Bitcoin Forum

Dear Crypto Community

Recently there have been alot of newbie accounts that have been quoting a coin developers posts or original posts with download links and changing them to ones that contain keyloggers/remote admin/botnets etc.
This is affecting a lot of people and a lot of people are losing money/personal info/passwords/interest in coins (as they have been robbed and don't want to start again) etc


To help combat these willy heads I suggest all devs remove/ban all download links for wallets in OP's etc and have only a link pointing to there website that will contain all needed clean downloads.


Or self moderated threads use this:

https://bitcointalk.org/index.php?topic=850210.0

Edit File deletebot.yml to your thread details and set Minimum Activity to the number you desire. This will allow the attacker to post but within 60 seconds or whatever you set sleep to the post will be deleted by the bot if... The users username is in the file "lusers.txt".... or the user has lower activity than what you set under "minimum activity" resulting in a nice clean friendly thread free from trolls/malicious links/FUD etc



Another thing we can do is keep an eye out for quoted posts containing said download links by hovering over each link and checking in the bottom left of your browser that they correspond, If they don't REPORT!
I have been requoting these attackers with warning messages but removing the link to reduce the spread until the mods delete the post like this :
https://bitcointalk.org/index.php?topic=979296.msg10846708#msg10846708


So far it has affected these communities that I'm aware of but there are probably many, many more:

FonzieCoin
10K Coin
TwisterCoin
GlobalCoin
PayCon
Tecoin

I know there is an element of "serves you right", but there are new members joining the crypto community every day. Some, pretty clued up. Some, not so much. But i hope we can pull together as a community and stop this BS getting out of control and before they form the biggest botnet the world has ever seen!

This is the latest account I have found to be posting these attacks. Check post history the only links he/she changes are the windows qt's that I can see:

https://bitcointalk.org/index.php?action=profile;u=486350

Please play safe and if you have any other idea's please post them below, spread the word. Awareness is everything!

Love you all

Mr Fista


Update:


Safer download distribution:

-FonzieCoin
(https://bitcointalk.org/index.php?topic=979296.0)

-


-


-

If you would like your coin to be added to the SDD list, please remove all download links from your thread and only host them on your official website and have a link in your OP to the official site. I will get a logo made you can add to your announcements to show people how much you care about your community.

No need to save the people who buy/mine these shitcoins. The deserve to loose their money

That's the attitude I was hoping to avoid.... And people that cant spell

What is a "shitcoin" to you?

Don't be a dick GTO911. Not everyone interested in crypto currencies has loads of IT & internet experience, nor do they deserve to get hacked just because they choose to experiment with the latest new coin on the first page of the announcement forum when they first start trying to figure out what's going on. Everyone has to start somewhere, and crypto needs lots of happy enthusiasts, not nasty knee-jerk comments parroted from all the other dicks peddling hate on this forum.

Your attitude towards other crypto users is pathetic

Thank you very much for this, it is a huge service to the community. Something like quoting malicious links has nothing to do with the coins associated and everything to do with helping people not download wallet stealing virus's.

Not all Coins have a secure website for download

What would you suggest for Coins less established that can host more secure wallets? Maybe the Github as repositories and put together a guide or information on how to set that up.

I think competition is fine in the marketplace and people aren't going to stop creating Coins so would be best to atleast help them keep other users safe by helping educate them on best practices.

Devs without websites can just add windows/mac etc mega/mediafire/gdrive links to there github readme. and then just have a github link in OP? I'm just testing XSTerminate at the moment. I have edited the config file to help people a bit more and put it in the OP. Its a really good tool to set minimum activity to post and have a ban list. Check it out!!!

How can you set a minimum activity to post and ban list without having a self moderated thread? Would that moderate the thread?

I don't think minimum activity to post would work because you do want newbies to be able to ask questions. What if someone found the thread that day and then got the wallet but had questions to ask, you'd have to wait a week or so before you could get a hold of someone.

My bad it is self moderated threads, also newbies can pm anyone for the information they need?

read this post, but there is a mistake with Twistercoin.
Wallet was checked with virustotal scanning services and was safe.
all users agreed saying wallet was safe.

however, it should be better doing viruses check on wallets before installing

I think you warning people to be carefull does help a bit.
To secure the whole forum is kinda impossible i think, the only real thing we can do is find out ourselfs if something is having fraudulent product in it.
Alot of these coins never survive after they got a few pumps and dumps and i think these developers actually not care if it contains a coinstealer and other trojan.
The only way to make sure to try to not become a victim is trust your antivirus product that when it says it trojan not to try it yourself.
I think the people without tech knowledge should ask the community to test if something is safe or not
Ofcourse we all know that antivirus products go over the top with reporting some very safe products like miner programs (bfgminer/cgminer/ccminer/sgminer) but on the other hand some people/firms get/got infiltrated with smart scripts who installed a secret miner on hundreds of computers without the owners knowing ( most of the time those people was looking at some kinda funny/sexy stuff)
Or get fooled by some kinda email asking them to NOT click or do click something ( we all know people look/click without thinking ;) )
Alot of nasty stuff can be installed on any machine with the aid of the developing tools made for any product.
It does not help to warn people not to look at emails for instance that was not initiated by you, like emails coming from your local bank.
Still people open them without thinking, so its very hard to protect people against these risks.

We are not talking about released clients. We are talking about attackers quoting devs posts like on twistercoin (which has been deleted now since I reported it.) and replacing the windows qt links with a malicious one. No one is saying a wallet is not safe....

Couple of months ago I suggested newbies accounts to be prevented from posting threads in the Announcement sections, but seems like mods are not interested.

Being honest here, I've done something similar on BTT a couple of times in the course of one of my little disputes/mega arguments, except not actually pointing to malware, but to a scam alert site.  It's incredibly easy to do, and an effective way to disrupt someones thread.
You'd be amazed how many people blindly click a quoted link without ever checking it.....

Good idea from SF, and we should be alert for this shit.
Never click on a quoted link within BTT without checking out exactly where it's taking you.....

mudder's sock/ candygirl Crestington wasn't too concerned about our security when he posted this suspicious link.  hmm..


Do not fall for this public relations stunt guys. They are doing this so that they can appear to be looking out for us/ "one of the good guys".

They do not want you clueing into the fact that this staged CON vs PYC clone war is IFCv2/COL vs IFC all over again.

What the fck are you on about? I have nothing to do with CON or PYC. I'm only doing this as today I spotted more faggots trying to cloak malicious urls in quotes again (Paycon,FonzieCoin,Tecoin) in fact 2 of these coins I hadn't heard of till today (Paycon,Tecoin). I was hacked a week or so ago and was affected badly because I was dumb and clicked these links. Lost alot of money/time changing passwords taking 2 days off work. I am looking out for you guys and yes I am "one of the good guys". I think your smoking to much crack and coming up with crazy stories. Don't come in here accusing me of doing this because of other reasons. I have been a solid member of this community for many years and haven't put a foot wrong. I am in the U.K and I made this post at 5am when I should be in bed. I started discovering these dodgy posts around 2am. So I don't care.... but I will stay up all night trying to help people, Logic.

Go sit on one.

You call this fake public relations?
3:49am
 https://bitcointalk.org/index.php?topic=979296.msg10846708#msg10846708

I made 3 of these posts today for the 3 coins above to help there community (which i'm not part of except making a logo for fonziecoin) not get fcked, got really pissed this is still happening without anything being done about it. So I decided to make this post . Come up with some ideas.... You happy with my story hippie keyboard warrior?

I quoted a meme from google, in what way was it supposed to be malicious since it's only a visual image?

PYC? you do know that there are many Coins, some with the exact same name.... like for example there is PYC and XPY and both are named PayCoin, and then you have all the Doge, LiteCoin and Darkcoin clones as well.

When it comes to this CON/COL/IFC/ADT/cryptsy crowd, everyone is guilty by association until proven innocent. :P

Is it merely a coincidence that you seem to be involved/interested in each and every coin that is allegedly being attacked ?

I think not ! lol

That's because he was in a thread and clicked one of the links, you don't have to own any of the coins to get hit by it, then he traced where they were coming from and notified threads in which it was posted on.

Read this: https://bitcointalk.org/index.php?topic=243911.msg10709087#msg10709087
get your fact right FUD cretin

I expect an apology

Yo Fista.

Why are you fighting with people on the internet?  There is no point.  Helping folks is an invitation to trolls, you know this. You have given some good info, let them talk trash.  You have helped the community, if people want to heed, they can, otherwise don't play their childish games.

Your right man, just find it worrying we have a "legendary" member coming out with these kind of accusations when they clearly don't know me.

Ok so lets get back on topic,

In what ways would be best for a trusted source? What is the best method for setting up sha checksums?

Now why would anyone want to waste their time hacking into your account so they could post malware on your, almost 2 year old, cryptsy shitcoin ?

I stand by my previous statement(s).

You cant expect new members/joe blogs to check checksums. We could all work together and set up a client download site, where any dev can upload there latest wallet, have there own page with there coin
 info, subjected to a virus scanned before link goes live. Obviously the site owner will have to be trusted not to alter any wallets etc... Would be kinda like a dedicated github for only crypto's

Devs would then just put a link like http://wehostwallets.com/megacoin in there OP ( this would not be a direct download link ) That wouldn't solve anything

This would also cut the cost of hosting for devs

Just an idea... discuss

Fuck me!! are you still going? haven't you got a box to go home to? Even after I show you this you disregard it and carry on with your own fairytale.

Yeah that could be a good idea, I think hosting with Github would probably be good, could just have someone keeping the wallets downloads safe. You could have lots of trusted sources which host different wallets as a service by donation as a list and then just lick to the source instead.

But that would mean that you'd also have to get the source updated whenever there is a new wallet.

Using git as a download repo for qt's would be a nightmare :). I was suggesting a dedicated site like a github clone that would host only the QT's, run by donations by someone who is well trusted to do the job. Make all wallets hosted read-only server side. No more dodgy devs, no more cloaked urls etc.

I'm talking, each coin has a dedicated landing page with there coins info for people to read up on and have all links needed, which would have been pre scanned for viruses with a virus total report under each link.



ORRRRRRR


ask cryptsy to host links here for eg. https://www.cryptsy.com/currencies/view/42
 
and then have devs point users to cryptsy if exchangeable there, for wallet links

Not sure if Verns up for that though

This is all on the basis that devs are wanting to do this as well which I'm sure some wont.

Thanks Fiesta.

People should always scan files /websites before downloading anything from the internet.

Good Antivirus with latest updates and Malwarebytes Premium (well worth the money) is crucial.

Also there are good online scanners e.g.

https://www.virustotal.com

http://quttera.com/website-malware-scanner.



I think you deserved some PayCon.

Post your adress in PayCon thread pls so i can send you some when i´m at home from work :)

It would probably just be better if Bitcointalk in general disallowed links to executable items from low post count accounts. If you need a minimum activity in order to post links in general then that doesn't stop newbies from posting on threads but it would stop them from posting links. It would be better to just disallow low activity accounts to post links, what would be the motive for a newbie account to post a link to an executable anyways? If you really had your heart set on launching a Coin with a new account, you could take the time to wait a week or two and make some posts in general.

Yeah that's another good option, having BTT disallowing newbie's from posting links would help a lot! Then again these attackers are not posting links, they are just quoting devs so they would also not be allowed to quote any post with a link in it. Hopefully we can get some devs behind this movement to keep everyone just that little bit more safer, also have it as an unwritten rule that no one is allowed to quote links/urls

:)

But that is posting links, they quote the topic and change the link. If links were disallowed for new accounts then the quoted topic would have the link dissallowed

He has brain damage or his account was hijacked long ago. The amount of trolling he does is ridiculous.

I absolutely agree what has happened is wrong and bad for crypto, but I think the solution is not to download wallets from random posts or users and only from first post of original ANN or a known dev post.

Thing is, we can alert people to this and to only download links from OP. But dev accounts get compromised and new folk join every day. How will they know not to download links that have been quoted etc

We need to "nip it at the bud", give them no opportunity.

So far the easiest way that has been suggested would be to disallow accounts quoting/posting links less than a certain activity threshold.

Keep the idea's flowing

not sure if i understood you solution correctly.


What i understood so far is that you think lunching a common site where all the "dev" can upload their wallets and on this forum they can hot link only to this site?

Again , i could be wrong but if this is the case its a pretty bad solution. Not only is centralized. It will lead to competition. next thing you know this site will be asking for BTC to be up in que or top link.  

No thanks. I can think of a thousands abuses this solution or alike solutions will bring to this space.  

nvm i read it better now. for some reason i felt like it was focusing on lunching a site.. ignore me : )

I think he's a troll from the beef council. I am seriously turned off to the whole cow hugging movement by shitheads like hippytech.

Anyone feeling hungry?

http://www.tabletalkatlarrys.com/wp-content/uploads/2011/08/Barbecue-ribs.jpg

https://adsoftheworld.com/sites/default/files/images/ChickFila01Lg.jpg

Will do! And beef too.

Oh man you guys are making me hungry, I can make the best barbecue ribs you've ever had.

He's selling the shitty links in his sig. Hoping to get a few clicks.

His trolling is basically spam (a highly underrated protein source by the way).

http://i.kinja-img.com/gawker-media/image/upload/s--vNkuZsnB--/18bgeimmain3fjpg.jpg

I don't want any reward, I just want this to be a safe as possible community. Thanks for the offer though

And you deserve whatever bad things have happened to you. Life hasn't been perfect for you has it, asshole? Unemployed? Angry? Girlfriendless? Ugly? Fat? There's a reason for your misfortunes. It's because you are a shitty person.

And XMR is a clone of Bytecoin with literally NOTHING new.

If you are going to call out shitcoins, you should get out of yours first.

A shitcoin is any coin that is not Bitcoin or Namecoin.

Basically, any coin without a useful purpose or reason to exist other than to exist is a shitcoin. Changing a few parameters to make it "different" than bitcoin is not a sufficient reason to create a new coin. Creating a new coin to serve an entirely new purpose, such as Namecoin, is not a shitcoin. Litecoin, the first shitcoin, is a perfect example. It serves no purpose, other than to change some aspects of Bitcoin, but is otherwise exactly the same and serves as nothing but a proxy for bitcoin.

A lot of people work very hard on creating a coin to serve a purpose. Without "shitcoins" there would be slow/no innovation. Bitcoin was a "shitcoin" compared to fiat currency in the early days, but people adopted it much like alt's people will accept the few projects that show promise. I don't know if your new around here but now-a-days most devs don't just "change a few parameters". "shitcoin's" are also a great ways to test new ideas and if people like them, then they will be successful if they don't they will be classed as shitcoin's by people like you that have no idea what their talking about. Users then read your comments and lose faith, then the dev gives up at making new innovations/tending to there community and move on to the next project.

Also a lot of devs run beta tests to "test the water" and offer people the chance to have there say, before committing to releasing a full blown project that could go bad and make them look incapable.


This is not a thread for your views on "shitcoins" so I ask kindly if you would keep on topic and stop answering for other peoples.

Yet another pillar of the community bashing other peoples hard work. Great

Thanks 7 post noob. You are a worthless copy of your parents with no substantial changes.

So you are a shit-person by your own uninformed, brain-dead logic.

With 7 posts, you likely know nothing that you talk about. Go back to reading the comments section of USA Today articles for your "knowledge".

Meanwhile, it takes 6 weeks to sync bitcoin and transactions only take an hour and a half to confirm.

Let's not attack people for calling shit-coin and whatnot (don't feed :) )

I personally find it's better not to reply or change the subject otherwise you get off-topic and end up arguing with people. The easiest way to end an argument is just to agree with a person, pretty hard to fight with someone agreeing with some points and maybe correcting bad information without insulting them too much. Arguing on the internet is like the special Olympics, even if you win you are still a retard for participating ;)

Lets get some more ideas going and see if we can come up with some good, safe methods for people. I could put together a guide for people but I am more along the lines that the answer needs to be a simple and easy thing to do, think off everything with the KISS principle (keep it simple stupid).

Someone asked what a shitcoin was. I did not bring up the topic. I'm sorry if you feel that I have somehow tread upon your sacred cow, but the fact of the matter is, all coins that don't provide a utility beyond what bitcoin already provides are shitcoins. Yes, they may provide some innovation and insight into how you could improve bitcoin, but that does not make it somehow "not-a-shitcoin." It's still a shitcoin. I never said shitcoins can't be useful, because they certainly can. It doesn't make them good coins though.

If a coin doesn't provide some utility beyond what's already provided by another coin (namely Bitcoin or Namecoin) then it is by definition a shitcoin.

TLDR - OK bro, move along now please. Thanks for teaching us about your unwanted poisonous views. Clearly most of us have been around long enough to know what your saying is your deluded opinion. Folk like you are not wanted in this discussion and boggles my mind how you are even here in the "shitcoin" forum if you hate them? Obviously you have to much time on your hands and over opinionated.

BACK ON TOPIC OR REPORT!

After a search for Tecoin, I've discovered this thread. I'm here to clear some stuff up. If I or any of the Tecoin community sees a clone post, we'll be first on the scene to report it.

This is the ONLY Tecoin thread, made my myself - the new Tecoin developer:

https://bitcointalk.org/index.php?topic=1006784.0

I'm only posting this here to avoid any FUD (FUD as in worry, not fully-undetectable). I understand the thread is a bit old, and doesn't need a bump, but, I'm here to let anyone know who's Googling Tecoin that this is not happening after the community takeover.

Thanks :)

Ok

The issue was about new users quoting topics and replacing with malicious links, I wonder if we could make a community warning force.

I've actually seen a few clone threads, too. Username looks similar to the actual dev's, too. It's a typical method of phishing. Say someone were to try to make a Tecoin thread under the name GaneOfBit. Some people could mistake the "n" for an "m", and think I made another thread. People download the "Qt" that's really just a RAT disguised as the Qt, run it, and they're infected. Same thing happens on Steam all the time. Spambots message you saying they want to trade for your CS:GO item, with a Steam phishing site attached.

Ok, good to know

What do you have for ideas in ways to combat this?

None, really. Just put a sticky up warning people to double check.

Those listed above.

A shitcoin is any coin that isn't BTC or NMC. Until a coin comes out that serves a purpose beyond being a proxy for BTC, it is by definition a shitcoin. NMC is the only coin other than BTC that serves a useful purpose.

What do you think of chongchang coin?

http://i.ytimg.com/vi/nKZ57nZExYU/hqdefault.jpg

A profoundly unheroic post. Reflects quite badly on your judgement.


Cheers

Graham

I wasn't aware there were standards a persons rank should stand on?

Pffft.. please...  Since when do people take the altcoin section seriously.

Just an emergent property. It's hard work being a dick all of the time so the longer someone's been around, the less of a dick they are, generally. There's always an exception that proves the rule, though.

Cheers

Graham

People should stop mining and supporting shitcoins, thats the only solution.

So what coins are not shitcoins?

Shitcoins are usually premined, clones, forks etc well you know better than me  ::)

That's like 99% of them.  :)

What do you think of NEM and NXT?  Are they shitcoins?

Yup.  Totally. 

What are the coins good to invest in?

Of course they are shitcoins. What purpose do they serve?  Absolutely nothing. Nobody takes them for goods or services. The only thing you can do with them is trade them for other shitcoins or bitcoins or sell them for fiat currency. That is the very definition of a shitcoin.

POS coins  ::) how else they would distribute? NXT,NEM > New source code afaik.

Any coin that I don't own is a shitcoin. That's the usual definition.

So they are shitcoins? ... because they are premined like you said.

Lets get back to ideas of an easy and secure way to host wallet downloads, what are the best practices?

This.  

That's why the discussions in the alt boards are biased and skewed and it's hard to take it seriously.  It's full of sockpuppets, fudsters and cheerleaders.  

It's pretty entertaining though..  ;D

I've giving up caring about cloning, it won't stop people from making Coins. Would be good to have some safe methods to protect people from getting their own Coins stolen which is more important.

Damn Troy, even your sock puppets are Hero members now  :'(

I'm not Troy but flattered you think I am, I do development work on two Coins and everyone thinks we are the same person.

we had another attempt of malware planting in the quoted post with a changed link in the XDE coin thread.
The user attempting that is djemphol and he did it in this deleted post:
https://bitcointalk.org/index.php?topic=841830.msg11104121#msg11104121

This is serious, people.

A lot of the folks coming to Bitcoin (and altcoins) these days are newbies. 

And there's a serious problem for newbies with keeping their computers secure.  They need all the help they can get.  And yes, some of them haven't learned yet that they oughtn't download crap without checking it thoroughly before running it.  But that doesn't mean they're bad or stupid people; it just means they need help.  Raising awareness of the issue by posting warnings in-thread whenever you see something intended to rip them off is a good start.  Deleting posts that contain malicious links is important too. 

I would recommend that such posts ought to be replaced by a message that says exactly why the post got deleted, as a warning to newbies reading the thread that this is a thing that happens.  Newbies probably do not know what things they need to be alert for.