DEF CON® Hacking Conference

Hijacking Bitcoin: Routing Attacks on Cryptocurrencies

arXiv:1605.07524
Date: 2017-03-24
Author(s): Maria Apostolaki, Aviv Zohar, Laurent Vanbever

Link to Paper


Abstract
As the most successful cryptocurrency to date, Bitcoin constitutes a target of choice for attackers. While many attack vectors have already been uncovered, one important vector has been left out though: attacking the currency via the Internet routing infrastructure itself. Indeed, by manipulating routing advertisements (BGP hijacks) or by naturally intercepting traffic, Autonomous Systems (ASes) can intercept and manipulate a large fraction of Bitcoin traffic. This paper presents the first taxonomy of routing attacks and their impact on Bitcoin, considering both small-scale attacks, targeting individual nodes, and large-scale attacks, targeting the network as a whole. While challenging, we show that two key properties make routing attacks practical: (i) the efficiency of routing manipulation; and (ii) the significant centralization of Bitcoin in terms of mining and routing. Specifically, we find that any network attacker can hijack few (<100) BGP prefixes to isolate ~50% of the mining power---even when considering that mining pools are heavily multi-homed. We also show that on-path network attackers can considerably slow down block propagation by interfering with few key Bitcoin messages. We demonstrate the feasibility of each attack against the deployed Bitcoin software. We also quantify their effectiveness on the current Bitcoin topology using data collected from a Bitcoin supernode combined with BGP routing data. The potential damage to Bitcoin is worrying. By isolating parts of the network or delaying block propagation, attackers can cause a significant amount of mining power to be wasted, leading to revenue losses and enabling a wide range of exploits such as double spending. To prevent such effects in practice, we provide both short and long-term countermeasures, some of which can be deployed immediately.

References
[1] “A Next-Generation Smart Contract and Decentralized Application Platform ,” https://github.com/ethereum/wiki/wiki/White-Paper.
[2] “Bitcoin Blockchain Statistics,” https://blockchain.info/.
[3] “bitnodes,” https://bitnodes.21.co/.
[4] “Bitnodes. Estimating the size of Bitcoin network,” https://bitnodes.21.co/.
[5] “CAIDA Macroscopic Internet Topology Data Kit.” https://www.caida.org/data/internet-topology-data-kit/.
[6] “Dyn Research. Pakistan hijacks YouTube.” http://research.dyn.com/2008/02/pakistan-hijacks-youtube-1/.
[7] “FALCON,” http://www.falcon-net.org/.
[8] “FIBRE,” http://bitcoinfibre.org/.
[9] “Litecoin ,” https://litecoin.org.
[10] “RIPE RIS Raw Data,” https://www.ripe.net/data-tools/stats/ris/ris-raw-data.
[11] “Routeviews Prefix to AS mappings Dataset (pfx2as) for IPv4 and IPv6.” https://www.caida.org/data/routing/routeviews-prefix2as.xml.
[12] “Scapy.” http://www.secdev.org/projects/scapy/.
[13] “The Relay Network,” http://bitcoinrelaynetwork.org/.
[14] “ZCash,” https://z.cash/.
[15] A. M. Antonopoulos, “The bitcoin network,” in Mastering Bitcoin. O’Reilly Media, Inc., 2013, ch. 6.
[16] H. Ballani, P. Francis, and X. Zhang, “A Study of Prefix Hijacking and Interception in the Internet,” ser. SIGCOMM ’07. New York, NY, USA: ACM, 2007, pp. 265–276.
[17] A. Boldyreva and R. Lychev, “Provable Security of S-BGP and Other Path Vector Protocols: Model, Analysis and Extensions,” ser. CCS ’12. New York, NY, USA: ACM, 2012, pp. 541–552.
[18] J. Bonneau, A. Miller, J. Clark, A. Narayanan, J. A. Kroll, and E. W. Felten, “Sok: Research perspectives and challenges for bitcoin and cryptocurrencies,” in Security and Privacy (SP), 2015 IEEE Symposium on. IEEE, 2015, pp. 104–121.
[19] P. Bosshart, D. Daly, G. Gibb, M. Izzard, N. McKeown, J. Rexford, C. Schlesinger, D. Talayco, A. Vahdat, G. Varghese et al., “P4: Programming protocol-independent packet processors,” ACM SIGCOMM Computer Communication Review, vol. 44, no. 3, pp. 87–95, 2014.
[20] C. Decker and R. Wattenhofer, “Information propagation in the bitcoin network,” in Peer-to-Peer Computing (P2P), 2013 IEEE Thirteenth International Conference on. IEEE, 2013, pp. 1–10.
[21] ——, Bitcoin Transaction Malleability and MtGox. Cham: Springer International Publishing, 2014, pp. 313–326. [Online]. Available: http://dx.doi.org/10.1007/978-3-319-11212-1_18
[22] M. Edman and P. Syverson, “As-awareness in tor path selection,” in Proceedings of the 16th ACM Conference on Computer and Communications Security, ser. CCS ’09, 2009.
[23] I. Eyal, “The miner’s dilemma,” in 2015 IEEE Symposium on Security and Privacy. IEEE, 2015, pp. 89–103.
[24] I. Eyal and E. G. Sirer, “Majority is not enough: Bitcoin mining is vulnerable,” in Financial Cryptography and Data Security. Springer, 2014, pp. 436–454.
[25] N. Feamster and R. Dingledine, “Location diversity in anonymity networks,” in WPES, Washington, DC, USA, October 2004.
[26] J. Garay, A. Kiayias, and N. Leonardos, “The bitcoin backbone protocol: Analysis and applications,” in Advances in Cryptology-EUROCRYPT 2015. Springer, 2015, pp. 281–310.
[27] A. Gervais, G. O. Karama, V. Capkun, and S. Capkun, “Is bitcoin a decentralized currency?” IEEE security & privacy, vol. 12, no. 3, pp. 54–60, 2014.
[28] A. Gervais, H. Ritzdorf, G. O. Karame, and S. Capkun, “Tampering with the delivery of blocks and transactions in bitcoin,” in Proceedings of the 22Nd ACM SIGSAC Conference on Computer and Communications Security, ser. CCS ’15. New York, NY, USA: ACM, 2015, pp. 692–705.
[29] P. Gill, M. Schapira, and S. Goldberg, “Let the Market Drive Deployment: A Strategy for Transitioning to BGP Security,” ser. SIGCOMM ’11. New York, NY, USA: ACM, 2011, pp. 14–25.
[30] S. Goldberg, M. Schapira, P. Hummon, and J. Rexford, “How Secure Are Secure Interdomain Routing Protocols,” in SIGCOMM, 2010.
[31] E. Heilman, A. Kendler, A. Zohar, and S. Goldberg, “Eclipse attacks on bitcoin’s peer-to-peer network,” in 24th USENIX Security Symposium (USENIX Security 15), 2015, pp. 129–144.
[32] Y.-C. Hu, A. Perrig, and M. Sirbu, “SPV: Secure Path Vector Routing for Securing BGP,” ser. SIGCOMM ’04. New York, NY, USA: ACM, 2004, pp. 179–192.
[33] J. Karlin, S. Forrest, and J. Rexford, “Pretty Good BGP: Improving BGP by Cautiously Adopting Routes,” in Proceedings of the Proceedings of the 2006 IEEE International Conference on Network Protocols, ser. ICNP ’06. Washington, DC, USA: IEEE Computer Society, 2006, pp. 290–299.
[34] E. K. Kogias, P. Jovanovic, N. Gailly, I. Khoffi, L. Gasser, and B. Ford, “Enhancing bitcoin security and performance with strong consistency via collective signing,” in 25th USENIX Security Symposium (USENIX Security 16). Austin, TX: USENIX Association, 2016, pp. 279–296.
[35] J. A. Kroll, I. C. Davey, and E. W. Felten, “The economics of bitcoin mining, or bitcoin in the presence of adversaries.” Citeseer.
[36] A. Miller, J. Litton, A. Pachulski, N. Gupta, D. Levin, N. Spring, and B. Bhattacharjee, “Discovering bitcoin’s public topology and influential nodes.”
[37] S. J. Murdoch and P. Zielinski, “Sampled traffic analysis by Internet- ´ exchange-level adversaries,” in Privacy Enhancing Technologies: 7th International Symposium, PET 2007, N. Borisov and P. Golle, Eds. Springer-Verlag, LNCS 4776, 2007, pp. 167–183.
[38] K. Nayak, S. Kumar, A. Miller, and E. Shi, “Stubborn mining: Generalizing selfish mining and combining with an eclipse attack,” IACR Cryptology ePrint Archive, vol. 2015, p. 796, 2015.
[39] T. Neudecker, P. Andelfinger, and H. Hartenstein, “A simulation model for analysis of attacks on the bitcoin peer-to-peer network,” in IFIP/IEEE International Symposium on Internet Management. IEEE, 2015, pp. 1327–1332.
[40] P. v. Oorschot, T. Wan, and E. Kranakis, “On interdomain routing security and pretty secure bgp (psbgp),” ACM Trans. Inf. Syst. Secur., vol. 10, no. 3, Jul. 2007.
[41] A. Pilosov and T. Kapela, “Stealing The Internet. An Internet-Scale Man In The Middle Attack.” DEFCON 16.
[42] Y. Rekhter and T. Li, A Border Gateway Protocol 4 (BGP-4), IETF, Mar. 1995, rFC 1771.
[43] M. Rosenfeld, “Analysis of hashrate-based double spending,” arXiv preprint arXiv:1402.2009, 2014.
[44] A. Sapirshtein, Y. Sompolinsky, and A. Zohar, “Optimal selfish mining strategies in bitcoin,” CoRR, vol. abs/1507.06183, 2015.
[45] E. B. Sasson, A. Chiesa, C. Garman, M. Green, I. Miers, E. Tromer, and M. Virza, “Zerocash: Decentralized anonymous payments from bitcoin,” in 2014 IEEE Symposium on Security and Privacy. IEEE, 2014, pp. 459–474.
[46] B. Schlinker, K. Zarifis, I. Cunha, N. Feamster, and E. Katz-Bassett, “Peering: An as for us,” in Proceedings of the 13th ACM Workshop on Hot Topics in Networks, ser. HotNets-XIII. New York, NY, USA: ACM, 2014, pp. 18:1–18:7.
[47] J. Schnelli, “BIP 151: Peer-to-Peer Communication Encryption,” Mar. 2016, https://github.com/bitcoin/bips/blob/mastebip-0151.mediawiki.
[48] X. Shi, Y. Xiang, Z. Wang, X. Yin, and J. Wu, “Detecting prefix hijackings in the Internet with Argus,” ser. IMC ’12. New York, NY, USA: ACM, 2012, pp. 15–28.
[49] Y. Sompolinsky and A. Zohar, “Secure high-rate transaction processing in bitcoin,” in Financial Cryptography and Data Security. Springer, 2015, pp. 507–527.
[50] Y. Sun, A. Edmundson, L. Vanbever, O. Li, J. Rexford, M. Chiang, and P. Mittal, “RAPTOR: Routing attacks on privacy in TOR.” in USENIX Security, 2015.
[51] A. Tonk, “Large scale BGP hijack out of India,” 2015, http://www.bgpmon.net/large-scale-bgp-hijack-out-of-india/.
[52] ——, “Massive route leak causes Internet slowdown,” 2015, http://www.bgpmon.net/massive-route-leak-cause-internet-slowdown/.
[53] L. Vanbever, O. Li, J. Rexford, and P. Mittal, “Anonymity on quicksand: Using BGP to compromise TOR,” in ACM HotNets, 2014.
[54] Z. Zhang, Y. Zhang, Y. C. Hu, and Z. M. Mao, “Practical defenses against BGP prefix hijacking,” ser. CoNEXT ’07. New York, NY, USA: ACM, 2007.
[55] Z. Zhang, Y. Zhang, Y. C. Hu, Z. M. Mao, and R. Bush, “iSPY: Detecting IP prefix hijacking on my own,” IEEE/ACM Trans. Netw., vol. 18, no. 6, pp. 1815–1828, Dec. 2010.
submitted by dj-gutz to myrXiv [link] [comments]

Rambling incoherent musings. It's hard for me to put things into words when it's not a joke. But I'll try. This is not sentiment to be taken seriously.

There is no TL:DR. Call it a shitpost and skip if you don't want to read it.
Well....The way I see it...DeFcon 2 and the people sitting on some channels like this and the Ethereum forums are the ones that want to know the bleeding edge of Ethereum news. We are sitting in a circle. We're all sitting here in bewilderment. I'm blown away by what I'm reading. I can't even understand the technicals but I can see the vision. But we're just one big circle trying to put the pieces together.
I could care less about this stupid $1.50 move today. I'm not trader so please don't take offense. I know you are trying to feed your families and I want you to be great at this game. This post isn't about price really. If I had to, I couldn't imagine trading any of this right now. The writing is on the wall in pretty charts and candlestick thingys for you to decide if you think this platform is worth $13 today. I think you know the answer. There is going to be a green candle coming that is going to make that rise from $4 to $22 look like child's play. The billionaires are watching this shit. They are only talking about it but they are doing more talk than Bitcoin ever dreamed of. That's my feeling. They are whispering and waiting for each other to flinch like a Clint Eastwood movie. The Multi-Millionaires only whisper.
Those short time frame folks who worry about the price just remember we don't even have the final video or the Blockchain summit complete. We're getting bits of info from gracious correspondents and 100 character tweets. The damn summit couldn't even be streamed because China. I couldn't aggregate all the news in one read even if I tried....I'm very grateful to those who have posted cliff notes of what happened.
Speculators/Investors (that's me) I think some major shit is gonna happen to the price in 4-6 months once we get closer to POS (and beyond) and all the geniuses that got to hang out with each re-enter meetings with their ICO partners and take what was presented at DeFcon and reinvigorate their particular Dapp plans....
The attacks are being tamed immediately and really this is the best time for them to try. PLEASE keep trying. We NEED you to keep all of us with capabilities sharp as a razor to fix it. Don't bitch and whine when the price falls back to $12 again...please...bubbles within bubbles are gonna happen. Soon you'll be complaining it fell back to $22
Now...Go back 3 months...How many of those AWESOME developments we learned about were tight lipped between each of the companies leading up to DefCon? NDA's much? How many of these awesome developers were so wrapped up in their coding they didn't dare look up from the screen to do anything else. They had major deadlines to beat to get ready for DeFCon. I'm sure a fair amount of them anyway. Hats off to the focus and attention...and now this same small circle of people here on Reddit and elsewhere are probably scratching their heads on whole new ideas that bridge gaps. We are bridging gaps and we are a tiny group.
Synergy or maybe some clarity about the road (or whatever that word thingy) is...roadmap?...fuck I don't know....I'm not an intellectual. BUT ....I think that's whats coming in Q1/Q2 - 2017. I'll call it Ethergy.
If Vitalik is getting listed on Fortune and Businessweek in the same damn day that's gonna get some wigs thinking seriously about why they didn't give bitcoin a shot all those years ago. That team is a beast.
The door is opening to a new class of investors instead of just crypto geeks. The crazy amount of news in the last year is leaving me spellbound. 2017 will be more exciting than 2016 for a new group of people. Just like 2016 was more exciting for me than when I learned about Ethereum in 2015. I didn't buy the ICO and I'm a small time dude.
Hugs from KC...I'm just a crazy music teacher with a passion for the kitchen. I bring nothing technical table but proof of steak. You are my favorite people on Reddit. I hardly ever go to any other sub and just check the frontpage every now and then. Maybe it's a disease....Maybe its mETh. But I'm here and happy with what I'm reading.
I'm praying I get Vitalik to KC someday. Or any of those guys. I'm 35 minutes from the airport and I have a loving family in a modest home and it would be an honor to throw a meal on the pit and share the video with the Ethereum family. He's just eccentric enough to show up and chat between 2 ferns his philosophies outdoors.
I'd have to explain to my wife that a man like vbuterin/ wearing a unicorn shirt with donuts on the horn and a cat man-satchel is actually a very normal thing. After all, I did make a license plate for my car with his project's name.
Be good out there.
submitted by jtnichol to ethtrader [link] [comments]

'What's wrong with my current cold storage method?' - an examination of potential weaknesses in the most common cold storage methods

Today we are going to discuss cold storage and some specific problems with cold storage. While this applies directly to the Secret Key portion of a key-pair; it also applies to the seed used to back up HD wallets and hardware wallets.
The best way to keep you seed/secret key safe is to have multiple copies in multiple locations perhaps with multiple formats and even better if the keys are split. However not everyone has access to multiple locations, or access to land long term, or more than one place to store their things. This is an examination of faults with individual methods; and not a comprehensive plan, obviously.
Not to say everything is all bad but there are many potential weakness out there, and some in the Bitcoin and crypto community like to know the edge cases of things.
I will also highlight some of the aspects of the Keyois Capsule which is a 'physical bitcoin'.
A physical Bitcoin is a cryptographic key pair, a physical key printed and affixed to what has always been before a coin. The first physical bitcoin coin was the Casascius coin, since then the world of physical bitcoin coins has blossomed as a fun part of the Bitcoin world.
We will focus on mediums relating to cold storage and not ones designed for more everyday use, but this applies to the seed you save to keep your everyday spending wallets safe and backed up.
We will assume you generated your keys securely and that you already have them on some medium. We will also have to ignore endpoint physical security because they can all be carried away the same. Remember your cell phone /hardware wallet/ computer client are only as good as where you put the backup seed phrase, which can be thought of as data much like the SK discussed below.
Written on a piece of paper
Printed on a piece of paper
On laminated paper
Engraved / etched/ ablated/ stamped on a piece of metal
Stored digitally on a computer
Stored digitally on CD, floppy disk, laserdisc, or mini-disc
Stored digitally on a flash drive
Backups are essential for digital data Computer code for performing operations can be corrupted in transfer or in operation. Special systems exist and procedures help data to last longer. For ideas, see this archive.gov page Remember to store in multiple locations. You can lose everything in single structure
A physical bitcoin coin
**What can solve most of these problems? A combination of good backup procedures and encryption. **
If you have permeant access to more than one location (people who live in big cities, without family or cars have a hard time with this) or have people you trust with your money (don't) then look into using some form of Multi-signature option.
The Keyois Capsule is a crypto piggy bank; it can be funded from the outside but you to break it open to get them out. You give me a BIP38 encrypted key pair (well the address not the public key) and I engrave it in this tamper evident and time resistant package. You still have to hold on to the pass phrase that allows you to decrypt it; that is however the same problem as all methods with BIP38 encryption. How to store this without having to trust anyone but still being assured of it's security?
  • Engraving, embossing, or stamping on a sheet of metal is one option; however the metals that are easiest to stamp are ones that melt in a house fire. They could be put in a glass jar that's filled with aerogel and buried. These is the best readily available option for most people but it really can be tedious. - This puts you back at anyone who can see it can steal it so dip in plastic dip, wrap in duct tape, bake in clay, encase in concrete, whatever just don't leave unencrypted keys visible!
  • The cryptosteel is another ready-made option
  • Have the words etched onto glass at home with off the shelf products; but be carful of this idea because the glass can shatter from impact and heat or even sudden temperature changes
  • Anodize the words yourself on a pieces of metal, there used to be a service to help use your home printer to print the words with some chemicals you can buy
  • Bake them in clay, then encase that in epoxy resin so it can't shatter. then paint the outside, in the future you can solvent the paint off and see the written seed
  • Use a combination of techniques to split the seed so that it is safe(because split and separated) and redundant (because backed up).
The most cost effective way for a 'normal' person (without their own land, without more than one location, and who cannot trust anyone else with their funds) to keep their backup seed/ secret key safe from damage from the elements would probably to buy a stamping kit and hammer and some stainless steel sheet or bar, Aluminium can be okay if you have the right alloy but better safe than sorry.
submitted by ProfBitcoin to Bitcoin [link] [comments]

'What is wrong with my current cold storage method' - an examination of potential weaknesses in the most common cold storage methods

Today we are going to discuss cold storage and some specific problems with cold storage. While this applies directly to the Secret Key portion of a key-pair; it also applies to the seed used to back up HD wallets and hardware wallets.
Not to say everything is all bad but there are many potential weakness out there, and some in the Bitcoin and crypto community like to know the edge cases of things.
I will also highlight some of the aspects of the Keyois Capsule which is a 'physical bitcoin'.
A physical Bitcoin is a cryptographic key pair, a physical key printed and affixed to what has always been before a coin. The first physical bitcoin coin was the Casascius coin, since then the world of physical bitcoin coins has blossomed as a fun part of the Bitcoin world.
We will focus on mediums relating to cold storage and not ones designed for more everyday use, but this applies to the seed you save to keep your everyday spending wallets safe and backed up.
We will assume you generated your keys securely and that you already have them on some medium. We will also have to ignore endpoint physical security because they can all be carried away the same. Remember your cell phone /hardware wallet/ computer client are only as good as where you put the backup seed phrase, which can be thought of as data much like the SK discussed below.
Written on a piece of paper
Printed on a piece of paper
On laminated paper
Engraved / etched/ ablated/ stamped on a piece of metal
Stored digitally on a computer
Stored digitally on CD, floppy disk, laserdisc, or mini-disc
Stored digitally on a flash drive
Backups are essential for digital data Computer code for performing operations can be corrupted in transfer or in operation. Special systems exist and procedures help data to last longer. For ideas, see this archive.gov page Remember to store in multiple locations. You can lose everything in single structure
A physical bitcoin coin
What can solve most of these problems? A combination of good backup procedures and encryption.
If you have permeant access to more than one location (people who live in big cities, without family or cars have a hard time with this) or have people you trust with your money (don't) then look into using some form of Multi-signature option.
The Keyois Capsule is a crypto piggy bank; it can be funded from the outside but you to break it open to get them out. You give me a BIP38 encrypted key pair (well the address not the public key) and I engrave it in this tamper evident and time resistant package. You still have to hold on to the pass phrase that allows you to decrypt it; that is however the same problem as all methods with BIP38 encryption. How to store this without having to trust anyone but still being assured of it's security?
  • Engraving, embossing, or stamping on a sheet of metal is one option; however the metals that are easiest to stamp are ones that melt in a house fire. They could be put in a glass jar that's filled with aerogel and buried. These is the best readily available option for most people but it really can be tedious.
  • The cryptosteel is another ready-made option
  • Have the words etched onto glass at home with off the shelf products; but be carful of this idea because the glass can shatter from impact and heat or even sudden temperature changes
  • Anodize the words yourself on a pieces of metal, there used to be a service to help use your home printer to print the words with some chemicals you can buy
  • Bake them in clay, then encase that in epoxy resin so it can't shatter. then paint the outside, in the future you can solvent the paint off and see the written seed
  • Use a combination of techniques to split the seed so that it is safe(because split and separated) and redundant (because backed up).
Characters stamped on Aluminium is probably the most cost effective way to keep a secret key or seed safe from fire and rot.
submitted by ProfBitcoin to btc [link] [comments]

What stopped my hacking spree in 2016

Hello, I am back. So before I start, this is not a deep web or darknet story, this is just a true story on why I stopped hacking blind.
Back in 2016 I was in a hacking group, now I'm not going to say what our name was, it wasn't very popular but we were in the realm of twitch raiding. Our small group of about 9 would go on twitch and find children or just anyone stupid enough to do what "Twitch support" says. I called this game Simon Says, because we would social engineer these people to give us their streamkey and we would IP log them, then DDoS them offline and hijack their stream. I can admit back then we didn't give a damn, we would stream isis home movies on these children's stream, just to watch for that message saying "This channel has be deleted due to term violation". I will admit, we did do good. We started up going this popular camera chat website, I'm sure all of you have been on before. I know there are a lot of naked pervs on there with their you know what's out. If you typed the right tags and search terms, you get to the real pedophiles, and I'm talking about vpns and proxies asking S2R and bitcoin. Yeah, I know what you're thinking, you've been on that site and never came across them. I know some individuals of lizard squad were wanting to take down pedophiles too, but didn't know they were on that site. After a while of reversing polarities and ratting, We moved onto mass scanning. Back in the 90s there was this program called Defcon, and it was like a telephone port scanner, I downloaded a copy of it and tried to decompile it.. With no success. So I wrote my own version of it, but more modern day. My Defcon would grab a text file of randomly generated IP addresses and it would try to connect to port 23 on each ip. One day running a scan I picked up a telnet server, and I immediately open a telnet client on my computer and connected to this server. I sat there for a good 7 hours trying every possible username and password, and still got nothing. I sent the IP and port to some of the members and I went to bed. I woke up to a message containing the words "Guest:Password", I immediately start a group call. Now it would of been about 3:30 AM here in australia at the time. I dread to think who was sleeping. I said how Jack found the username and password, so we all stupidly try to log in to the same guest account at once, and only I got in. I shared my screen on skype and tried going through the logs of this mysterious server to try to find what it is. We were guessing at what it could be. A member we are going to call Jake due to I don't want to drop anyones dox, now Jake thought it must of been a power plant or a water plant. I thought it was most likely an ISP switch, because that's mostly what I would find and break into. We all were taking our guesses on what it could be, so I go in deeper into the server and start changing some values and ones and zeros. After messing around changing crap and creating random files and folders with stupid names, I found in the root folder an ID block. SSH session keys and a lovely ID that says "Children's hospital". I start swearing over and over, a few people left the call and didn't want to know what they just read. I trace the IP from an online ISP IP tracker. The IP came back to Bangkok. I google all over around for a children's hospital in Bangkok and found nothing. A day went past, after I threw away the IP Address and I hadn't slept. I set up google to notify me when something in the news feed containing the words "Bangkok", "Hacked", "Hospital". Three sleepless days later, I get an ding. Now, I don't know if it was just a coincidence or if it was some joke and I'm paranoid and it's from the lack of sleep. I hesitated clicking on it, I was hovering my mouse over the link, trying to click it but couldn't. Instead of clicking it, I broke down crying about what I did, because, it turned out that the settings I was messing with, after my friend Jack logged back in via a ratted relay, the settings were for life support systems. I was hoping it was all just a dream. I spent the next 3 to 5 months in complete paranoia from it. I ended up leaving the group and trying to run from what I did. I joined a new group, new hackers, had no idea about what I did. I taught them were to find pedophiles, and we set up this gig were we would extort pedophiles for bitcoin and give them our word we wouldn't call the police if they donated some coins. Of course we went back, and tipped off their local tipline and sent screenshots with faces and of the gross content. I couldn't really do it anymore and I kept being reminded of my past and what I hacked into, so I tried to leave this group. But I got messed about with my cut of coins, so I just left. Very annoyed. I tried to join another hacking group for a bit, but still the same thing, I couldn't run from the guilt, so I just stopped all together. And now 2018, I just write crappy programs and I teach people on youtube how to also write these programs. I think about what I did every day. People tell me it's not my fault, I was a stupid kid, but I always feel and know it was. It always eats at me all the time. It is my greatest shame. I tried to go back and find the news report just to know how many children I might of killed, but I couldn't find it anymore. I do not have access to that email anymore and that really anoys me the most. I am sharing this because I hope it help me try to not be eaten away from it, so I can move on with my life and do something great So for the next young 16 or 17 year old who goes on a hacking spree, just know what you're breaking into first. =======Feel free to comment and redistribute this in anyway you want, even if it's just to throw me over the hot coals.========= Thank you for taking the time to read all of this. -S.C
submitted by GhostedFredo to DarknessPrevails [link] [comments]

What is wrong with my current cold storage method?

Today we are going to discuss cold storage and some specific problems with cold storage. While this applies directly to the Secret Key portion of a key-pair; it also applies to the seed used to back up HD wallets and hardware wallets.
The best way to keep you seed/secret key safe is to have multiple copies in multiple locations perhaps with multiple formats and even better if the keys are split. However not everyone has access to multiple locations, or access to land long term, or more than one place to store their things. This is an examination of faults with individual methods; and not a comprehensive plan, obviously.
Not to say everything is all bad but there are many potential weakness out there, and some in the Bitcoin and crypto community like to know the edge cases of things.
I will also highlight some of the aspects of the Keyois Capsule which is a 'physical bitcoin'.
A physical Bitcoin is a cryptographic key pair, a physical key printed and affixed to what has always been before a coin. The first physical bitcoin coin was the Casascius coin, since then the world of physical bitcoin coins has blossomed as a fun part of the Bitcoin world.
We will focus on mediums relating to cold storage and not ones designed for more everyday use, but this applies to the seed you save to keep your everyday spending wallets safe and backed up.
We will assume you generated your keys securely and that you already have them on some medium. We will also have to ignore endpoint physical security because they can all be carried away the same. Remember your cell phone /hardware wallet/ computer client are only as good as where you put the backup seed phrase, which can be thought of as data much like the SK discussed below.
Written on a piece of paper
Printed on a piece of paper
On laminated paper
Engraved / etched/ ablated/ stamped on a piece of metal
Stored digitally on a computer
Stored digitally on CD, floppy disk, laserdisc, or mini-disc
Stored digitally on a flash drive
Backups are essential for digital data Computer code for performing operations can be corrupted in transfer or in operation. Special systems exist and procedures help data to last longer. For ideas, see this archive.gov page Remember to store in multiple locations. You can lose everything in single structure
A physical bitcoin coin
**What can solve most of these problems? A combination of good backup procedures and encryption. **
If you have permeant access to more than one location (people who live in big cities, without family or cars have a hard time with this) or have people you trust with your money (don't) then look into using some form of Multi-signature option.
The Keyois Capsule is a crypto piggy bank; it can be funded from the outside but you to break it open to get them out. You give me a BIP38 encrypted key pair (well the address not the public key) and I engrave it in this tamper evident and time resistant package. You still have to hold on to the pass phrase that allows you to decrypt it; that is however the same problem as all methods with BIP38 encryption. How to store this without having to trust anyone but still being assured of it's security?
  • Engraving, embossing, or stamping on a sheet of metal is one option; however the metals that are easiest to stamp are ones that melt in a house fire. They could be put in a glass jar that's filled with aerogel and buried. These is the best readily available option for most people but it really can be tedious. - This puts you back at anyone who can see it can steal it so dip in plastic dip, wrap in duct tape, bake in clay, encase in concrete, whatever just don't leave unencrypted keys visible!
  • The cryptosteel is another ready-made option
  • Have the words etched onto glass at home with off the shelf products; but be carful of this idea because the glass can shatter from impact and heat or even sudden temperature changes
  • Anodize the words yourself on a pieces of metal, there used to be a service to help use your home printer to print the words with some chemicals you can buy
  • Bake them in clay, then encase that in epoxy resin so it can't shatter. then paint the outside, in the future you can solvent the paint off and see the written seed
  • Use a combination of techniques to split the seed so that it is safe(because split and separated) and redundant (because backed up).
The most cost effective way for a 'normal' person (without their own land, without more than one location, and who cannot trust anyone else with their funds) to keep their backup seed/ secret key safe from damage from the elements would probably to buy a stamping kit and hammer and some stainless steel sheet or bar, Aluminium can be okay if you have the right alloy but better safe than sorry.
submitted by ProfBitcoin to Keyois [link] [comments]

The Infamous Defcon Bitcoin Briefcase The Eleventh HOPE (2016): Best Bitcoin Wallets For 2016 Mark Nesbitt - Hacking Cryptocurrencies - DEF CON 27 Block Chain Village Is Bitcoin a Good Investment (Updated for 2016)

We also briefly discuss the implementation of BIP91 and Segwit2X, and whether a Bitcoin hard or soft work is still a possibility. Danny, Eijah, and Trace are all in Las Vegas getting ready for DefCon. Hacking bitcoin and blockchain Both bitcoin and blockchain are vulnerable to attack. Here's what you need to know to protect yourself and why blockchain is becoming a foundational technology. defcon.org media.defcon.org defcongroups.org. DEF CON Dates. DEF CON 28 SAFE MODE August 6-9, 2020 Online. DEF CON 29 Aug. 5-8, 2021 Book a Room! DEF CON 30 Aug. 11-14, 2022. Speaker's Corner. DEF CON CFP: Thinking Back and Moving Forward by Nikita. Bridging the Gap: Dispersing Knowledge through Research Presented at DEFCON by Aditya K Sood, PhD Its publication comes about six months after Brainwallet.org, the most widely used Bitcoin-based brain wallet service, permanently ceased operations. The service voluntarily shut down following Weston is currently working on the application security team of NCR Weston has recently Spoken at DEF CON 22,23 and 24, Blackhat 2016, HOPE11, Hardware.IO 2016, Takdowncon 2016, ICS cyber security 2016, Bsides Boston, Enterprise Connect 2016 ISC2-Security Congress, SC-Congress Toronto and over 60 other speaking engagements from regional events to universities on security subject matter.

[index] [25025] [5137] [26097] [13619] [17210] [30169] [24530] [2391] [12216] [9066]

The Infamous Defcon Bitcoin Briefcase

After landmark arrests of prominent cyber criminals Bitcoin faces its most severe adversary yet, the very banks it was built to destroy. Banking on Bitcoin full Movie Watch Online Banking on ... As the chart below indicates, when the signal formed in 2016, Bitcoin proceeded to rally by over 4,000% in the year and a half that followed. Just a quick video discussing the Ethereum related talks I saw at DEF CON 25. Porosity Solidity Decompiler: https://github.com/comaeio/porosity Hacking Smart... In which I meet some clever hardware hackers at Defcon who built this awesome Bitcoin vending briefcase. Like what you see? Donate with Bitcoin to 1JqU22aWrv... Presentations from the DEF CON 27 Blockchain Village. DEF CON 23 - Samy Kamkar - Drive it like you Hacked it: New Attacks and Tools to Wireles - Duration: 45:31. DEFCONConference 94,870 views

Flag Counter