the beginning of the year, Alibaba has published ten times more patents than its closest competitor, IBM. According to analysts, if the pace is maintained, the Chinese corporation will become the largest patent holder by the end of the year.
France Begins Central Bank Digital Currency Testing
Société Générale — one of the largest financial conglomerates in Europe — will test the central bank digital currency (CBDC) on the Tezos blockchain. The Bank of France, as a result of the selection of partners, chose the Forge blockchain platform to test CBDC for interbank settlements. As part of the experiment, the feasibility of digitizing financial securities and the possibility of settlements on them using CBDC will be studied. In addition to Nomadic Labs, several technology service providers and consultants will participate in the testing.
Kazakhstan Will Develop A Blockchain Service For Ensuring The Security Of Personal Data
It will allow citizens of the country to control the use of their personal data. The service is planned to be introduced by the end of this year.
People
Kiss Rock Group Member Is Ready To Buy Bitcoin
Gene Simmons supported Cameron Winklevoss's request to use bank accounts to buy Bitcoin and Ether. The co-founder of Gemini tweeted that people who do not have access to banking services find it difficult to become the owners of cryptocurrency and that they need to take advantage of the benefits. The musician commented as follows: "I will. I am." For this moment, the most common opinion on Twitter is that Simmons is already buying cryptocurrency and will continue to increase the amount of Bitcoin he owns.
That’s all for now! For more details follow us on Twitter, subscribe to our YouTube channel, join our Telegram.
submitted by CoinjoyAssistant to cryptoeconomynet [link] [comments]

Crypto Weekly News — September, 18

What important crypto events happened last week?

Cryptocurrencies

Monero Presents New Legal Framework In Defense Of Privacy Coins
Riccardo Spagni presented the result of more than a year's work. A whitepaper titled "Anti-Money Laundering Regulation of Privacy-Enabling Cryptocurrencies" has been published. The document was conceived as a new legal framework to protect confidential coins such as Monero, Zcash, Dash, Komodo, and others.
Tether Is Moving 1 Billion More USDT Coins From TRON To Ethereum Blockchain
The total supply of coins will not change. The company carried out the swap on September 15, coordinating its actions "with a third party". In recent weeks, this is the second such stablecoin transfer between blockchains — on August 20, the issuer also moved USDT 1 billion from Tron to Ethereum. Another piece of news about Tether: USDT capitalization exceeded $15 billion, having increased by $3 billion in just a month.

Projects and Updates

Kraken Receives Licence To Establish First U.S Digital Assets Bank
The Kraken Bitcoin exchange was the first in the United States to receive the status of a special purpose depository institution (SPDI), giving it the functions of a traditional financial institution. The corresponding application of the Californian company was approved by the Wyoming Banking Council. This will allow Kraken to opt-out of third-party vendors to perform certain banking functions on its own.
Official Ethereum Proof-of-Stake Algorithm Proposal Published
Ethereum Foundation Lead Developer Danny Ryan has published the official proposal EIP-2982, which suggests the launch of Ethereum 2.0 and the transition from the Proof-of-Work consensus algorithm to Proof-of-Stake. If approved by other leading developers, it will be possible to launch Serenity, Ethereum 2.0 phase zero. Within its framework, the Beacon Chain will be activated, which will use Proof-of-Stake.
Uniswap Provides All Its Users With $1.200
Leading decentralized exchange (DEX) Uniswap has released the UNI governance token. It was listed on the Binance exchange almost immediately. About 13000 Uniswap users have already requested tokens.

Regulations

New Draft Law Suggests The European Union Is Set To Regulate Cryptocurrencies
The European Commission proposed to establish a legal framework for cryptocurrencies, security tokens, and stablecoins by analogy with the requirements for traditional financial instruments. This is stated in the Cryptocurrency Asset Markets Bill. The bill proposes to treat cryptocurrency assets like any other financial instrument. According to the European Commission, this will provide legal clarity.
Digital Assets Recognized As Securities In Nigeria
The regulator clarified that cryptocurrencies offer public alternative investment opportunities. Digital assets can be used as a medium of exchange, settlement, and accumulation. In order to protect investors from risks and not violate the integrity of the market, crypto assets must be controlled on an equal basis with securities. The main task of regulation is not to discourage the development of new technologies, but to ensure fair market competition and adherence to ethical standards.

Hacking

Japanese Crypto Exchange Sues Binance for Role in $63 Million Bitcoin Hack
The Japanese company Fisco Cryptocurrency Exchange, Inc has filed a US lawsuit against Binance Holdings Ltd., accusing it of providing a service to launder cryptocurrency stolen from the Zaif exchange in 2018. Fisco acquired Zaif in 2018 shortly after the hack. Over $9 million in stolen assets could have been funneled through Binance. The company notes that analysts were able to track the movement of all stolen $63 million to one bitcoin address. Subsequently, 1,451.7 BTC were sent from it to Binance addresses.
New Virus Attacks Microsoft SQL Database Servers For Monero Mining
Tencent's cybersecurity division has discovered a new miner virus called MrbMiner. The tactics of the virus are quite simple — the botnet scans the available IP addresses in search of Microsoft SQL servers, and if it detects such, it tries to log in under the administrator account using a brute-force password. If successful, the virus downloads the assm.exe file, which implements a reboot mechanism and creates a special account for hackers to access the server. After that, MrbMiner downloads a miner for mining the anonymous cryptocurrency Monero (XMR).

Mass adoption

Bahamas Geared to Launch Central Bank Digital Currency
The Bahamas wants to be the first country in the world to roll out a government-backed virtual currency nationwide and announced they will launch a central bank-issued cryptocurrency (CBDC) in October. The digital currency, dubbed "sand dollar", is designed to increase the financial availability of remote islands within the archipelago state.
Alibaba On Track To Be The Largest Blockchain Patent Holder By End Of 2020
Computer giant IBM risks losing the title of the largest blockchain patent holder to the Chinese corporation Alibaba. Since the beginning of the year, Alibaba has published ten times more patents than its closest competitor, IBM. According to analysts, if the pace is maintained, the Chinese corporation will become the largest patent holder by the end of the year.
France Begins Central Bank Digital Currency Testing
Société Générale — one of the largest financial conglomerates in Europe — will test the central bank digital currency (CBDC) on the Tezos blockchain. The Bank of France, as a result of the selection of partners, chose the Forge blockchain platform to test CBDC for interbank settlements. As part of the experiment, the feasibility of digitizing financial securities and the possibility of settlements on them using CBDC will be studied. In addition to Nomadic Labs, several technology service providers and consultants will participate in the testing.
Kazakhstan Will Develop A Blockchain Service For Ensuring The Security Of Personal Data
It will allow citizens of the country to control the use of their personal data. The service is planned to be introduced by the end of this year.

People

Kiss Rock Group Member Is Ready To Buy Bitcoin
Gene Simmons supported Cameron Winklevoss's request to use bank accounts to buy Bitcoin and Ether. The co-founder of Gemini tweeted that people who do not have access to banking services find it difficult to become the owners of cryptocurrency and that they need to take advantage of the benefits. The musician commented as follows: "I will. I am." For this moment, the most common opinion on Twitter is that Simmons is already buying cryptocurrency and will continue to increase the amount of Bitcoin he owns.
That’s all for now! For more details follow us on Twitter, subscribe to our YouTube channel, join our Telegram.
submitted by CoinjoyAssistant to u/CoinjoyAssistant [link] [comments]

using AI in unethical ways

Hello, before I start spilling the beans let me give some background about myself. Since I was a little child my fascination on the topic of electricity and computing was immeasurable. This was not enough to be considered good at anything, everyone including myself viewed me as a failure, and I can't blame them, I didn't do any sports or had good grades. But one summer, it was about 5 years ago I have started exploring computer science, on my own. And my skills were improving really fast, but my family's constant disappointment pushed me away from anything, since my programs weren't good grades, and fuck me that I don't have good grades. This pushed me into a great depression, an insane one where I didn't felt like waking up anymore, except one day when I found out about artificial intelligence, and it's potential. At first it was just a hobby I kept secret from everyone since I don't want to let anyone know anything about me since I will be critiqued, but this hobby of mine turned into an obsession. Any money I could earn would go into video cards and any free time I had would go towards researching different AI's. My room turned into GPUs and wires. Electricity bill was getting out of hand with each day, this issue won't continue for long since I discovered an website named "this person doesn't exist", that site gave me an idea, one of the worst kinds, but quite profitable in money.
To reach that idea I have done a lot of research on genetic algorithms, deep learning, machine learning. This research gave birth to some new learning algorithms, and all of them combined let me virtual humans. At first I could get a realistic face, but it was not enough to reach my goal. I needed something to let me create poses at demand, this part took 6 months out of my life, nights I haven't slept, constant headaches and insane anxiety, not knowing if each attempt will work, all I could do is to wait until it fully trained on my dateset(who is just insane to gather enough data, and process them manually).
My nightmare ended with one algorithm who took a long time to adapt itself, but it showed potential. I wasn't deceived it kept working really well. But let's not forget why I wanted to make something that let me create a persona and pose it however I wanted, to pay my electricity bills and buy new upgrades for my botnet. So I opened an Instagram page, where I would impersonate a girl named Casey(not the name I had actually used, but I still want to keep this dirty business). She would put some provocative pictures of herself. It wasn't long until Casey(I don't identify as her, she is only an internet personality, I think) was asked for nudes so I agreed to sell them and get paid through bitcoin, my program could generate nudity with ease since all I had to do was to find what parameters influenced her clothing .
The sad part of my story is that I'm using others to live a lazy life. If you are wondering why don't I sell me work, or why don't I work in this domain officially and so on, the answer is simple, I don't have a college done, I need to work hard to gain less than I do from exploiting some horny people and I get to work on my latest project who is not related to any AI, a compiler. It might get me closer to self programming AI if I use an genetic algorithm on it. Don't expect any replies from me, since this is the first time and the last I'm logging on this account, and I hope my English didn't bothered you, it was built by many hours of playing games, farewell.
submitted by AIThrowAwayAcc to offmychest [link] [comments]

IoT Attacks, Hacker Motivations, and Recommended Countermeasures

IoT Attacks, Hacker Motivations, and Recommended Countermeasures


Illustration: © IoT For All
Businesses worldwide spent $1.5 billion on IoT security in 2019. When it comes to connecting devices via cellular IoT, the selling-point is typically the data and derived insights–this is where the customer sees real value, more so than in any security benefits. That said, IoT solution providers not taking security measures into consideration are risking significant revenue and reputation loss in the event of a security breach–both for their own business as well as their customer’s business.
In the worst cases, the harm done from one security breach will far outweigh any previously created customer value. IoT connectivity providers that can explain and demonstrate their security concepts will gain a competitive advantage.

Why Are Hackers Focused on IoT?

IoT attacks increased by 900% in 2019. So, why are hackers increasingly targeting IoT devices? There are several explanations:
  1. Lack of security software on the devices: Opposed to regular computers, IoT devices do not have a firewall or virus scanner.
  2. Less experienced device producers: The businesses usually come from the industry vertical and often are lacking the IT security expertise of servecomputer manufacturers.
  3. Multiple devices with the same security mechanisms: Once an attack works with one device it will work with thousands.
  4. IoT devices are out of reach: device owners deploy their machines remotely. Often an owner won’t realize that the devices have been compromised until it is too late. Once an attacker has control over a device, it could run all day long before being physically shut down by the owner.

Who Are the Attackers and What Motivates Them?

  • Amateur hackers and script kiddies – usually their objective is fame among their peers, either by targeting a high-profile victim or by demonstrating an ability to infect many devices in a single attack.
  • Governments/Intelligence organizations – acting in the safety of their citizens, intelligence agencies attempt to secure access to important information.
  • Political interest groups – they attack organizations that they think are morally corrupt. Examples are groups like anonymous.
  • Criminal businesses – organizations that take advantage of vulnerabilities within the target to generate revenue for themselves.
The criminal businesses mentioned above are typically set up as ordinary businesses and are especially relevant in the IoT domain. Their objective is to gain control over a large number of IoT devices and make money out of them, often in one of the following ways:
  • Selling Distributed Denial of Service attacks – like webstresser.org (more information via Forbes)
  • Using devices for Bitcoin mining (more information via CNBC)
  • Blocking the device operation until the owner pays a ransom (ransomware)

How Do IoT Attacks Work?

Mirai

The most common IoT attack today is the Mirai malware, which originated in 2016. The malware scans the public internet for IoT devices and tries to establish a remote telnet connection using a list of common factory default usernames and passwords. As soon as one device is infected, the malware begins scanning for more victims. All devices become part of the Mirai botnet which is then steered through the attacker’s command and control center. The attackers then execute a DDoS attack, on behalf of their customers, to a target destination in order to take down the servers of the victims.

Stuxnet

The Stuxnet computer worm was first uncovered in 2010. The malware first injects Microsoft Windows machines exploiting zero-day exploit or outdated OS versions; initially it spread over USB flash drives. On the Windows machine it looks for the Siemens Step7 software that controls the Siemens programmable logic controller (PLC). With the Step7 software it then installs itself on the IoT device and takes over control. Stuxnet once targeted Iranian facilities and reportedly severely harmed the Iranian atomic program.

Silex/Brickerbot

While Brickerbot was discovered in 2017 and Silex appeared in 2019, they have a common attack pattern. Like Mirai, the software scans the public internet and tries to log in to the IoT device with default and weak login and password combinations. After infection, the software overwrites all data and deletes the network configuration, which makes the IoT device unusable, unless someone can physically get a hand on the device.

Countermeasures to Guard Against Attacks

As seen in the Stuxnet attack, IoT devices in the same network as other machines can be impacted by the vulnerabilities of those other machines. To avoid this, using a dedicated network infrastructure is recommended, instead of using shared LAN or Wi-Fi networks. Alternatively, using cellular communication that separates the communication of the different machines is also preferred.
The Mirai and Silex / Brickerbot malware show the value of having random and unique log-in credentials for the different devices – this could have prevented the above-mentioned attack. While the devices allowed for remote access by their owners, the access was granted via the unsecured public internet. A more secure way to get remote access to IoT devices is to use IPSec or Intra-Cloud Connect, avoiding the exposure of public Internet.
One way to prevent attempts to steal remote access to IoT devices, as well as completely block attacks, is to use a cellular firewall. With a cellular firewall, devices are only permitted to communicate with a defined subset of IP addresses. The firewall itself is not located on the individual devices, rather on the cellular connection – out of the attacker’s control.

Key Takeaway: Security First

While the excitement surrounding the brimming potential of IoT connectivity is understandable–and warranted–overlooking IoT device security can prove catastrophic. A robustly secured IoT solution is one that can safely scale globally, enable groundbreaking solutions, and last for years to come.
Originally published by EMnify -| August 12, 2020 iot for all
submitted by kjonesatjaagnet to JAAGNet [link] [comments]

How Ransomware Encryption Happens & 4 Methods for Recovery

We know how overwhelming it can feel to be the victim of a ransomware attack and how your business cannot operate due encrypted or locked files. This page delivers insight on why your files were encrypted or locked, and the options you have to decrypt ransomware. As a ransomware recovery service provider, we have helped thousands of clients successfully recover their data and decrypt their data.
Evaluating all options will include analyzing the encrypted files, and the least desirable option to pay the ransom demand if necessary. Our process helps provide critical insight into decrypting ransomware and the available options that clients have.
By the end of this piece, it is our goal to show you what is involved to successfully recover your files. This guide outlines what steps and research are necessary to decrypt or unlock your files from a ransomware attack.

You’re the victim of a ransomware attack

You arrive to work and start noticing suspicious alerts coming from your servers, and none of the databases are functional. Your co-workers are frantic and cannot access any of their data. You investigate further and find all of the files on your network are renamed and discover ransom notes, and a screen asking you to email someone if you want your data back. You finally realize that you are a victim of a ransomware attack, and all of your files are locked or encrypted.

3 Common Ways Your Files Were Encrypted or Locked

Ransomware succeeds when businesses have poor security hygiene. Organizations that lack policies & procedures around data security will have a higher risk of ransomware attacks. Here are some of the most common ways to fall victim to a ransomware attack:

Open Remote Desktop Protocol Ports (RDP)

Businesses that have improperly configured network security may leave their Remote Desktop Protocol (RDP) ports open. Unknowingly, this is the equivalent of leaving the front door unlocked when you leave your home: it provides an opportunity for cyber attacks to come through with little deterrence.
Once a hacker is connected to your network, they can install ransomware and additional back doors to access your network at a later date. A large percentage of ransomware attacks still use this method of attack because so many organizations are not even aware of this security vulnerability.

Phishing Attacks

Ransomware can infiltrate your network by a malicious email campaign known as a phishing attack. Ransomware operators use massive networks of internet-connected devices (botnets) to send phishing emails to unsuspecting victims. These emails intend to trick the receiver into clicking on a malicious attachment or link, which can secretly install the ransomware virus or other malware.
Phishing emails are becoming increasingly difficult to detect as cybercriminals find clever ways to make a malicious email look legitimate. This underscores the importance of security awareness training for everyone in the organization, not just the I.T. department.

Compromised Passwords

The ransomware operators may have used previously compromised passwords from employees at your organization to gain unauthorized access to the networks. This derives from the poor security practices of reusing the same passwords for multiple accounts and authentication processes.
If your employees have been using old & weak passwords to access your business data, a cyber criminal can use a previously compromised password to initiate the attack. Remember to always to follow good password hygiene.
The variety of attack vectors highlights the importance of a digital forensics investigation that can help victims understand how the ransomware came onto your computer and what steps you can take to remediate the vulnerability.

4 Options for Ransomware Recovery

In this section, we cover the options to restore files encrypted or locked by ransomware.

1. Recover files with a backup

If your files become encrypted in a ransomware attack, check to see if you have backups to restore and recover (in order).

2. Recreate the data

Even though your files are encrypted by ransomware, you might be able to recreate the data from a variety of sources as outlined below:

3. Breaking the ransomware encryption

The harsh truth is that the majority of ransomware encryption is unbreakable. This impossibility is a tough concept for many of us to accept, given the technological advances of our society.
Does this mean you should skip looking into whether the ransomware encryption can be broken? This option should always be explored if presented by a ransomware recovery firm, although the final choice is yours to make. We will lay out a real life example at Proven Data below to outline why this was a great decision for a company that was infected with ransomware.
While it tends to be rare, there are poorly constructed ransomware encryptions that have been broken by security researchers. If you can avoid paying a ransom, you should at all costs.
There can be flaws in the malware or weaknesses in the encryption. Businesses can look at these options, especially if time is on your side. There are also free ransomware decryption resources that provide tools for previously decrypted ransomware variants. A client of ours had hired a ransomware recovery company to recover their files until we discovered at the very last moment through our analysis that the encryption was breakable. With less than 20 minutes to spare, we saved the client out of paying a $450,000 ransom.

Why can’t most ransomware encryption be broken?

Ransomware is a cryptovirus, which means it uses cryptography in combination with malware to lock your files. Modern cryptography uses sophisticated mathematical equations (algorithms) and secret keys to encrypt and decrypt data. If strong encryption is used, it can take thousands, if not millions of years to break the encryption given the strength of today’s computers.
Encryption is a security tool created with the intent of data protection. It is a defensive tool to provide security, privacy, and authentication. Sadly, ransomware attackers are using it as a weapon against innocent victims.

How do I know if the encryption can be broken?

You can start off with this free ransomware identification resource to determine the feasibility of decryption. You will need to upload the ransom note and a sample file into the ID-Ransomware website, and it will tell you if there is a free decrypter or if it is an unknown ransomware variant. Please note that the tool is not always 100% accurate. If the variant is still under analysis, you will need a malware or encryption analyst to determine whether or not there is a possibility for decryption.
Encryption is designed to be unbreakable, which is why security researchers can’t simply make a tool for ransomware decryption. These unbreakable encryptions protect our bank accounts, trade secrets, government data, and mobile communications, among other things. It would be a significant security concern if there were a master decryption tool that could break encryption algorithms.

4. Paying the ransom to decrypt ransomware files

If the encryption is too strong, the only way to obtain the decryption key for your files is to pay the ransom. Many ransomware victims don’t have time on their side because they are facing significant business disruption. Each minute that passes could be a lost client, or worse for a medical organization.
Here is a list of the most prevalent ransomware variants that are known to be “cryptographically secure,” which means that Proven Data or the security community has confirmed the encryption is unbreakable:

I don’t want to pay the hackers ransom.

Businesses and individuals have the option of choosing not to pay the ransom in a ransomware attack to regain access to their files. For personal, political, or moral reasons, there has been resentment of the ransomware economy, and victims do not have to engage in extortion. If paying the ransom is the only option, you should know what to expect before considering moving forward.

How a ransomware recovery specialist can help

If you do decide to use a ransomware recovery company and if there is one thing you get out of this article, it is this: You should always question how a ransomware recovery company is recovering your data. If you are unsure, asking the right questions will ensure a transparent experience:
A ransomware recovery specialist can analyze your current situation and determine what options are available to you at the time of the inquiry. A competent and experienced ransomware recovery company should be able to provide the following:
Understanding how your files were affected by ransomware in the first place will provide you with the insight needed to prevent another attack. Whether you choose Proven Data or another company to decrypt your ransomware files, it’s important to know what unknowns there may be out there.
Our threat intelligence that we’ve gathered from the thousands of previous cases enable you to make informed decisions in helping restore your data after a ransomware attack. If you require a company with such experience, we’re standing by to assist 24/7.
submitted by Proven_Data to u/Proven_Data [link] [comments]

AMA: Ask Mike Anything

Hello again. It's been a while.
People have been emailing me about once a week or so for the last year to ask if I'm coming back to Bitcoin now that Bitcoin Cash exists. And a couple of weeks ago I was summoned on a thread called "Ask Mike Hearn Anything", but that was nothing to do with me and I was on holiday in Japan at the time. So I figured I should just answer all the different questions and answers in one place rather than keep doing it individually over email.
Firstly, thanks for the kind words on this sub. I don't take part anymore but I still visit occasionally to see what people are talking about, and the people posting nice messages is a pleasant change from three years ago.
Secondly, who am I? Some new Bitcoiners might not know.
I am Satoshi.
Just kidding. I'm not Satoshi. I was a Bitcoin developer for about five years, from 2010-2015. I was also one of the first Bitcoin users, sending my first coins in April 2009 (to SN), about 4 months after the genesis block. I worked on various things:
You can see a trend here - I was always interested in developing peer to peer decentralised applications that used Bitcoin.
But what I'm best known for is my role in the block size debate/civil war, documented by Nathaniel Popper in the New York Times. I spent most of 2015 writing extensively about why various proposals from the small-block/Blockstream faction weren't going to work (e.g. on replace by fee, lightning network, what would occur if no hard fork happened, soft forks, scaling conferences etc). After Blockstream successfully took over Bitcoin Core and expelled anyone who opposed them, Gavin and I forked Bitcoin Core to create Bitcoin XT, the first alternative node implementation to gain any serious usage. The creation of XT led to the imposition of censorship across all Bitcoin discussion forums and news outlets, resulted in the creation of this sub, and Core supporters paid a botnet operator to force XT nodes offline with DDoS attacks. They also convinced the miners and wider community to do nothing for years, resulting in the eventual overload of the main network.
I left the project at the start of 2016, documenting my reasons and what I expected to happen in my final essay on Bitcoin in which I said I considered it a failed experiment. Along with the article in the New York Times this pierced the censorship, made the wider world aware of what was going on, and thus my last gift to the community was a 20% drop in price (it soon recovered).

The last two years

Left Bitcoin ... but not decentralisation. After all that went down I started a new project called Corda. You can think of Corda as Bitcoin++, but modified for industrial use cases where a decentralised p2p database is more immediately useful than a new coin.
Corda incorporates many ideas I had back when I was working on Bitcoin but couldn't implement due to lack of time, resources, because of ideological wars or because they were too technically radical for the community. So even though it's doesn't provide a new cryptocurrency out of the box, it might be interesting for the Bitcoin Cash community to study anyway. By resigning myself to Bitcoin's fate and joining R3 I could go back to the drawing board and design with a lot more freedom, creating something inspired by Bitcoin's protocol but incorporating all the experience we gained writing Bitcoin apps over the years.
The most common question I'm asked is whether I'd come back and work on Bitcoin again. The obvious followup question is - come back and work on what? If you want to see some of the ideas I'd have been exploring if things had worked out differently, go read the Corda tech white paper. Here's a few of the things it might be worth asking about:
I don't plan on returning to Bitcoin but if you'd like to know what sort of things I'd have been researching or doing, ask about these things.
edit: Richard pointed out some essays he wrote that might be useful, Enterprise blockchains for cryptocurrency experts and New to Corda? Start here!
submitted by mike_hearn to btc [link] [comments]

The Solutions to Spam

Spam is an interesting and somewhat unique problem for Nano. For Nano to remain feeless, it needs to penalize malicious actors which spam the network in an attempt to slow or stop the network, but at the same time all transactions must be considered equal because Nano is a permissionless network. This is quite the Catch-22, so how can we solve this dilemma without adding fees on-chain and without making the work requirement burdensome to the average user or service?
Keep in mind there is not one solution to spam. A lot of different things will need to work together to mitigate spam. The current proposed solutions are as follows:
The above methods are the only ones I'm aware that the Nano team is pursuing at this time. Since Dynamic PoW is the only one currently implemented, Nano is vulnerable to spam attacks. This said, here are some additional solutions that can be implemented that would reduce the ability for spammers to saturate the network:
Let me know what you think. I intentionally left some of the multipliers as X for debate, should they by two, three, ten or more times the BASE requirement? What other ways can the spam problem be solved?
submitted by hanzyfranzy to nanocurrency [link] [comments]

A few stories about Brian Krebs: The independent cybercrime journalist who exposes criminals on the internet

First, a bit of introduction before we get into the living drama that is Brian Krebs.
Brian Krebs has been a journalist for decades, starting in the late 90s. He got his start at The Washington Post, but what he's most famous for are his exposes on criminal businesses and individuals who perpetuate cyber crime worldwide. In 2001, he got his interest in cybercrime piqued when a computer worm locked him out of his own computer. In 2005, he shifted from working as a staff writer at The Washington Post's tech newswire to writing for their security blog, "Security Wire". During his tenure there, he started by focusing on the victims of cybercrime, but later also started to focus on the perpetrators of it as well. His reporting helped lead to the shutdown of McColo, a hosting provider who provided service to some of the world's biggest spammers and hackers. Reports analyzing the shutdown of McColo estimated that global spam volume dropped by between 40 and 70 percent. Further analysis revealed it also played host to child pornography sites, and the Russian Business Network, a major Russian cybercrime ring.
In 2009, Krebs left to start his own site, KrebsOnSecurity. Since then, he's been credited with being the first to report on major events such as Stuxnet and when Target was breached, resulting in the leakage of 40 million cards. He also regularly investigates and reveals criminals' identities on his site. The latter has made him the bane of the world of cybercrime, as well as basically a meme, where criminals will include references like Made by Brian Krebs in their code, or name their shops full of stolen credit cards after him.
One of his first posts on his new site was a selection of his best work. While not particularly dramatic, they serve as an excellent example of dogged investigative work, and his series reveal the trail of takedowns his work has documented, or even contributed to.
And now, a selection of drama involving Krebs. Note, all posts are sarcastically-tinged retellings of the source material which I will link throughout. I also didn't use the real names in my retellings, but they are in the source material. This took way too long to write, and it still does massively condense the events described in the series. Krebs has been involved with feuds with other figures, but I'd argue these tales are the "main" bits of drama that are most suited for here.

Fly on the Wall

By 2013, Krebs was no stranger to cybercriminals taking the fight to the real world. He was swatted previously to the point where the police actually know to give him a ring and see if there'd actually been a murder, or if it was just those wacky hackers at it again. In addition, his identity was basically common knowledge to cybercriminals, who would open lines of credit in his name, or find ways to send him money using stolen credit cards.
However, one particular campaign against him caught his eye. A hacker known as "Fly" aka "Flycracker" aka "MUXACC1" posted on a Russian-language fraud forum he administered about a "Krebs fund". His plan was simple. Raise Bitcoin to buy Heroin off of a darknet marketplace, address it to Krebs, and alert his local police via a spoofed phone call. Now, because Krebs is an investigative journalist, he develops undercover presences on cybercrime forums, and it just so happened he'd built up a presence on this one already.
Guys, it became known recently that Brian Krebs is a heroin addict and he desperately needs the smack, so we have started the "Helping Brian Fund", and shortly we will create a bitcoin wallet called "Drugs for Krebs" which we will use to buy him the purest heroin on the Silk Road. My friends, his withdrawal is very bad, let’s join forces to help the guy! We will save Brian from the acute heroin withdrawal and the world will get slightly better!
Fly had first caught Krebs' attention by taunting him on Twitter, sending him Tweets including insults and abuse, and totally-legit looking links. Probably either laced with malware, or designed to get Krebs' IP. He also took to posting personal details such as Krebs' credit report, directions to his house, and pictures of his front door on LiveJournal, of all places.
So, after spotting the scheme, he alerted his local police that he'd probably have someone sending him some China White. Sure enough, the ne'er-do-wells managed to raise 2 BTC, which at the time was a cool $200 or so. They created an account on the premiere darknet site at the time, The Silk Road under the foolproof name "briankrebs7". They found one seller who had consistently high reviews, but the deal fell through for unknown reasons. My personal theory is the seller decided to Google where it was going, and realized sending a gram of dope into the waiting arms of local law enforcement probably wasn't the best use of his time. Still, the forum members persevered, and found another seller who was running a buy 10 get 2 free promotion. $165 of Bitcoin later, the drugs were on their way to a new home. The seller apparently informed Fly that the shipment should arrive by Tuesday, a fact which he gleefully shared with the forum.
While our intrepid hero had no doubt that the forum members were determined to help him grab the tail of the dragon, he's not one to assume without confirmation, and enlisted the help of a graduate student at UCSD who was researching Bitcoin and anonymity on The Silk Road, and confirmed the address shared by Fly was used to deposit 2 BTC into an account known to be used for money management on the site.
By Monday, an envelope from Chicago had arrived, containing a copy of Chicago confidential. Taped inside were tiny baggies filled with the purported heroin. Either dedicated to satisfied customers, or mathematically challenged, the seller had included thirteen baggies instead of the twelve advertised. A police officer arrived to take a report and whisked the baggies away.
Now, Fly was upset that Krebs wasn't in handcuffs for drug possession, and decided to follow up his stunt by sending Krebs a floral arrangement shaped like a cross, and an accompanying threatening message addressed to his wife, the dire tone slightly undercut by the fact that it was signed "Velvet Crabs". Krebs' curiosity was already piqued from the shenanigans with the heroin, but with the arrival of the flowers decided to dive deeper into the сука behind things.
He began digging into databases from carding sites that had been hacked, but got his first major breakthrough to his identity from a Russian computer forensics firm. Fly had maintained an account on a now-defunct hacking forum, whose database was breached under "Flycracker". It turns out, the email Flycracker had used was also hacked at some point, and a source told Krebs that the email was full of reports from a keylogger Fly had installed on his wife's computer. Now, because presumably his wife wasn't part of, or perhaps even privy to her husband's illicit dealings, her email account happened to be her full legal name, which Krebs was able to trace to her husband. Now, around this time, the site Fly maintained disappeared from the web, and administrators on another major fraud forum started purging his account. This is a step they typically take when they suspect a member has been apprehended by authorities. Nobody knew for sure, but they didn't want to take any chances.
More research by Krebs revealed that the criminals' intuition had been correct, and Fly was arrested in Italy, carrying documents under an assumed name. He was sitting in an Italian jail, awaiting potential extradition to the United States, as well as potentially facing charges in Italy. This was relayed to Krebs by a law enforcement official who simply said "The Fly has been swatted". (Presumably while slowly removing a pair of aviator sunglasses)
While Fly may have been put away, the story between Krebs and Fly wasn't quite over. He did end up being extradited to the US for prosecution, but while imprisoned in Italy, Fly actually started sending Krebs letters. Understandably distrustful after the whole "heroin" thing, his contacts in federal law enforcement tested the letter, and found it to be clean. Inside, there was a heartfelt and personal letter, apologizing for fucking with Krebs in so many ways. He also forgave Krebs for posting his identity online, leading him to muse that perhaps Fly was working through a twelve-step program. In December, he received another letter, this time a simple postcard with a cheerful message wishing him a Merry Christmas and a Happy New Year. Krebs concluded his post thusly:
Cybercrooks have done some pretty crazy stuff to me in response to my reporting about them. But I don’t normally get this kind of closure. I look forward to meeting with Fly in person one day soon now that he will be just a short train ride away. And he may be here for some time: If convicted on all charges, Fly faces up to 30 years in U.S. federal prison.
Fly ultimately was extradited. He plead guilty and was sentenced to 41 months in jail

vDOS and Mirai Break The Internet

Criminals are none too happy when they find their businesses and identities on the front page of KrebsOnSecurity. It usually means law enforcement isn't far behind. One such business was known as vDOS. A DDOS-for-hire (also known as a "booter" or a "stresser") site that found itself hacked, with all their customer records still in their databases leaked. Analysis of the records found that in a four-month time span, the service had been responsible for about 8.81 years worth of attack time, meaning on average at any given second, there were 26 simultaneous attacks running. Interestingly, the hack of vDOS came about from another DDOS-for-hire site, who as it turns out was simply reselling services provided by vDOS. They were far from the only one. vDOS appeared to provide firepower to a large number of different resellers.
In addition to the attack logs, support messages were also among the data stolen. This contained some complaints from various clients who complained they were unable to launch attacks against Israeli IPs. This is a common tactic by hackers to try and avoid unwanted attention from authorities in their country of residence. This was confirmed when two men from Israel were arrested for their involvement in owning and running vDOS. However, this was just the beginning for this bit of drama.
The two men arrested went by the handles "applej4ck" and "Raziel". They had recently published a paper on DDOS attack methods in an online Israeli security magazine. Interestingly, on the same day the men were arrested, questioned, and released on bail, vDOS went offline. Not because it had been taken down by Israeli authorities, not because they had shut it down themselves, but because a DDOS protection firm, BackConnect Security, had hijacked the IP addresses belonging to the company. To spare a lot of technical detail, it's called a BGP hijack, and it basically works by a company saying "Yeah, those are our addresses." It's kind of amazing how much of the internet is basically just secured by the digital equivalent of pinky swears. You can read some more technical detail on Wikipedia. Anyway, we'll get back to BackConnect.
Following the publication of the story uncovering the inner workings of vDOS, KrebsOnSecurity was hit with a record breaking DDOS attack, that peaked at 620/Gbps, nearly double the most powerful DDOS attack previously on record. To put that in perspective, that's enough bandwidth to download 5 simultaneous copies of Interstellar in 4K resolution every single second, and still have room to spare. The attack was so devastating, Akamai, one of the largest providers of DDOS protection in the world had to drop Krebs as a pro bono client. Luckily, Google was willing to step in and place his site under the protection of Google's Project Shield, a free service designed to protect the news sites and journalists from being knocked offline by DDOS attacks.
This attack was apparently in retaliation for the vDOS story, since some of the data sent in the attack included the string "freeapplej4ck". The attack was executed by a botnet of Internet of Things (or IoT) devices. These are those "smart" devices like camera systems, routers, DVRs. Basically things that connect to the cloud. An astounding amount of those are secured with default passwords that can be easily looked up from various sites or even the manufacturers' websites. This was the start of a discovery of a massive botnet that had been growing for years.
Now time for a couple quick side stories:
Dyn, a company who provides DNS to many major companies including Twitter, Reddit, and others came under attack, leaving many sites (including Twitter and Reddit) faltering in the wake of it. Potentially due to one of their engineers' collaboration with Krebs on another story. It turned out that the same botnet that attacked Krebs' site was at least part of the attack on Dyn
And back to BackConnect, that DDOS protection firm that hijacked the IP addresses from vDOS. Well it turns out BGP Hijacks are old hat for the company. They had done it at least 17 times before. Including at least once (purportedly with permission) for the address 1.3.3.7. Aka, "leet". It turns out one of the co-founders of BackConnect actually posted screenshots of him visiting sites that tell you your public IP address in a DDOS mitigation industry chat, showing it as 1.3.3.7. They also used a BGP Hijack against a hosting company and tried to frame a rival DDOS mitigation provider.
Finally, another provider, Datawagon was interestingly implicated in hosting DDOS-for-hire sites while offering DDOS protection. In a Skype conversation where the founder of Datawagon wanted to talk about that time he registered dominos.pizza and got sued for it, he brings up scanning the internet for vulnerable routers completely unprompted. Following the publication of the story about BackConnect, in which he was included in, he was incensed about his portrayal, and argued with Krebs over Skype before Krebs ultimately ended up blocking him. He was subsequently flooded with fake contact requests from bogus or hacked Skype accounts. Shortly thereafter, the record-breaking DDOS attack rained down upon his site.
Back to the main tale!
So, it turns out the botnet of IoT devices was puppeteered by a malware called Mirai. How did it get its name? Well, that's the name its creator gave it, after an anime called Mirai Nikki. How did this name come to light? The creator posted the source code online. (The name part, not the origin. The origin didn't come 'til later.) The post purported that they'd picked it up from somewhere in their travels as a DDOS industry professional. It turns out this is a semi-common tactic when miscreants fear that law enforcement might come looking for them, and having the only copy of the source code of a malware in existence is a pretty strong indicator that you have something to do with it. So, releasing the source to the world gives a veneer of plausible deniability should that eventuality come to pass. So who was this mysterious benefactor of malware source? They went by the name "Anna-senpai".
As research on the Mirai botnet grew, and more malware authors incorporated parts of Mirai's source code into their own attacks, attention on the botnet increased, and on the people behind it. The attention was presumably the reason why Hackforums, the forum where the source code was posted, later disallowed ostensible "Server Stress Tester" services from being sold on it. By December, "Operation Tarpit" had wrought 34 arrests and over a hundred "knock and talk" interviews questioning people about their involvement.
By January, things started to come crashing down. Krebs published an extensive exposé on Anna-senpai detailing all the evidence linking them to the creation of Mirai. The post was so big, he included a damn glossary. What sparked the largest botnet the internet had ever seen? Minecraft. Minecraft servers are big business. A popular one can earn tens of thousands of dollars per month from people buying powers, building space, or other things. It's also a fiercely competitive business, with hundreds of servers vying for players. It turns out that things may have started, as with another set of companies, two rival DDOS mitigation providers competing for customers. ProTraf was a provider of such mitigation technology, and a company whose owner later worked for ProTraf had on at least one occasion hijacked addresses belonging to another company, ProxyPipe. ProxyPipe had also been hit with DDOS attacks they suspected to be launched by ProTraf.
While looking into the President of ProTraf, Krebs realized he'd seen the relatively uncommon combination of programming languages and skills posted by the President somewhere else. They were shared by Anna-senpai on Hackforums. As Krebs dug deeper and deeper into Anna-senpai's online presence, he uncovered other usernames, including one he traced to some Minecraft forums where a photoshopped picture of a still from Pulp Fiction contained the faces of BackConnect, which was a rival to ProTraf's DDOS mitigation business, and another face. A hacker by the name of Vyp0r, who another employee of ProTraf claimed betrayed his trust and blackmailed him into posting the source of another piece of malware called Bashlite. There was also a third character photoshopped into the image. An anime character named "Yamada" from a movie called B Gata H Hei.
Interestingly, under the same username, Krebs found a "MyAnimeList" profile which, out of 9 titles it had marked as watched, were B Gata H Hei, as well as Mirai Nikki, the show from which Mirai derived its name. It continues on with other evidence, including DDOS attacks against Rutgers University, but in short, there was little doubt in the identity of "Anna-senpai", but the person behind the identity did contact Krebs to comment. He denied any involvement in Mirai or DDOS attacks.
"I don’t think there are enough facts to definitively point the finger at me," [Anna-senpai] said. "Besides this article, I was pretty much a nobody. No history of doing this kind of stuff, nothing that points to any kind of sociopathic behavior. Which is what the author is, a sociopath."
He did, however, correct Krebs on the name of B Gata H Kei.
Epilogue
Needless to say, the Mirai botnet crew was caught, but managed to avoid jailtime thanks to their cooperation with the government. That's not to say they went unpunished. Anna-senpai was sentenced to 6 months confinement, 2500 hours of community service, and they may have to pay up to $8.6 million in restitution for their attacks on Rutgers university.

Other Stories

I don't have the time or energy to write another effortpost, and as is I'm over 20,000 characters, so here's a few other tidbits of Krebs' clashes with miscreants.
submitted by HereComesMyDingDong to internetdrama [link] [comments]

The Problem with PoW

The Problem with PoW
Miners have always had it rough..
"Frustrated Miners"

The Problem with PoW
(and what is being done to solve it)

Proof of Work (PoW) is one of the most commonly used consensus mechanisms entrusted to secure and validate many of today’s most successful cryptocurrencies, Bitcoin being one. Battle-hardened and having weathered the test of time, Bitcoin has demonstrated the undeniable strength and reliability of the PoW consensus model through sheer market saturation, and of course, its persistency.
In addition to the cost of powerful computing hardware, miners prove that they are benefiting the network by expending energy in the form of electricity, by solving and hashing away complex math problems on their computers, utilizing any suitable tools that they have at their disposal. The mathematics involved in securing proof of work revolve around unique algorithms, each with their own benefits and vulnerabilities, and can require different software/hardware to mine depending on the coin.
Because each block has a unique and entirely random hash, or “puzzle” to solve, the “work” has to be performed for each block individually and the difficulty of the problem can be increased as the speed at which blocks are solved increases.

Hashrates and Hardware Types

While proof of work is an effective means of securing a blockchain, it inherently promotes competition amongst miners seeking higher and higher hashrates due to the rewards earned by the node who wins the right to add the next block. In turn, these higher hash rates benefit the blockchain, providing better security when it’s a result of a well distributed/decentralized network of miners.
When Bitcoin first launched its genesis block, it was mined exclusively by CPUs. Over the years, various programmers and developers have devised newer, faster, and more energy efficient ways to generate higher hashrates; some by perfecting the software end of things, and others, when the incentives are great enough, create expensive specialized hardware such as ASICs (application-specific integrated circuit). With the express purpose of extracting every last bit of hashing power, efficiency being paramount, ASICs are stripped down, bare minimum, hardware representations of a specific coin’s algorithm.
This gives ASICS a massive advantage in terms of raw hashing power and also in terms of energy consumption against CPUs/GPUs, but with significant drawbacks of being very expensive to design/manufacture, translating to a high economic barrier for the casual miner. Due to the fact that they are virtual hardware representations of a single targeted algorithm, this means that if a project decides to fork and change algorithms suddenly, your powerful brand-new ASIC becomes a very expensive paperweight. The high costs in developing and manufacturing ASICs and the associated risks involved, make them unfit for mass adoption at this time.
Somewhere on the high end, in the vast hashrate expanse created between GPU and ASIC, sits the FPGA (field programmable gate array). FPGAs are basically ASICs that make some compromises with efficiency in order to have more flexibility, namely they are reprogrammable and often used in the “field” to test an algorithm before implementing it in an ASIC. As a precursor to the ASIC, FPGAs are somewhat similar to GPUs in their flexibility, but require advanced programming skills and, like ASICs, are expensive and still fairly uncommon.

2 Guys 1 ASIC

One of the issues with proof of work incentivizing the pursuit of higher hashrates is in how the network calculates block reward coinbase payouts and rewards miners based on the work that they have submitted. If a coin generated, say a block a minute, and this is a constant, then what happens if more miners jump on a network and do more work? The network cannot pay out more than 1 block reward per 1 minute, and so a difficulty mechanism is used to maintain balance. The difficulty will scale up and down in response to the overall nethash, so if many miners join the network, or extremely high hashing devices such as ASICs or FPGAs jump on, the network will respond accordingly, using the difficulty mechanism to make the problems harder, effectively giving an edge to hardware that can solve them faster, balancing the network. This not only maintains the block a minute reward but it has the added side-effect of energy requirements that scale up with network adoption.
Imagine, for example, if one miner gets on a network all alone with a CPU doing 50 MH/s and is getting all 100 coins that can possibly be paid out in a day. Then, if another miner jumps on the network with the same CPU, each miner would receive 50 coins in a day instead of 100 since they are splitting the required work evenly, despite the fact that the net electrical output has doubled along with the work. Electricity costs miner’s money and is a factor in driving up coin price along with adoption, and since more people are now mining, the coin is less centralized. Now let’s say a large corporation has found it profitable to manufacture an ASIC for this coin, knowing they will make their money back mining it or selling the units to professionals. They join the network doing 900 MH/s and will be pulling in 90 coins a day, while the two guys with their CPUs each get 5 now. Those two guys aren’t very happy, but the corporation is. Not only does this negatively affect the miners, it compromises the security of the entire network by centralizing the coin supply and hashrate, opening the doors to double spends and 51% attacks from potential malicious actors. Uncertainty of motives and questionable validity in a distributed ledger do not mix.
When technology advances in a field, it is usually applauded and welcomed with open arms, but in the world of crypto things can work quite differently. One of the glaring flaws in the current model and the advent of specialized hardware is that it’s never ending. Suppose the two men from the rather extreme example above took out a loan to get themselves that ASIC they heard about that can get them 90 coins a day? When they join the other ASIC on the network, the difficulty adjusts to keep daily payouts consistent at 100, and they will each receive only 33 coins instead of 90 since the reward is now being split three ways. Now what happens if a better ASIC is released by that corporation? Hopefully, those two guys were able to pay off their loans and sell their old ASICs before they became obsolete.
This system, as it stands now, only perpetuates a never ending hashrate arms race in which the weapons of choice are usually a combination of efficiency, economics, profitability and in some cases control.

Implications of Centralization

This brings us to another big concern with expensive specialized hardware: the risk of centralization. Because they are so expensive and inaccessible to the casual miner, ASICs and FPGAs predominantly remain limited to a select few. Centralization occurs when one small group or a single entity controls the vast majority hash power and, as a result, coin supply and is able to exert its influence to manipulate the market or in some cases, the network itself (usually the case of dishonest nodes or bad actors).
This is entirely antithetical of what cryptocurrency was born of, and since its inception many concerted efforts have been made to avoid centralization at all costs. An entity in control of a centralized coin would have the power to manipulate the price, and having a centralized hashrate would enable them to affect network usability, reliability, and even perform double spends leading to the demise of a coin, among other things.
The world of crypto is a strange new place, with rapidly growing advancements across many fields, economies, and boarders, leaving plenty of room for improvement; while it may feel like a never-ending game of catch up, there are many talented developers and programmers working around the clock to bring us all more sustainable solutions.

The Rise of FPGAs

With the recent implementation of the commonly used coding language C++, and due to their overall flexibility, FPGAs are becoming somewhat more common, especially in larger farms and in industrial setting; but they still remain primarily out of the hands of most mining enthusiasts and almost unheard of to the average hobby miner. Things appear to be changing though, one example of which I’ll discuss below, and it is thought by some, that soon we will see a day when mining with a CPU or GPU just won’t cut it any longer, and the market will be dominated by FPGAs and specialized ASICs, bringing with them efficiency gains for proof of work, while also carelessly leading us all towards the next round of spending.
A perfect real-world example of the effect specialized hardware has had on the crypto-community was recently discovered involving a fairly new project called VerusCoin and a fairly new, relatively more economically accessible FPGA. The FPGA is designed to target specific alt-coins whose algo’s do not require RAM overhead. It was discovered the company had released a new algorithm, kept secret from the public, which could effectively mine Verus at 20x the speed of GPUs, which were the next fastest hardware types mining on the Verus network.
Unfortunately this was done with a deliberately secret approach, calling the Verus algorithm “Algo1” and encouraging owners of the FPGA to never speak of the algorithm in public channels, admonishing a user when they did let the cat out of the bag. The problem with this business model is that it is parasitic in nature. In an ecosystem where advancements can benefit the entire crypto community, this sort of secret mining approach also does not support the philosophies set forth by the Bitcoin or subsequent open source and decentralization movements.
Although this was not done in the spirit of open source, it does hint to an important step in hardware innovation where we could see more efficient specialized systems within reach of the casual miner. The FPGA requires unique sets of data called a bitstream in order to be able to recognize each individual coin’s algorithm and mine them. Because it’s reprogrammable, with the support of a strong development team creating such bitstreams, the miner doesn’t end up with a brick if an algorithm changes.

All is not lost thanks to.. um.. Technology?

Shortly after discovering FPGAs on the network, the Verus developers quickly designed, tested, and implemented a new, much more complex and improved algorithm via a fork that enabled Verus to transition smoothly from VerusHash 1.0 to VerusHash 2.0 at block 310,000. Since the fork, VerusHash 2.0 has demonstrated doing exactly what it was designed for- equalizing hardware performance relative to the device being used while enabling CPUs (the most widely available “ASICs”) to mine side by side with GPUs, at a profit and it appears this will also apply to other specialized hardware. This is something no other project has been able to do until now. Rather than pursue the folly of so many other projects before it- attempting to be “ASIC proof”, Verus effectively achieved and presents to the world an entirely new model of “hardware homogeny”. As the late, great, Bruce Lee once said- “Don’t get set into one form, adapt it and build your own, and let it grow, be like water.”
In the design of VerusHash 2.0, Verus has shown it doesn’t resist progress like so many other new algorithms try to do, it embraces change and adapts to it in the way that water becomes whatever vessel it inhabits. This new approach- an industry first- could very well become an industry standard and in doing so, would usher in a new age for proof of work based coins. VerusHash 2.0 has the potential to correct the single largest design flaw in the proof of work consensus mechanism- the ever expanding monetary and energy requirements that have plagued PoW based projects since the inception of the consensus mechanism. Verus also solves another major issue of coin and net hash centralization by enabling legitimate CPU mining, offering greater coin and hashrate distribution.
Digging a bit deeper it turns out the Verus development team are no rookies. The lead developer Michael F Toutonghi has spent decades in the field programming and is a former Vice President and Technical Fellow at Microsoft, recognized founder and architect of Microsoft's .Net platform, ex-Technical Fellow of Microsoft's advertising platform, ex-CTO, Parallels Corporation, and an experienced distributed computing and machine learning architect. The project he helped create employs and makes use of a diverse myriad of technologies and security features to form one of the most advanced and secure cryptocurrency to date. A brief description of what makes VerusCoin special quoted from a community member-
"Verus has a unique and new consensus algorithm called Proof of Power which is a 50% PoW/50% PoS algorithm that solves theoretical weaknesses in other PoS systems (Nothing at Stake problem for example) and is provably immune to 51% hash attacks. With this, Verus uses the new hash algorithm, VerusHash 2.0. VerusHash 2.0 is designed to better equalize mining across all hardware platforms, while favoring the latest CPUs over older types, which is also one defense against the centralizing potential of botnets. Unlike past efforts to equalize hardware hash-rates across different hardware types, VerusHash 2.0 explicitly enables CPUs to gain even more power relative to GPUs and FPGAs, enabling the most decentralizing hardware, CPUs (due to their virtually complete market penetration), to stay relevant as miners for the indefinite future. As for anonymity, Verus is not a "forced private", allowing for both transparent and shielded (private) transactions...and private messages as well"

If other projects can learn from this and adopt a similar approach or continue to innovate with new ideas, it could mean an end to all the doom and gloom predictions that CPU and GPU mining are dead, offering a much needed reprieve and an alternative to miners who have been faced with the difficult decision of either pulling the plug and shutting down shop or breaking down their rigs to sell off parts and buy new, more expensive hardware…and in so doing present an overall unprecedented level of decentralization not yet seen in cryptocurrency.
Technological advancements led us to the world of secure digital currencies and the progress being made with hardware efficiencies is indisputably beneficial to us all. ASICs and FPGAs aren’t inherently bad, and there are ways in which they could be made more affordable and available for mass distribution. More than anything, it is important that we work together as communities to find solutions that can benefit us all for the long term.

In an ever changing world where it may be easy to lose sight of the real accomplishments that brought us to this point one thing is certain, cryptocurrency is here to stay and the projects that are doing something to solve the current problems in the proof of work consensus mechanism will be the ones that lead us toward our collective vision of a better world- not just for the world of crypto but for each and every one of us.
submitted by Godballz to CryptoCurrency [link] [comments]

The chatlog from #lightning-network discussing recent Lightning DDOS/vulnerability

bitPico [5:49 PM] If any LN testers see their connection slots full it’s us. We will release the attack code when ready. The network needs better protection against DDoS’s. (edited)
Laolu Osuntokun [5:59 PM] ? or report to specific implementations @bitPico? like the early days of bitcoin, don't think many impls have even started to start to cover dos vectors busy working on safety in other aspects
bitPico [6:00 PM] As it stands no implementation can handle connection exhaustion attacks by overflowing the underlying TCP stack.
Laolu Osuntokun [6:00 PM] not sure if any limit inbound connections yet
bitPico [6:02 PM] Doesn’t matter; we use the TCP half-open attack. This occurs at the kernel.
Laolu Osuntokun [6:02 PM] sure you'd still run into fd limits so that's not really impl specific
bitPico [6:02 PM] Yes; we exhaust the FD’s. (edited)
Laolu Osuntokun [6:04 PM] you could do the same for any active bitcoin node today, nodes would need to set up network-level mitigations unless the impls were super low level enough to detect something like that so would really depend on their default kernel settings
Matt Drollette [6:10 PM] echo 1 > /proc/sys/net/ipv4/tcp_syncookies … ?
bitPico [6:14 PM] Our Bitcoin implementation performs round-robin disconnects to induce network churn. This is one of the best methods to prevent most TCP attacks. Churn is needed in decentralized systems. It keeps them robust. Longstanding TCP connections are bad. *ie we disconnect N nodes every T mins.
Laolu Osuntokun [6:18 PM] if it's half open, how are you detecting the TCP connections then @bitPico? well for LN the connections are typically long lived @mdrollette yeh, defenses are at the kernel lvl
bitPico [6:21 PM] Round-robin disconnects free the kernel FD’s. There is also App level half-connect Works like this Syn Ack But don’t sent the Ack The connection is then half-open TCP connect scans work like this. TCP half-open scans are harder to detect.
ɹɑd [6:33 PM] Is there a way to tell lnd to listen on ipv4 instead of ipv6? When I try lnd --listen=0.0.0.0:9735 ..., it is listening on IPv6 TCP *:9735 but I need it to listen on IPv4.
Matt Drollette [6:34 PM] I think if you give it a specific IP instead of 0.0.0.0 it will only bind to that specific interface
ɹɑd [6:34 PM] ok, trying that…
bitPico [6:36 PM] Dual-stack OS will still open IPv6 Windows and Linux are VERY different TCP stacks. The behaviour is different.
ɹɑd [6:38 PM] Nice, that worked. Thanks, @mdrollette
bitPico [7:13 PM] How does LN protect from “dead end packets”? ie* onion wrapped but final destination doesn’t exist. aka routing amplification attack
kekalot [7:14 PM] :trumpet::skull:
bitPico [7:16 PM] We will test it and perform a 100,000 route amplification. We are trying to make our test kit reusable as possible to work out the kinks. (edited)
kekalot [7:16 PM] :trumpet::skull:
bitPico [7:25 PM] Seeing bad OP-SEC on LN; don’t name your node as the type of hardware. Those raspberry pi’s will go down.
kekalot [7:25 PM] :trumpet: :skull:
camelCase [7:26 PM] :joy:
bitPico [7:26 PM] ie* eclair.raspberry.pi
Abhijeet singh [8:05 PM] joined #lightning-network.
bitPico [8:48 PM] https://gist.github.com/anonymous/46f6513625579c5a920fe04b32103a03 Already running some custom attack vectors on LN nodes to see how they standup.
Sun Mar 18 23:49:08 [INFO] - open_tcp_transports: Preparing TCP connection to x.x.x.x:9735 for attack vector TCPHO. Sun Mar 18 23:49:08 [INFO] - open_tcp_transports: Preparing TCP connection to x.x.x.x:9735 for attack vector TCPHO. Sun Mar 18 23:49:08 [INFO] - open_tcp_transports: Preparing TCP connection to x.x.x.x:9735 for attack vector TCPHO. Sun Mar 18 23:49:08 [INFO] - open_tcp_transports: Preparing TCP connection to x.x.x.x:9735 for attack vector TCPHO. Sun Mar 18 23:49:08 [INFO] - open_tcp_transports: Preparing TCP connection to x.x.x.x:9735 for attack vector TCPHO. Sun Mar 18 23:49:08 [INFO] - open_tcp_transports: Preparing TCP connection to x.x.x.x:9735 for attack vector TCPHO. Sun Mar 18 23:49:08 [INFO] - open_tcp_transports: Preparing TCP connection to x.x.x.x:9735 for attack vector TCPHO. Sun Mar 18 23:49:08 [INFO] - open_tcp_transports: Preparing TCP connection to x.x.x.x:9735 for attack vector TCPHO. Sun Mar 18 23:49:08 [INFO] - open_tcp_transports: Preparing TCP connection to x.x.x.x:9735 for attack vector TCPHO. Sun Mar 18 23:49:08 [INFO] - open_tcp_transports: Preparing TCP connection to We expect to perfect this testsuite by the weekend with some very useable attack vectors Sun Mar 18 23:51:19 [INFO] - operator(): TCP connection to x.x.x.x:9735 success, sending attack payload. Sun Mar 18 23:51:19 [INFO] - operator(): TCP connection to x.x.x.x:9735 failed, message = Connection refused. Sun Mar 18 23:51:19 [INFO] - operator(): TCP connection to x.x.x.x:9735 success, sending attack payload. Sun Mar 18 23:51:19 [INFO] - operator(): TCP connection to x.x.x.x:9735 success, sending attack payload. Sun Mar 18 23:51:19 [INFO] - operator(): TCP connection to x.x.x.x:9735 success, sending attack payload. Sun Mar 18 23:51:19 [INFO] - operator(): TCP connection to x.x.x.x:9735 success, sending attack payload.
:+1: If you notice weird traffic it’s us.
bitPico [9:00 PM] We are most interested in our “route payload amplification” attack vector. This attack onion wraps payloads via hop by hop where the last hop is the first hop creating a self-denial of service where the LN nodes attack themselves after long route traversal. Exploiting the anonymous nature of onion routing allows no defense to the network. Anonymous routing in and of itself creates a situation where the network can get into an endless loop of self DDoS. Once we complete the entire message serialization routines and a deadline timer the TESTBED will run standalone continuously. Prob. only take another day to complete that. We are also making attack vectors as base classes so new ones can be easily created via overrides. *ie plugin-like attack vectors
Russell O'Connor [9:22 PM] https://lists.linuxfoundation.org/pipermail/lightning-dev/2015-August/000135.html
bitPico [9:26 PM] Yes; that idea and our attack vector(s) makes the entire network fall apart. We will prove this works. (edited) When nobody trusts nobody the network collapses. Low level attacks requiring no fees are easier however. (edited) There is nothing to prevent spoofing via replay of older packets. Because onion routing requires decryption (CPU Intensive) this can also be used to clog pathways with old payloads via CPU exhaustion. (edited) This is the real reason why ToR is so damn slow; it’s constantly attacked. It has nothing to do with end users actions.
Matt Drollette [9:34 PM] https://github.com/lightningnetwork/lnd/pull/761 GitHub Switch Persistence [ALL]: Forwarding Packages + Sphinx Replay Protection + Circuit Persistence by cfromknecht · Pull Request #761 · lightningnetwork/lnd This PR builds on #629, and integrates the changes with my more recent work on forwarding packages and batch-replay protection provided via pending changes to lightning-onion repo. Save one or two ...
bitPico [9:40 PM] (#)761 doesn’t impact our AV_03 It does however cause nodes to use more CPU and possibly go to disk per the notes. If LN nodes must go to disk this is bad. The slowest code pathways make the best AV’s.
bitPico [9:52 PM] CircuitKey’s are allocated “on the heap”. (edited) Underlying implementation would use malloc/realloc/free. Instead of RAII. This is asking for an overflow into unknown memory segments. We suggest stack only allocation. Memory on the stack is trivial to maintain; it has no holes; it can be mapped straight into the cache; it is attached on a per-thread basis. Memory in the heap is a heap of objects; it is more difficult to maintain; it can have holes.
Laolu Osuntokun [9:59 PM] @bitPico cpu usage is super minimal, this isn't tor so we're not relaying like gigabytes unknown memory segments? golang is a memory safe language stuff goes on the stack, then escape analysis is used to decide what should go on the heap
bitPico [10:00 PM] Heap allocation is more of a concern here. golang is not memory safe; it uses C underneath.
Laolu Osuntokun [10:01 PM] uhh
bitPico [10:01 PM] golang is not written in golang :slightly_smiling_face:
Laolu Osuntokun [10:01 PM] yes it is... https://github.com/golang/go/blob/mastesrc/runtime/map.go GitHub golang/go go - The Go programming language
bitPico [10:02 PM] That’s like saying the C runtime is C and not ASM. The C runtime is ASM.
Laolu Osuntokun [10:02 PM] go is written in go before go 1.4 (maybe 1.5) is was written in c but still, your "attack vector" isn't an implementation level issue, it's a network/kernel level DoS recycling, syn cookies, etc, would be needed not impl level defenses (edited)
bitPico [10:07 PM] We know the answer but what does golang compile to?
Laolu Osuntokun [10:07 PM] also replay htlc's will be rejected native?
bitPico [10:08 PM] ASM
Laolu Osuntokun [10:08 PM] yeh...
bitPico [10:08 PM] So what we said is exactly true.
Laolu Osuntokun [10:08 PM] no?
bitPico [10:08 PM] It’s as vulnerable as we stated.
Laolu Osuntokun [10:08 PM]
the heap is a heap of objects; it is more difficult to maintain; it can have holes
bitPico [10:09 PM] It still allocates through OS heap memory and not onto the stack in your case here. Which means it has holes.
Laolu Osuntokun [10:10 PM] aight, lemmie know when you exploit these issues in the golang runtime here's the code if you wanna study it: https://github.com/golang/go/ GitHub golang/go go - The Go programming language
bitPico [10:11 PM] ASM is ASM. Heap is heap. Heap is bad in this case. Stack is wise. Same applies to C or C++. Avoid the heap at all costs.
Laolu Osuntokun [10:12 PM] aye aye, capt
stark [10:12 PM] replied to a thread: Seeing bad OP-SEC on LN; don’t name your node as the type of hardware. Those raspberry pi’s will go down. don't name your node at all....
bitPico [10:12 PM] https://www.cs.ru.nl/E.Poll/hacking/slides/hic4.pdf
Laolu Osuntokun [10:13 PM] cool, i'll be waiting on those exploits in the go runtime, i'm sure many others will be excited as well
bitPico [10:14 PM] Has nothing to do with go. It uses malloc underneath. Heap always uses malloc; go, c or c++ or java or whatever.
Laolu Osuntokun [10:15 PM] sure, i think many of us know how memory management works
bitPico [10:15 PM] http://security.cs.rpi.edu/courses/binexp-spring2015/lectures/17/10_lecture.pdf Security experts avoid heap allocation. This is common knowledge. Noticed somebody commented about performance of the PR. That is because of the use of heap allocation instead of stack.
Laolu Osuntokun [10:17 PM] no, it's because of the disk I/O
bitPico [10:18 PM] So LN nodes write data to disk in case of crash? As to not lose funds? That’s what the PR says. Anyway golang uses libc; it is not compiled into pure ASM. (edited) Nevertheless we are not focusing on golang; LN in general and TCP/IP stacks.
ɹɑd [10:22 PM] @bitPico write an exploit and get back with us. Until then it just sounds like concern trolling.
bitPico [10:24 PM] Funny, we are exhausting LN TCP/IP Stacks as we type this… It’s no good if we can overtake the TCP stack and run it out of FD’s. We have 100's of connections to LN nodes and it;s automated using our hand built attack toolkit. When we increase this to 1000's then what?
Matt Drollette [10:26 PM] Isn’t that true of any TCP service though? Or are you saying there is something Lightning or lnd specific about your method?
Laolu Osuntokun [10:26 PM] it's true of any TCP service the defenses are on the kernel level
bitPico [10:27 PM] You’d need to have LN code handle millions of connections to mitigate this. We know golang will crash if this happens. But so will C.
Matt Drollette [10:29 PM] I’m beginning to wonder if @bitPico is actually performing a meta-attack on Lightning. A denial-of-service at the developer level with all this subtle trolling
bitPico [10:29 PM] This first problem is LN keeps inbound connections alive. It does not handle and drop them like a webserver. This is the only reason webservers can scale. Apache uses a timeout of 3 seconds in most cases. Currently we are connected to 45 LN nodes with over 22K connections. One variable change on our end and the network will suffer. (edited)
Matt Drollette [10:31 PM] but is that variable on the heap?
bitPico [10:32 PM] On Linux consider forcing it to require 999999 FD’s. AND do not keep-alive connections. The variable is an enum (an integer). Attack aggressiveness
Matt Drollette [10:33 PM] I’m just joking with you :stuck_out_tongue: I look forward to the write-up on the attack
bitPico [10:33 PM] Otherwise our code will keep LN nodes hung in TIME_WAIT. Anyway we are not trolling; we are BTC whales and LN must not fail. Otherwise our investment suffers. The only motivation behind this testing… As it stands LN nodes need L7 LB. Code will run overnight; sleep before we continue. Good job though on LN so far.
bitPico [10:46 PM] uploaded and commented on this image: Screen Shot 2018-03-19 at 1.44.19 AM.png
Fun stats: We’ve sucked 3.3 GB’s of bandwidth per hour from LN nodes. This will continue while we sleep. Every 80 milliseconds there is 44 attacks being performed.
bitPico [10:48 PM] :sleeping:
kekalot [1:35 AM] Seems likely. They were also the one who claimed segwit 2x would continue after it was officially canceled. Matt Drollette I’m beginning to wonder if @bitPico is actually performing a meta-attack on Lightning. A denial-of-service at the developer level with all this subtle trolling Posted in #lightning-network Mar 18th
bitcoinhunter [3:07 AM] So you put down the network @bitPico or just DDosing dev`s time ?
kekalot [3:08 AM] technically youd need multiple people to be doing it to be considered DDoS this is just DoS
Mike Rizzo [7:57 AM] joined #lightning-network.
Alphonse Pace [8:31 AM] bitpico: are you bragging about attacking computer networks on here?
Bear Shark [9:54 AM] That was the funnest 5 minutes of my life. Watching a guy go from bragging about attempting a DoS to deleting the account.
aceat64 [9:56 AM] Reporting an attack vector is fine, releasing PoC code is fine, but actually DoSing a network is a crime, and to just go online and brag about it, wow The only way that could have been worse would be if they didn't use a pseudonym
Bear Shark [9:58 AM] It's fine. He was probably sitting behind 3 tor exits and 10 VPNs (edited)
chek2fire [10:09 AM] i see c-lightning is always at 80% cpu usage
Russell O'Connor [10:12 AM] Did bitPico delete their own account themselves?
kekalot [10:26 AM] @alp?
Alphonse Pace [10:27 AM] I banned. zero tolerance for illegal shit.
chek2fire [10:29 AM] and he says hitler is alive :stuck_out_tongue:
chek2fire [10:43 AM] i dont know why but the new version of lightning-c has a huge cpu usage (edited)
chek2fire [11:06 AM] is there possible not compatibility from lnd to c-lightning? i just connect bitrefil and they say that in their lnd node bitrefill payments works in my c-lightning is not working when i try to do a payment with their ln links i always get this "code" : 205, "message" : "Could not find a route", "data" : { "getroute_tries" : 2, "sendpay_tries" : 1 } }
hkjn [12:00 PM] was that just-banned bitpico the same one as this one? https://lists.linuxfoundation.org/pipermail/bitcoin-segwit2x/2017-Novembe000689.html
Russell O'Connor [12:02 PM] I believe they claimed to be. It's hard to know for sure I guess.
Matt Drollette [12:03 PM] Lest we forget.
ASM is ASM. Heap is heap. Heap is bad in this case. Stack is wise. Avoid the heap at all costs. - bitPico
Laolu Osuntokun [1:48 PM] lmao
Sent from my Space Ship
pebble [4:52 PM] joined #lightning-network.
camelCase [10:28 PM] could be possible to run two lnd nodes in sync between them? i mean wallet-wise (edited)
Justin Camarena [8:02 AM] Bitrefill getting DDos'd lol that bitpico tho
Brandy Lee Camacho [8:21 AM] joined #lightning-network.
chek2fire [8:53 AM] my c-lightning node has very high cpu usage is always at 80% in the same time bitcoin node is at 15-17%
Gregory Sanders [8:58 AM] @chek2fire could be the gossip silliness that's being worked on, or bitPico :stuck_out_tongue: probably gossip inefficiency
chek2fire [8:59 AM] maybe someone dos my node i dont know
Laolu Osuntokun [11:46 AM] time to learn how to use iptables folks
Sent from my Space Ship (edited)
camelCase [11:50 AM] anyone knows if what i asked above is possible? like running two or more nodes that replicate the wallet so you avoid having your channels offline
gonzobon [11:55 AM] https://twitter.com/alexbosworth/status/976158861722726405 Alex Bosworth ☇@alexbosworth Lightning nodes are getting DDOS'ed, rumor is that someone from the 2x effort known as "BitPico" has taken credit for this. The Lightning services I've deployed have been attacked from the start, with botnets, etc. Deploying in adversarial conditions, decentralization is hard.
Twitter Mar 20th
camelCase [11:56 AM] well... at least we know we wasn't trolling about that lol
v33r [11:58 AM] https://twitter.com/alexbosworth/status/976158861722726405
gonzobon [11:59 AM] beat you to it @v33r_ :stuck_out_tongue:
Tomislav Bradarić [12:23 PM] something something good for bitcoin but really, better to see how sturdy things are now than when lightning starts getting adopted more, like how the last rise in popularity was at the same time as blockchain spam
gonzobon [12:28 PM] andreas put it in context as a good testing opp.
Hiro Protagonist [1:04 PM] I so wanna get my old sysasmin-devops team together to start running lightning nodes under these conditions. Every website is attacked relentlessly by DoS, spoofing, etc. Defences exist but you need skills to figure out what to do.
submitted by bitsko to btc [link] [comments]

Transcript of Open Developer Meeting in Discord - 7/19/2019

[Dev-Happy] BlondfrogsLast Friday at 3:58 PM
Hey everyone. The channel is now open for the dev meeting.
LSJI07 - MBITLast Friday at 3:58 PM
Hi
TronLast Friday at 3:59 PM
Hi all!
JerozLast Friday at 3:59 PM
:wave:
TronLast Friday at 3:59 PM
Topics: Algo stuff - x22rc, Ownership token for Restricted Assets and Assets.
JerozLast Friday at 4:00 PM
@Milo is also here from coinrequest.
MiloLast Friday at 4:00 PM
Hi :thumbsup:
Pho3nix Monk3yLast Friday at 4:00 PM
welcome, @Milo
TronLast Friday at 4:00 PM
Great.
@Milo Was there PRs for Android and iOS?
MiloLast Friday at 4:01 PM
Yes, I've made a video. Give me a second I'll share it asap.
JerozLast Friday at 4:02 PM
I missed the iOS one.
MiloLast Friday at 4:02 PM
Well its 1 video, but meant for all.
JerozLast Friday at 4:02 PM
Ah, there's an issue but no pull request (yet?)
https://github.com/RavenProject/ravenwallet-ios/issues/115
[Dev-Happy] BlondfrogsLast Friday at 4:03 PM
nice @Milo
MiloLast Friday at 4:04 PM
Can it be that I have no video post rights?
JerozLast Friday at 4:05 PM
In discord?
MiloLast Friday at 4:05 PM
yes?
[Dev-Happy] BlondfrogsLast Friday at 4:05 PM
just a link?
JerozLast Friday at 4:05 PM
Standard version has a file limit afaik
Pho3nix Monk3yLast Friday at 4:05 PM
try now
gave permissions
MiloLast Friday at 4:05 PM
it's not published yet on Youtube, since I didn't knew when it would be published in the wallets
file too big. Hold on i'll put it on youtube and set it on private
LSJI07 - MBITLast Friday at 4:06 PM
no worries ipfs it...:yum:
Pho3nix Monk3yLast Friday at 4:06 PM
ok, just send link when you can
[Dev-Happy] BlondfrogsLast Friday at 4:07 PM
So guys. We released Ravencoin v2.4.0!
JerozLast Friday at 4:08 PM
If you like the code. Go update them nodes! :smiley:
[Dev-Happy] BlondfrogsLast Friday at 4:08 PM
We are recommending that you are upgrading to it. It fixes a couple bugs in the code base inherited from bitcoin!
MiloLast Friday at 4:08 PM
https://www.youtube.com/watch?v=t\_g7NpFXm6g&feature=youtu.be
sorry for the hold up
YouTube
Coin Request
Raven dev Gemiddeld
LSJI07 - MBITLast Friday at 4:09 PM
thanks short and sweet!!
KAwARLast Friday at 4:10 PM
Is coin request live on the android wallet?
TronLast Friday at 4:10 PM
Nice video.
It isn't in the Play Store yet.
Pho3nix Monk3yLast Friday at 4:10 PM
Well, this is the first time in a while where we have this many devs online. What questions do y'all have?
LSJI07 - MBITLast Friday at 4:11 PM
Algo questions?
Pho3nix Monk3yLast Friday at 4:11 PM
sure
KAwARLast Friday at 4:11 PM
KK
LSJI07 - MBITLast Friday at 4:12 PM
what are the proposed 22 algos in x22r? i could only find the original 16 plus 5 on x21.
TronLast Friday at 4:12 PM
Likely the 5 from x21 and find one more.
We need to make sure they're all similar in time profile.
liqdmetalLast Friday at 4:14 PM
should we bother fixing a asic-problem that we dont know exists for sure or not?
TronLast Friday at 4:14 PM
That's the 170 million dollar question.
[Dev-Happy] BlondfrogsLast Friday at 4:14 PM
I would prefer to be proactive not reactive.
imo
JerozLast Friday at 4:14 PM
same
LSJI07 - MBITLast Friday at 4:15 PM
RIPEMD160 is a golden oldie but not sure on hash speed compared to the others.
liqdmetalLast Friday at 4:15 PM
in my mind we should focus on the restricted messaging etc
Sevvy (y rvn pmp?)Last Friday at 4:15 PM
probably won't know if the action was needed until after you take the action
liqdmetalLast Friday at 4:15 PM
we are at risk of being interventionistas
acting under opacity
TronLast Friday at 4:15 PM
Needs to spit out at least 256 bit. Preferably 512 bit.
LSJI07 - MBITLast Friday at 4:15 PM
ok
TronLast Friday at 4:15 PM
If it isn't 512 bit, it'll cause some extra headache for the GPU mining software.
liqdmetalLast Friday at 4:16 PM
i seek to avoid iatrogenics
TronLast Friday at 4:16 PM
Similar to the early problems when all the algos except the first one were built for 64-bytes (512-bit) inputs.
Had to look that one up. TIL iatrogenics
JerozLast Friday at 4:17 PM
I have to google most of @liqdmetal's vocabulary :smile:
liqdmetalLast Friday at 4:17 PM
@Tron tldr: basically the unseen, unintended negative side effects of the asic "cure"
Sevvy (y rvn pmp?)Last Friday at 4:18 PM
10 dolla word
liqdmetalLast Friday at 4:19 PM
we need a really strong case to intervene in what has been created.
TronLast Friday at 4:19 PM
I agree. I'm less concerned with the technical risk than I am the potential split risk experienced multiple times by Monero.
Sevvy (y rvn pmp?)Last Friday at 4:20 PM
tron do you agree that forking the ravencoin chain presents unique risks compared to other chains that aren't hosting assets?
JerozLast Friday at 4:21 PM
Yes, if you fork, you need to figure out for each asset which one you want to support.
Sevvy (y rvn pmp?)Last Friday at 4:21 PM
yeah. and the asset issuer could have a chain preference
TronLast Friday at 4:22 PM
@Sevvy (y rvn pmp?) Sure. Although, I'd expect that the asset issuers will be honor the assets on the dominant chain. Bigger concern is the branding confusion of multiple forks. See Bitcoin, Bitcoin Cash, Bitcoin SV for an example. We know they're different, but do non-crypto folks?
Hans_SchmidtLast Friday at 4:22 PM
I thought that the take-away from the recently published analyses and discussions was that ASICs for RVN may be active, but if so then they are being not much more effective than GPUs.
Sevvy (y rvn pmp?)Last Friday at 4:22 PM
agreed on all accounts there tron
TronLast Friday at 4:23 PM
I'm not yet convinced ASICs are on the network.
KAwARLast Friday at 4:23 PM
It would be better to damage an asic builder by forking after they made major expenses. Creating for them the type of deficit that could be negated by just buying instead of mining. Asic existence should be 100 percent confirmed before fork.
liqdmetalLast Friday at 4:23 PM
170million dollar question is right.lol
TronLast Friday at 4:24 PM
I've had someone offer to connect me to the folks at Fusion Silicon.
Sevvy (y rvn pmp?)Last Friday at 4:25 PM
yes. and if they are active on the network they are not particularly good ASICs
which makes it a moot point probably
TronLast Friday at 4:26 PM
The difficult part of this problem is that by the time everyone agrees that ASICs are problematic on the network, then voting the option in is likely no longer an option.
Sevvy (y rvn pmp?)Last Friday at 4:26 PM
yes. part of me wonders if we would say "okay, the clock on the asic countdown is reset by this new algo. but now the race is on"
[Dev-Happy] BlondfrogsLast Friday at 4:26 PM
There are always risks when making a change that will fork the network. We want wait to long though, as tron said. It wont be a voting change. it will be a mandatory change at a block number.
Sevvy (y rvn pmp?)Last Friday at 4:26 PM
acknowledge the inevitable
MiloLast Friday at 4:27 PM
I had just a small question from my side. When do you think the android version would be published, and do you maybe have a time-frame for the others?
TronLast Friday at 4:27 PM
Quick poll. How would everyone here feel about a BIP9 option - separate from the new features that can be voted in?
KAwARLast Friday at 4:27 PM
Maybe voting should not be a strictly blockchain vote. A republic and a democratic voice?
[Dev-Happy] BlondfrogsLast Friday at 4:27 PM
@Milo We can try and get a beta out next week, and publish soon after that.
MiloLast Friday at 4:28 PM
@[Dev-Happy] Blondfrogs :thumbsup::slight_smile:
[Dev-Happy] BlondfrogsLast Friday at 4:28 PM
BIP9 preemptive vote. I like it.
TronLast Friday at 4:30 PM
The advantage to a BIP9 vote is that it puts the miners and mining pools at a clear majority before activation.
LSJI07 - MBITLast Friday at 4:30 PM
Centralisation is inevitable unless we decide to resist it. ASIC's are market based and know the risks and rewards possible. A key step in resisting is sending a message. An algo change to increase asic resistance is imho a strong message. A BIP9 vote now would also be an indicator of bad actors early....
TronLast Friday at 4:30 PM
The disadvantage is that it may not pass if the will isn't there.
LSJI07 - MBITLast Friday at 4:30 PM
Before assets are on main net and cause additional issues.
KAwARLast Friday at 4:31 PM
I am not schooled in coding to have an educated voice. I only understand social problems and how it affects the economy.
SpyderDevLast Friday at 4:31 PM
All are equal on RVN
TronLast Friday at 4:31 PM
It is primarily a social problem. The tech change is less risky and is easier than the social.
LSJI07 - MBITLast Friday at 4:32 PM
All can have a share....people who want more of a share however pay for the privilege and associated risks.
KAwARLast Friday at 4:33 PM
Assets and exchange listings need to be consistent and secure.
brutoidLast Friday at 4:36 PM
I'm still not entirely clear on what the overall goal to the algo change is? Is it just to brick the supposed ASICs (unknown 45%) which could still be FPGAs as seen from the recent block analysis posted in the nest. Is the goal to never let ASICs on? Is it to brick FPGAs ultimately. Are we making Raven strictly GPU only? I'm still unclear
LSJI07 - MBITLast Friday at 4:37 PM
What about the future issue of ASICs returning after a BIP9 fork "soon"? Are all following the WP as a community? i.e asic resistant or are we prepared to change that to asic resistant for early coin emission. Ideally we should plan for the future. Could the community make a statement that no future algo changes will be required to incentivise future public asic manufacturers?
Lol. Same question @brutoid
brutoidLast Friday at 4:37 PM
Haha it is
You mind-beamed me!
[Dev-Happy] BlondfrogsLast Friday at 4:38 PM
The is up to the community.
Currently, the feel seems like the community is anti asic forever.
The main issue is getting people to upgrade.
KAwARLast Friday at 4:38 PM
Clarity is important. Otherwise we are attacking windmills like Don Quixote.
brutoidLast Friday at 4:39 PM
I'm not getting the feeling of community ASIC hate if the last few weeks of discussion are anything to go by?
Hans_SchmidtLast Friday at 4:39 PM
A unilateral non-BIP9 change at a chosen block height is a serious thing, but anti-ASIC has been part of the RVN philosophy since the whitepaper and is therefore appropriate for that purpose.
[Dev-Happy] BlondfrogsLast Friday at 4:39 PM
We can use the latest release as an example. It was a non forking release, announced for 2 weeks. and only ~30% of the network has upgraded.
TronLast Friday at 4:39 PM
@Hans_Schmidt Well said.
liqdmetalLast Friday at 4:40 PM
I'm not concerned about a "asic hardware problem" so much as I believe it more likely what we are seeing is several big fish miners (perhaps a single really big fish). For now I recommend standing pat on x16r. In the future I can see an algo upgrade fork to keep the algo up to date. If we start fighting against dedicated x16r hashing machines designed and built to secure our network we are more likely to go down in flames. The custom SHA256 computers that make the bitcoin the most secure network in existence are a big part of that security. If some party has made an asic that performs up to par or better than FPGA or GPU on x16r, that is a positive for this network, a step towards SHA256 security levels. It is too bad the community is in the dark regarding their developments. Therefore I think the community has to clarify its stance towards algorithm changes. I prefer a policy that will encourage the development of mining software, bitstreams and hardware by as many parties as possible. The imminent threat of ALGO fork screws the incentive up for developers.
JerozLast Friday at 4:40 PM
@brutoid the vocal ones are lenient towards asics, but the outcome of the 600+ votes seemed pretty clear.
brutoidLast Friday at 4:40 PM
This is my confusion
TronLast Friday at 4:41 PM
More hashes are only better if the cost goes up proportionally. Machines that do more hashes for less $ doesn't secure the network more, and trends towards centralization.
JerozLast Friday at 4:41 PM
I would argue for polling ever so often as it certainly will evolve dynamically with the state of crypto over time.
TronLast Friday at 4:41 PM
Measure security in two dimensions. Distribution, and $/hash.
liqdmetalLast Friday at 4:41 PM
and volume of hash
traysiLast Friday at 4:42 PM
45% of the hashrate going to one party is unhealthy, and standing pat on x16r just keeps that 45% where it is.
TronLast Friday at 4:42 PM
Volume doesn't matter if the cost goes down. For example, lets say software shows up that does 1000x better than the software from yesterday, and everyone moves to it. That does not add security. Even if the "difficulty" and embedded hashes took 1000x more attempts to find.
brutoidLast Friday at 4:42 PM
My issue is defintely centralization of hash and not so much what machine is doing it. I mine with both GPU and FPGA. Of course, the FPGAs are not on raven
TJayLast Friday at 4:44 PM
easy solution is just to replace a few of 16 current hash functions, without messing with x21r or whatever new shit
TronLast Friday at 4:44 PM
How do folks here feel about allowing CPUs back in the game?
traysiLast Friday at 4:44 PM
Botnets is my concern with CPUs
brutoidLast Friday at 4:44 PM
Botnets is my concern
SpyderDevLast Friday at 4:44 PM
Yes please.
LSJI07 - MBITLast Friday at 4:44 PM
the poll votes seem not very security conscious. More of day miners chasing profits. I love them bless! Imho the future is bright for raven, however these issues if not sorted out now will bite hard long term when asset are on the chain and gpu miners are long gone.....
ZaabLast Friday at 4:45 PM
How has the testing of restricted assets been on the test net?
liqdmetalLast Friday at 4:45 PM
Agreed. I dont think x16r is obsolete like that yet however
[Dev-Happy] BlondfrogsLast Friday at 4:45 PM
@Zaab not enough testing at the moment.
HedgerLast Friday at 4:45 PM
Yes, how is the Testing going?
justinjjaLast Friday at 4:45 PM
Like randomX or how are cpus going to be back in the game?
TronLast Friday at 4:45 PM
@Zaab Just getting started at testing at the surface level (RPC calls), and fixing as we go.
ZaabLast Friday at 4:45 PM
And or any updates on the review of dividend code created by the community
Lokar -=Kai=-Last Friday at 4:45 PM
if the amount of hash the unknown pool has is fixed as standarderror indicated then waiting for the community of FPGAers to get onto raven might be advantageous if the fork doesn't hurt FPGAs.
ZaabLast Friday at 4:45 PM
Can't rememeber who was on it
SpyderDevLast Friday at 4:45 PM
@Zaab But we are working on it...
Lokar -=Kai=-Last Friday at 4:46 PM
more hash for votes
JerozLast Friday at 4:46 PM
@Maldon is, @Zaab
TronLast Friday at 4:46 PM
@Zaab There are unit tests and functional tests already, but we'd like more.
[Dev-Happy] BlondfrogsLast Friday at 4:46 PM
@Zaab Dividend code is currently adding test cases for better security. Should have more update on that next meeting
KAwARLast Friday at 4:46 PM
Absolute democracy seems to resemble anarchy or at least civil war. In EVE online they have a type of community voice that get voted in by the community.
ZaabLast Friday at 4:46 PM
No worries was just curious if it was going as planned or significant issues were being found
Obviously some hiccups are expected
More testing is always better!
TronLast Friday at 4:47 PM
Who in here is up for a good civil war? :wink:
ZaabLast Friday at 4:47 PM
Tron v Bruce. Celebrity fight night with proceeds to go to the RVN dev fund
SpyderDevLast Friday at 4:48 PM
Cagefight or mudpit?
JerozLast Friday at 4:48 PM
talking about dev funds..... :wink:
Pho3nix Monk3yLast Friday at 4:49 PM
and there goes the conversation....
KAwARLast Friday at 4:49 PM
I am trying to be serious...
ZaabLast Friday at 4:49 PM
Sorry back to the ascii topic!
traysiLast Friday at 4:49 PM
@Tron What do we need in order to make progress toward a decision on the algo? Is there a plan or a roadmap of sorts to get us some certainty about what we're going to do?
LSJI07 - MBITLast Friday at 4:50 PM
Could we have 3 no BIP9 votes? No1 Friendly to asics, retain status quo. No2 change to x17r minimal changes etc, with no additional future PoW/algo upgrades. No3. Full Asic resistance x22r and see what happens...
:thonk~1:
Sounds messy....
TronLast Friday at 4:51 PM
Right now we're in research mode. We're building CNv4 so we can run some metrics. If that goes well, we can put together x22rc and see how it performs. It will likely gore everyone's ox. CPUs can play, GPUs work, but aren't dominant. ASICs VERY difficult, and FPGAs will have a tough time.
ZaabLast Friday at 4:51 PM
Yeah i feel like the results would be unreliable
TronLast Friday at 4:51 PM
Is this good, or do we lose everyone's vote?
PlayHardLast Friday at 4:52 PM
Fpga will be dead
Lokar -=Kai=-Last Friday at 4:52 PM
why isn;t a simple XOR or something on the table?
ZaabLast Friday at 4:52 PM
The multiple bip9 that is
Lokar -=Kai=-Last Friday at 4:52 PM
something asic breaking but doesn't greatly complicate ongoing efforts for FPGA being my point.
justinjjaLast Friday at 4:52 PM
How are you going to vote for x22rc?
Because if by hashrate that wouldn't pass.
traysiLast Friday at 4:52 PM
Personally I like the idea of x22rc but I'd want to investigate the botnet threat if CPUs are allowed back in.
TronLast Friday at 4:52 PM
XOR is on the table, and was listed in my Medium post. But, the social risk of chain split remains, for very little gain.
traysiLast Friday at 4:53 PM
@Lokar -=Kai=- A small change means that whoever has 45% can probably quickly adapt.
LSJI07 - MBITLast Friday at 4:53 PM
Research sounds good. x22rc could be reduce to x22r for simplicity...
TronLast Friday at 4:53 PM
x22r is a viable option. No CNv4.
LSJI07 - MBITLast Friday at 4:53 PM
Don't know how much time we have to play with though...
Lokar -=Kai=-Last Friday at 4:53 PM
if they have FPGAs yes if they have ASIC then not so much, but I guess that gets to the point, what exactly are we trying to remove from the network?
PlayHardLast Friday at 4:54 PM
Guys my name is Arsen and we designed x16r fpga on bcus. Just about to release it to the public. I am buzzdaves partner.
Cryptonight
Will kill us
But agreed
Asic is possible on x16r
And you dont need 256 core
Cores
traysiLast Friday at 4:55 PM
Hi Arsen. Are you saying CN will kill "us" meaning RVN, or meaning FPGA?
JerozLast Friday at 4:55 PM
This is what im afraid of ^ an algo change killing FPGA as I have the feeling there is a big fpga community working on this
PlayHardLast Friday at 4:55 PM
Fpgas ))
whitefire990Last Friday at 4:55 PM
I am also about to release X16R for CVP13 + BCU1525 FPGA's. I'm open to algo changes but I really don't believe in CPU mining because of botnets. Any CNv4 shifts 100% to CPU mining, even if it is only 1 of the 22 functions.
Lokar -=Kai=-Last Friday at 4:55 PM
namely FPGAs that aren;t memory equipped
like fast mem
not ddr
PlayHardLast Friday at 4:55 PM
Hbm non hbm
Cryptonight
whitefire990Last Friday at 4:56 PM
Right now with both Buzzdave/Altered Silicon and myself (Zetheron) about to release X16R for FPGA's, then the 45% miner's share will decrease to 39% or less.
PlayHardLast Friday at 4:56 PM
Will be dead for fpga
LSJI07 - MBITLast Friday at 4:56 PM
sound so x22r is fpga "friendly" ... more so than asic anyway...
PlayHardLast Friday at 4:56 PM
But a change must be planned
X16r is no way possible to avoid asics
TJayLast Friday at 4:56 PM
@LSJI07 - MBIT I would say less friendly...
whitefire990Last Friday at 4:57 PM
As I mentioned in thenest discussion, asic resistance increases with the square of the number of functions, so X21R is more asic resistant than X16R, but both are pretty resistant
PlayHardLast Friday at 4:58 PM
Yeah more algos make it heavier on ASIC
DirkDiggler (Citadel Architect)Last Friday at 4:58 PM
My interpretation of the whitepaper was that we used x16r as it was brand new (thus ASIC resistant), and that was to ensure a fair launch... We've launched... I don't like the idea of constantly forking to avoid the inevitable ASICs.
x16r was a great "experiment" before we had any exchange listings... that ship has sailed though... not sure about all these x22rs lmnop changes
KAwARLast Friday at 5:00 PM
I believe that it is easier to change the direction of a bicycle than an oil tanker. We feel more like a train. We should lay out new tracks and test on them and find benefits that are acceptable to everyone except train robbers. Then open the new train station with no contentious feelings except a silently disgruntled minority group. ???
Hans_SchmidtLast Friday at 5:01 PM
The most productive action the community can do now re ASICs is to voice support for the devs to make a non-BIP9 change at a chosen block height if/when the need is clear. That removes the pressure to act rashly to avoid voting problems.
LSJI07 - MBITLast Friday at 5:01 PM
Thats why im proposing to fork at least once to a more asic resistant algo (but FPGA "friendly/possible"), with the proviso ideally that no more PoW algo forks are require to provide future ASICs some opportunity to innovate with silicon and efficiency.
TJayLast Friday at 5:01 PM
folks should take into account, that high end FPGAs like BCU1525 on x16r can't beat even previous gen GPUs (Pascal) in terms of hash cost. so they aren't a threat to miners community
PlayHardLast Friday at 5:02 PM
A proper change
Requires proper research
eyz (Silence)Last Friday at 5:02 PM
Just so I'm clear here, we are trying to boot ASICS, don't want CPUs because of Botnets, and are GPU and FPGA friendly right?
PlayHardLast Friday at 5:02 PM
It is not a quick one day process
eyz (Silence)Last Friday at 5:02 PM
If there is a bip9 vote there needs to be a clear explanation as I feel most in the community don't understand exactly what we are trying to fix
TronLast Friday at 5:03 PM
@Hans_Schmidt I like that route. It has some game theoretics. It gives time for miners to adapt. It is only used if needed. It reduces the likelihood of ASICs dominating the network, or even being built.
[Dev-Happy] BlondfrogsLast Friday at 5:03 PM
Hey guys. great convo. We are of course looking to do the best thing for the community and miner. We are going to be signing off here though.
justinjjaLast Friday at 5:03 PM
TJay that comes down to power cost.
If your paying 4c/kw gpus all the way.
But if your a home miner in europe an fpga is your only chance
LSJI07 - MBITLast Friday at 5:03 PM
@Hans_Schmidt How do we decide the block limit and when sufficient evidence is available? I would say we have had much compelling information to date...
[Dev-Happy] BlondfrogsLast Friday at 5:03 PM
Thanks for participating. and keep up the good work :smiley:
Have a good weekend.
CAWWWW
TronLast Friday at 5:03 PM
I haven't seen any compelling evidence of ASICs - yet.
Pho3nix Monk3yLast Friday at 5:03 PM
:v:
JerozLast Friday at 5:04 PM
I suggest to continue discussion in #development and #thenest :smiley:
thanks all!
TronLast Friday at 5:04 PM
Cheers everyone!
KAwARLast Friday at 5:04 PM
Agree with Hans.
DirkDiggler (Citadel Architect)Last Friday at 5:04 PM
thanks Tron
Pho3nix Monk3yLast Friday at 5:04 PM
Ending here. continue in Nest if wanted
DirkDiggler (Citadel Architect)Last Friday at 5:04 PM
I am waiting for compelling evidence myself.
submitted by mrderrik to Ravencoin [link] [comments]

CloudBots: Harvesting Crypto Coins Like a Botnet Farmer What are the 5 Elements of Creating a Cryptocurrency by Tom McMurrain FREE Monero botnet builder or setup your own hidden miner installer v3 (Update OCT 2018) Earn Free Bitcoin How to make a botnet/qbot with Putty Quick and Easy - YouTube

Creating Bitcoin trading bots don’t lose money. Let’s make cryptocurrency-trading agents using deep reinforcement learning. Adam King. Apr 27, 2019 · 14 min read. In this article we are going to create deep reinforcement learning agents that learn to make money trading Bitcoin. In this tutorial we will be using OpenAI’s gym and the PPO agent from the stable-baselines library, a fork of ... The advent of darknets, along with the popularization of cryptocurrencies, namely bitcoin, have helped hackers market their services, throughout the Creating a Bitcoin-Mining Botnet at No Cost. By Neil J . Rubenking. Aug. 7, 2014, 2:46 a.m. At the Black Hat 2014 conference in Las Vegas, Rob Ragan and Oscar Salazar, penetration testers from ... Creating a Bitcoin-Mining Botnet at No Cost. Bitcoins are valuable, in large part because mining for bitcoins takes a lot of resources. At Black Hat a pair of researchers demonstrated that it's ... Individuals, businesses, developers: learn from our simple Bitcoin guides. How Bitcoin works, what is Bitcoin, what is blockchain, how to buy Bitcoin, what is Bitcoin mining and more.

[index] [14920] [37132] [6008] [3781] [3659] [47740] [10832] [4025] [34601] [17052]

CloudBots: Harvesting Crypto Coins Like a Botnet Farmer

website : https://bit.ly/2Z2W7jM Install and earn free 10$ https://bit.ly/2JIeC4r Refer code 17H1Y1 bitcoin miner 2020, bitcoin miner app, bitcoin miner 2019... MasterMana BotNet Virus steals Cryptocurrency - MasterMana BotNet wants your Bitcoin - Duration: 8:26. Crypto Coin Investor 130 views. 8:26. 7) Soldering + Tools for (almost) ... Bitcoin Algo Trading and Market Making Seminar 22 Mar 2017 - Duration: 1:01:40. BitMEX 20,805 views. 1:01:40. TOP 5 Cryptocurrency Trading Bots - Crypto Trading Bot Review - Duration: 8:09. ... In this video I learn you how to build a botnet, or build and hide a personalised secret miner. I will give tips on how to spread your hidden miner This is for educational purposes only. With the ... In this video ima show you how to create a botnet/qbot with Putty fast and easy Subscribe to my youtube channel like and leave a comment. Download Link: Link...

#